chore: Add the PQC conformance tests

.github/workflows/conformance-tests-gax-showcase.yaml

@@ -10,29 +10,29 @@ jobs:
     gapic-showcase:
         runs-on: ubuntu-latest
         env:
-            GAPIC_SHOWCASE_VERSION: 0.36.2
+            GAPIC_SHOWCASE_VERSION: 0.42.0
             OS: linux
             ARCH: amd64
         name: GAPIC Showcase Conformance Tests
         steps:
         - name: Checkout code
-          uses: actions/checkout@v7
+          uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
 
         - name: Setup PHP
-          uses: shivammathur/setup-php@v2
+          uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 #2.37.2
           with:
-            php-version: '8.1'
-            extensions: grpc
+            php-version: '8.2'
+            extensions: grpc-1.83.0
 
         - name: Install and run GAPIC Showcase
           run: |
             curl -L https://github.com/googleapis/gapic-showcase/releases/download/v${GAPIC_SHOWCASE_VERSION}/gapic-showcase-${GAPIC_SHOWCASE_VERSION}-${OS}-${ARCH}.tar.gz | tar -zx
-            ./gapic-showcase run &
+            ./gapic-showcase run --port :7469 --tls --ca-cert-output-file Gax/tests/Conformance/showcase.pem &
+            sleep 2
 
         - name: Install dependencies
           run: |
             composer update --prefer-dist --no-interaction --no-suggest -d Gax/
 
         - name: Run PHPUnit
           run: Gax/vendor/bin/phpunit -c Gax/phpunit-conformance.xml.dist
-

Gax/.gitignore

@@ -20,3 +20,5 @@ src/Jison/Parser.js
 
 # VS Code
 .vscode
+
+*.pem

Gax/README.md

@@ -80,12 +80,20 @@ be found for Mac or Windows.
     > vendor/bin/phpunit
     ```
 
-4.  Run static analysis tools
+4.  Run conformance tests (requires [GAPIC Showcase](https://github.com/googleapis/gapic-showcase)).
+
+    ```sh
+    > ./gapic-showcase run --port :7469 --tls --ca-cert-output-file tests/Conformance/showcase.pem &
+    > vendor/bin/phpunit -c phpunit-conformance.xml.dist
+    ```
+
+5.  Run static analysis tools
 
     ```sh
     > phpstan -c phpstan.neon.dist
     ```
 
+
 ## License
 
 BSD - See [LICENSE][] for more information.

Gax/tests/Conformance/PqcShowcaseTest.php

@@ -0,0 +1,105 @@
+<?php
+/*
+ * Copyright 2026 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+declare(strict_types=1);
+
+namespace Google\Generator\Tests\Conformance;
+
+use Google\ApiCore\InsecureCredentialsWrapper;
+use Google\ApiCore\RequestBuilder;
+use Google\ApiCore\Transport\GrpcTransport;
+use Google\ApiCore\Transport\RestTransport;
+use Google\ApiCore\Transport\TransportInterface;
+use Google\Auth\HttpHandler\HttpHandlerFactory;
+use Google\Showcase\V1beta1\Client\EchoClient;
+use Google\Showcase\V1beta1\EchoRequest;
+use Grpc\ChannelCredentials;
+use GuzzleHttp\Client;
+use PHPUnit\Framework\TestCase;
+
+class PqcShowcaseTest extends TestCase
+{
+    private const TLS_GROUP = 'x-showcase-tls-group';
+    private const TLS_VERSION = 'x-showcase-tls-version';
+
+    public function provideTransport(): array
+    {
+        $pemPath = __DIR__ . '/showcase.pem';
+        $host = 'localhost:7469';
+
+        // gRPC Configuration
+        $pemContents = file_get_contents($pemPath);
+        if (!$pemContents) {
+            $this->fail('Could not read showcase.pem');
+        }
+
+        $grpcTransport = GrpcTransport::build($host, [
+            'stubOpts' => [
+                'credentials' => ChannelCredentials::createSsl($pemContents)
+            ]
+        ]);
+
+        // REST Configuration
+        $restConfigPath = __DIR__ . '/src/V1beta1/resources/echo_rest_client_config.php';
+
+        $requestBuilder = new RequestBuilder($host, $restConfigPath);
+        $guzzleClient = new Client([
+            'verify' => $pemPath
+        ]);
+        $httpHandler = HttpHandlerFactory::build($guzzleClient);
+        $restTransport = new RestTransport($requestBuilder, [$httpHandler, 'async']);
+
+        return [[$grpcTransport], [$restTransport]];
+    }
+
+    /** @dataProvider provideTransport */
+    public function testPqc(TransportInterface $transport): void
+    {
+        $expected = 'This is a test';
+        $expectedGroup = 'X25519MLKEM768';
+        $responseHeaders = null;
+        $metadataCallback = function (array $metadata) use (&$responseHeaders) {
+            $responseHeaders = $metadata;
+        };
+
+        $echoClient = new EchoClient([
+            'credentials' => new InsecureCredentialsWrapper(),
+            'transport' => $transport
+        ]);
+
+        $echoRequest = new EchoRequest();
+        $echoRequest->setContent($expected);
+        $response = $echoClient->echo($echoRequest, [
+            'metadataCallback' => $metadataCallback
+        ]);
+
+        $this->assertEquals($expected, $response->getContent());
+        $this->assertNotNull($responseHeaders);
+
+        /** @var array<string, array<int, string>> $responseHeaders */
+        $responseHeaders = array_change_key_case($responseHeaders, CASE_LOWER);
+        $negotiatedGroup = $responseHeaders[self::TLS_GROUP][0];
+
+        if ($transport instanceof GrpcTransport) {
+            // gRPC must ALWAYS negotiate PQC
+            $this->assertEquals($expectedGroup, $negotiatedGroup);
+        } else {
+            // REST uses host system OpenSSL (X25519MLKEM768 when PQC is available, or X25519 fallback)
+            $this->assertContains($negotiatedGroup, [$expectedGroup, 'X25519']);
+        }
+    }
+}

Gax/tests/Conformance/ShowcaseTest.php

@@ -22,7 +22,7 @@
 use Google\ApiCore\ApiException;
 use Google\ApiCore\KnownTypes;
 use Google\ApiCore\InsecureCredentialsWrapper;
-use Google\ApiCore\InsecureRequestBuilder;
+use Google\ApiCore\RequestBuilder;
 use Google\ApiCore\Transport\GrpcTransport;
 use Google\ApiCore\Transport\TransportInterface;
 use Google\ApiCore\Transport\RestTransport;
@@ -31,21 +31,37 @@
 use Google\Showcase\V1beta1\Client\EchoClient;
 use Google\Showcase\V1beta1\FailEchoWithDetailsRequest;
 use Grpc\ChannelCredentials;
+use GuzzleHttp\Client;
 
 final class ShowcaseTest extends TestCase
 {
     public function provideTransport()
     {
+        $pemPath = __DIR__ . '/showcase.pem';
+        $host = 'localhost:7469';
+
+        // gRPC Configuration
+        $pemContents = file_get_contents($pemPath);
+
+        if (!$pemContents) {
+            $this->fail('Could not read showcase.pem');
+        }
+
         // build gRPC transport
         $grpc = GrpcTransport::build(
             'localhost:7469',
-            ['stubOpts' => ['credentials' => ChannelCredentials::createInsecure()]]
+            [
+                'stubOpts' => [
+                    'credentials' => ChannelCredentials::createSsl($pemContents)
+                ]
+            ]
         );
 
         // build REST transport
         $restConfigPath = __DIR__ . '/src/V1beta1/resources/echo_rest_client_config.php';
-        $requestBuilder = new InsecureRequestBuilder('localhost:7469', $restConfigPath);
-        $httpHandler = HttpHandlerFactory::build();
+        $requestBuilder = new RequestBuilder('localhost:7469', $restConfigPath);
+        $guzzleClient = new Client(['verify' => $pemPath]);
+        $httpHandler = HttpHandlerFactory::build($guzzleClient);
         $rest = new RestTransport($requestBuilder, [$httpHandler, 'async']);
 
         return [[$grpc], [$rest]];