From e95ec3274ec3fa834d63e3cd7946bfe7df347d3d Mon Sep 17 00:00:00 2001
From: Jay Gowdy <jay@gowdy.me>
Date: Wed, 4 Mar 2026 11:19:59 -0800
Subject: [PATCH 1/2] Ensure integration test failures fail the CI build

Add set -euo pipefail and explicit exit-on-failure guards to all test
commands in integration-test.sh. Prevents silent test failures from
producing a green CI build (fixes #120).
---
 scripts/integration-test.sh | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/scripts/integration-test.sh b/scripts/integration-test.sh
index 715e7ef..87c8263 100755
--- a/scripts/integration-test.sh
+++ b/scripts/integration-test.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -e
+set -euo pipefail
 
 ORIG_DIR=$(pwd)
 
@@ -25,7 +25,7 @@ echo "GOBIN: ${GOBIN}"
 go mod tidy
 
 echo Encrypt with Go
-go test -v -test.run '^TestEncryptFeatures$' -godog.paths="${ORIG_DIR}/integration/node/features/encrypt.feature"
+go test -v -test.run '^TestEncryptFeatures$' -godog.paths="${ORIG_DIR}/integration/node/features/encrypt.feature" || { echo "FAIL: Go encrypt tests failed"; exit 1; }
 
 echo Encrypt and Decrypt with Asherah-Node
 
@@ -34,15 +34,15 @@ echo Installing npm packages
 CXXFLAGS='-DNODE_API_EXPERIMENTAL_NOGC_ENV_OPT_OUT' npm install
 
 echo "Running cucumber-js encrypt.feature"
-./node_modules/.bin/cucumber-js ./features/encrypt.feature
+./node_modules/.bin/cucumber-js ./features/encrypt.feature || { echo "FAIL: cucumber-js encrypt tests failed"; exit 1; }
 
 ### Decrypt with Asherah-Node
 
 echo "Running cucumber-js decrypt.feature"
-./node_modules/.bin/cucumber-js ./features/decrypt.feature
+./node_modules/.bin/cucumber-js ./features/decrypt.feature || { echo "FAIL: cucumber-js decrypt tests failed"; exit 1; }
 
 ### Decrypt with Go
 
 echo Decrypt with Go
 cd "${ORIG_DIR}/integration/asherah/tests/cross-language/go" || exit 1
-go test -v -test.run '^TestDecryptFeatures$' -godog.paths="${ORIG_DIR}/integration/node/features/decrypt.feature"
+go test -v -test.run '^TestDecryptFeatures$' -godog.paths="${ORIG_DIR}/integration/node/features/decrypt.feature" || { echo "FAIL: Go decrypt tests failed"; exit 1; }

From 24dd702a91759c058bd38aa23a423102b236dcca Mon Sep 17 00:00:00 2001
From: Jay Gowdy <jay@gowdy.me>
Date: Wed, 4 Mar 2026 11:23:10 -0800
Subject: [PATCH 2/2] Fix unbound GOROOT variable in integration-test.sh

Use ${GOROOT:-} default to handle GOROOT not being set, which is the
case when actions/setup-go already puts go on PATH.
---
 scripts/integration-test.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/integration-test.sh b/scripts/integration-test.sh
index 87c8263..d8acf72 100755
--- a/scripts/integration-test.sh
+++ b/scripts/integration-test.sh
@@ -12,7 +12,7 @@ mkdir -p "${GO_DIR}/bin"
 export GOPATH=${GO_DIR}
 export GOBIN=${GO_DIR}/bin
 export GOTOOLCHAIN=local
-PATH=$GOPATH/bin:$GOROOT/bin:$PATH
+PATH=$GOPATH/bin:${GOROOT:-}/bin:$PATH
 
 ### Encrypt with Go
 cd "${ORIG_DIR}/integration/asherah/tests/cross-language/go" || exit 1