From 0e0597b7399603d166ddbecb4d21bc22e46550a8 Mon Sep 17 00:00:00 2001
From: Yuansheng Wang <membphis@gmail.com>
Date: Sat, 30 May 2026 21:19:02 +0800
Subject: [PATCH 1/2] ci: test OpenResty runtime matrix

---
 .github/scripts/openresty-smoke.lua      | 38 +++++++++++++++++
 .github/scripts/run-openresty-runtime.sh | 52 ++++++++++++++++++++++++
 .github/workflows/ci.yml                 | 44 ++++++++++++++++++++
 3 files changed, 134 insertions(+)
 create mode 100644 .github/scripts/openresty-smoke.lua
 create mode 100755 .github/scripts/run-openresty-runtime.sh

diff --git a/.github/scripts/openresty-smoke.lua b/.github/scripts/openresty-smoke.lua
new file mode 100644
index 0000000..97f70f5
--- /dev/null
+++ b/.github/scripts/openresty-smoke.lua
@@ -0,0 +1,38 @@
+local qjson = require("qjson")
+
+local doc = qjson.parse([[
+{
+  "body": {
+    "model": "qjson-ci",
+    "ok": true
+  },
+  "items": [10, 20, 30],
+  "none": null
+}
+]])
+
+assert(doc:get_str("body.model") == "qjson-ci")
+assert(doc:get_bool("body.ok") == true)
+assert(tonumber(doc:get_i64("items[1]")) == 20)
+assert(doc:is_null("none") == true)
+
+local decoded = qjson.decode([[{"field":"value","nested":{"n":42},"list":[true]}]])
+assert(decoded.field == "value")
+assert(decoded.nested.n == 42)
+assert(decoded.list[1] == true)
+
+local encoded = qjson.encode({
+    field = "value",
+    nested = { n = 42 },
+    list = { true },
+})
+local roundtrip = qjson.decode(encoded)
+assert(roundtrip.field == "value")
+assert(roundtrip.nested.n == 42)
+assert(roundtrip.list[1] == true)
+
+doc = nil
+decoded = nil
+roundtrip = nil
+collectgarbage("collect")
+collectgarbage("collect")
diff --git a/.github/scripts/run-openresty-runtime.sh b/.github/scripts/run-openresty-runtime.sh
new file mode 100755
index 0000000..83ae71e
--- /dev/null
+++ b/.github/scripts/run-openresty-runtime.sh
@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+: "${OPENRESTY_IMAGE:?OPENRESTY_IMAGE is required}"
+
+workspace="${GITHUB_WORKSPACE:-$(pwd)}"
+libqjson="$workspace/target/release/libqjson.so"
+
+if [[ ! -f "$libqjson" ]]; then
+    echo "missing release cdylib: $libqjson" >&2
+    exit 1
+fi
+
+docker run --rm \
+    -e DEBIAN_FRONTEND=noninteractive \
+    -v "$workspace:/workspace" \
+    -w /workspace \
+    "$OPENRESTY_IMAGE" \
+    bash -lc '
+set -euo pipefail
+
+OPENRESTY=/usr/local/openresty
+RESTY="$OPENRESTY/bin/resty"
+LUAJIT="$OPENRESTY/luajit/bin/luajit"
+BUSTED="$OPENRESTY/luajit/bin/busted"
+
+test -x "$RESTY"
+test -x "$LUAJIT"
+
+apt-get update
+apt-get install -y --no-install-recommends \
+    ca-certificates \
+    liblua5.1-0-dev \
+    lua5.1 \
+    luarocks
+
+# Use Ubuntu LuaRocks here. The OpenResty-bundled luarocks command runs under
+# LuaJIT and can fail to load the current public manifest due to bytecode limits.
+/usr/bin/luarocks install busted
+/usr/bin/luarocks install lua-cjson
+
+test -x "$BUSTED"
+"$RESTY" -V >/dev/null 2>&1
+"$LUAJIT" -e '\''assert(jit, "LuaJIT required"); print(jit.version)'\''
+
+export LD_LIBRARY_PATH=/workspace/target/release
+export LUA_PATH="/workspace/lua/?.lua;;"
+
+"$RESTY" /workspace/.github/scripts/openresty-smoke.lua
+"$BUSTED" --lua="$LUAJIT" /workspace/tests/lua \
+    --lpath="/workspace/lua/?.lua"
+'
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 86fb37a..a2abf5a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -296,6 +296,50 @@ jobs:
           "$LUAJIT_BIN" -e 'local qjson = require("qjson"); local doc = qjson.parse("{\"a\":42}"); assert(doc:get_i64("a") == 42)'
           busted --lua="$LUAJIT_BIN" tests/lua
 
+  openresty:
+    name: OpenResty runtime (${{ matrix.openresty.version }})
+    runs-on: ubuntu-22.04
+    needs: rust
+    strategy:
+      fail-fast: false
+      matrix:
+        openresty:
+          - version: "1.21.4.4"
+            image: "openresty/openresty:1.21.4.4-0-jammy"
+          - version: "1.27.1.2"
+            image: "openresty/openresty:1.27.1.2-0-jammy"
+          - version: "1.29.2.4"
+            image: "openresty/openresty:1.29.2.4-0-jammy"
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Install Rust (stable)
+        run: |
+          rustup toolchain install stable --profile minimal --no-self-update
+          rustup default stable
+
+      - name: Cache cargo registry & target
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: openresty-${{ runner.os }}-${{ matrix.openresty.version }}-${{ hashFiles('Cargo.toml') }}
+          restore-keys: |
+            openresty-${{ runner.os }}-${{ matrix.openresty.version }}-
+            openresty-${{ runner.os }}-
+
+      - name: Build cdylib
+        run: cargo build --release
+
+      - name: Run OpenResty runtime checks
+        env:
+          OPENRESTY_IMAGE: ${{ matrix.openresty.image }}
+        run: .github/scripts/run-openresty-runtime.sh
+
   package:
     name: LuaRocks package (${{ matrix.os }})
     runs-on: ${{ matrix.os }}

From 4fa9a7566e5d7d890bb407e89a867ea085b7ad28 Mon Sep 17 00:00:00 2001
From: Yuansheng Wang <membphis@gmail.com>
Date: Sat, 30 May 2026 22:15:58 +0800
Subject: [PATCH 2/2] ci: scope OpenResty job token permissions

---
 .github/workflows/ci.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a2abf5a..f46e60c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -300,6 +300,8 @@ jobs:
     name: OpenResty runtime (${{ matrix.openresty.version }})
     runs-on: ubuntu-22.04
     needs: rust
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix: