test: decode baseline tests and CI fixes

[janiussyafiq]

Splits #32 into 3 stacked, independently-reviewable PRs. This is 1/3.

1/3 — decode baseline + CI (this PR, ~160 LoC + cert regen)
Fix CI (retired runner, moved OpenLDAP image, slapd cert expired 2023) and add t/decode.t, which checks decode output against the current rasn decoder through a shim that re-points at the pure-Lua decoder once it lands. No production code changed.

2/3 — pure-Lua decoder, additive (~4,300 LoC: ~510 code / ~3,800 tests)
Add asn1.decode / protocol.decode_message + unit and hardening tests. Nothing calls it yet — rasn still decodes — so the parser is reviewed in isolation.

3/3 — cutover, drop Rust, features (~1,400 added / ~250 deleted)
Switch the client to the pure-Lua decoder, remove the Rust toolchain, ship the builtin rockspec; add the pinned-connection session, RFC 4515 filter escaping, and resty.ldap compat. The t/decode.t baseline then runs against the new decoder and proves it matches the old one.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds LDAP decoding helpers and comprehensive Test::Nginx coverage, refreshes the certificate fixture, and modernizes CI dependency installation with active OpenLDAP readiness checks.

Changes

LDAP decoding test integration

Layer / File(s)	Summary
CI dependency and OpenLDAP readiness setup .github/workflows/ci.yml, .gitignore	CI uses updated OpenResty and Perl dependency setup, removes Docker installation steps, and actively verifies OpenLDAP readiness before testing.
Decoder helpers and protocol coverage t/lib/*, t/decode.t, t/certs/mycacert.crt	Adds fallback LDAP decoding and whitespace-tolerant hex helpers, with tests for response types, binary values, and empty attributes; refreshes the certificate fixture.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• api7/lua-resty-ldap#32: Overlaps on LDAP decoding tests, helper modules, and CI OpenLDAP readiness changes.

🚥 Pre-merge checks | ✅ 6

✅ Passed checks (6 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
E2e Test Quality Review	✅ Passed	PASS: The new tests are isolated, readable, and complement the existing LDAP end-to-end suite; CI readiness and cert updates are coherent.
Security Check	✅ Passed	Only CI/test assets changed; no production code or sensitive logging/serialization/auth paths were added, and cert/key usage stays in CI/tests.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main changes: new decode baseline tests and CI adjustments.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/ci.yml (1)

17-17: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Avoid persisting the checkout token for the test step.

make test executes repository code after checkout. Disable credential persistence unless a later step needs authenticated Git access. actions/checkout documents persist-credentials: false as the opt-out. (github.com)

Suggested change

       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml at line 17, Update the actions/checkout step in the
CI workflow to set persist-credentials to false, ensuring the checkout token is
not retained for the subsequent make test step. Keep the existing pinned
checkout action reference unchanged.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/ci.yml:
- Line 17: Update the actions/checkout step in the CI workflow to set
persist-credentials to false, ensuring the checkout token is not retained for
the subsequent make test step. Keep the existing pinned checkout action
reference unchanged.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 588efa27-7e79-46f2-9e9f-780f51d5f0e2

📥 Commits

Reviewing files that changed from the base of the PR and between fe29c1b and 7ec9faa.

⛔ Files ignored due to path filters (2)

• t/certs/localhost_slapd_cert.pem is excluded by !**/*.pem
• t/certs/localhost_slapd_key.pem is excluded by !**/*.pem

📒 Files selected for processing (6)

• .github/workflows/ci.yml
• .gitignore
• t/certs/mycacert.crt
• t/decode.t
• t/lib/ldap_decode.lua
• t/lib/ldap_hex.lua

[membphis]

LGTM