From 09d2e2979942754c54eca5d325cfce325e396525 Mon Sep 17 00:00:00 2001
From: Ximon Eighteen <3304436+ximon18@users.noreply.github.com>
Date: Tue, 10 Mar 2026 12:00:57 +0100
Subject: [PATCH 1/4] Add a system test that checks that a signed zone is
 re-used on re-start.

I.e. that we persist signed zones to disk and reload and reuse the
persisted zone instead of re-signing the zone on startup.
---
 integration-tests/system-tests.yml            |  15 ++
 .../tests/persist-zone/action.yml             | 132 ++++++++++++++++++
 2 files changed, 147 insertions(+)
 create mode 100644 integration-tests/tests/persist-zone/action.yml

diff --git a/integration-tests/system-tests.yml b/integration-tests/system-tests.yml
index 13413b4f8..3f312bc43 100644
--- a/integration-tests/system-tests.yml
+++ b/integration-tests/system-tests.yml
@@ -145,3 +145,18 @@ jobs:
       - uses: ./integration-tests/tests/ixfr-in
         with:
           log-level: ${{ inputs.log-level }}
+
+  persist-zone:
+    name: Added zone should still exist after restart.
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        rust: [stable]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/set-build-profile
+        with:
+          build-profile: ${{ inputs.build-profile }}
+      - uses: ./integration-tests/tests/persist-zone
+        with:
+          log-level: ${{ inputs.log-level }}
diff --git a/integration-tests/tests/persist-zone/action.yml b/integration-tests/tests/persist-zone/action.yml
new file mode 100644
index 000000000..383fd4e27
--- /dev/null
+++ b/integration-tests/tests/persist-zone/action.yml
@@ -0,0 +1,132 @@
+# Making reusable composite actions documented at
+# https://docs.github.com/en/actions/tutorials/create-actions/create-a-composite-action#creating-a-composite-action-within-the-same-repository
+name: 'Added zone should still exist after restart.'
+description: 'Added zone should still exist after restart.'
+defaults:
+  # see: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#defaultsrunshell
+  run:
+    shell: bash --noprofile --norc -eo pipefail -x {0}
+inputs:
+  log-level:
+    description: The level of logging that Cascade should output.
+    required: false
+    default: debug
+    type: choice
+    options:
+      - error
+      - warning
+      - info
+      - debug
+      - trace
+runs:
+  using: "composite"
+  steps:
+    - env:
+        WOW: ${{inputs.log-level}}
+      run: |
+        echo "::error:: log-level=${WOW}"
+
+    - uses: ./.github/actions/prepare-systest-env
+    - uses: ./.github/actions/setup-and-start-cascade
+      with:
+        log-level: ${{ inputs.log-level }}
+
+    - name: Add a zone served by the NSD primary
+      run: |
+        cascade zone add --policy default --source 127.0.0.1:1055 example.test
+
+    - name: Wait for Cascade to sign the zone
+      run: |
+        timeout=10 # seconds
+        start=$(date +%s)
+        until cascade zone status example.test | grep -q "Published zone available"; do
+          if (($(date +%s) > (start + timeout))); then
+            cascade zone status example.test
+            echo "::error:: timeout: zone status did not report published zone available"
+            exit 1
+          fi
+          sleep 1
+        done
+
+    - name: Capture the signing time and publish version
+      id: last-capture
+      run: |
+        # TODO: Once https://github.com/NLnetLabs/cascade/issues/337 is done,
+        # check this via JSON rather than text scraping.
+        CURRENT_SIGNED_AT=$(cascade zone status example.test | grep 'Signing started at' | grep -Po '\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}')
+        CURRENT_PUBLISHED_SERIAL=$(cascade zone status example.test | grep 'Published version' | cut -b 23-)
+        echo "SIGNED_AT=${CURRENT_SIGNED_AT}" >> "$GITHUB_OUTPUT"
+        echo "PUBLISHED_SERIAL=${CURRENT_PUBLISHED_SERIAL}" >> "$GITHUB_OUTPUT"
+
+    - name: Query zone
+      run: |
+        dig +noall @127.0.0.1 -p 4543 example.test AXFR
+
+    - name: Stop Cascade
+      run: |
+        pkill cascaded
+
+    - name: Wait for Cascade to exit
+      run: |
+        timeout=10 # seconds
+        start=$(date +%s)
+        until ! cascade health; do
+          if (($(date +%s) > (start + timeout))); then
+            cascade health
+            echo "::error:: timeout: health check did not indicate Cascade had stopped"
+            exit 1
+          fi
+          sleep 1
+        done
+
+    - name: Restart Cascade
+      run: |
+        CASCADE_DIR=${{ github.workspace }}/cascade-dir
+        cascaded --config "${CASCADE_DIR}/config.toml" --state "${CASCADE_DIR}/state.db" --daemonize &>"${CASCADE_DIR}/cascade-startup.log"      
+
+    - name: Wait for Cascade to become healthy
+      run: |
+        timeout=10 # seconds
+        start=$(date +%s)
+        until cascade health; do
+          if (($(date +%s) > (start + timeout))); then
+            echo "::error:: timeout: health check did not indicate Cascade had started"
+            exit 1
+          fi
+          sleep 1
+        done
+
+    - name: Check that Cascade still knows the zone
+      run: |
+        timeout=10 # seconds
+        start=$(date +%s)
+        until cascade zone list | grep -q example.test; do
+          if (($(date +%s) > (start + timeout))); then
+            cascade zone list
+            echo "::error:: timeout: Cascade no longer knows the zone"
+            exit 1
+          fi
+          sleep 1
+        done
+
+    - name: Check that Cascade did NOT resign the zone
+      env:
+        LAST_SIGNED_AT: ${{ steps.last-capture.outputs.SIGNED_AT }}
+        LAST_PUBLISHED_SERIAL: ${{ steps.last-capture.outputs.PUBLISHED_SERIAL }}
+      run: |
+        # TODO: Once https://github.com/NLnetLabs/cascade/issues/337 is done,
+        # check this via JSON rather than text scraping.
+        CURRENT_SIGNED_AT="$(cascade zone status example.test | grep 'Signing started at' | grep -Po '\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}')"
+        CURRENT_PUBLISHED_SERIAL="$(cascade zone status example.test | grep 'Published version' | cut -b 23-)"
+        if [[ "${CURRENT_SIGNED_AT}" != "${LAST_SIGNED_AT}" ]]; then
+          echo "::error:: zone has been re-signed but was expected to re-use persisted signed zone records from disk. Signing time=${CURRENT_SIGNED_AT} vs last signing time=${LAST_SIGNED_AT}."
+          exit 1
+        fi
+        if [[ "${CURRENT_PUBLISHED_SERIAL}" != "${LAST_PUBLISHED_SERIAL}" ]]; then
+          echo "::error:: zone has been re-signed but was expected to re-use persisted signed zone records from disk. Published serial=${CURRENT_PUBLISHED_SERIAL} vs last published serial=${LAST_PUBLISHED_SERIAL}."
+          exit 1
+        fi
+
+    - name: Print log files on any failure in this job
+      uses: ./.github/actions/print-logfiles
+      if: failure()

From db32d1a8e595a3ed35f9d16dac09f3b1afd847b0 Mon Sep 17 00:00:00 2001
From: Ximon Eighteen <3304436+ximon18@users.noreply.github.com>
Date: Tue, 10 Mar 2026 12:50:11 +0100
Subject: [PATCH 2/4] Remove left over debugging.

---
 integration-tests/tests/persist-zone/action.yml | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/integration-tests/tests/persist-zone/action.yml b/integration-tests/tests/persist-zone/action.yml
index 383fd4e27..12ef22b18 100644
--- a/integration-tests/tests/persist-zone/action.yml
+++ b/integration-tests/tests/persist-zone/action.yml
@@ -21,11 +21,6 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - env:
-        WOW: ${{inputs.log-level}}
-      run: |
-        echo "::error:: log-level=${WOW}"
-
     - uses: ./.github/actions/prepare-systest-env
     - uses: ./.github/actions/setup-and-start-cascade
       with:

From f64bbb9a841f5a9ff533f9d9a268d967ed6b9805 Mon Sep 17 00:00:00 2001
From: Ximon Eighteen <3304436+ximon18@users.noreply.github.com>
Date: Thu, 9 Apr 2026 17:56:03 +0200
Subject: [PATCH 3/4] Merge fix.

---
 integration-tests/system-tests.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/integration-tests/system-tests.yml b/integration-tests/system-tests.yml
index c75d7871d..9dc3510ef 100644
--- a/integration-tests/system-tests.yml
+++ b/integration-tests/system-tests.yml
@@ -246,8 +246,6 @@ jobs:
 
   persist-zone:
     name: Added zone should still exist after restart.
-  remove-zone:
-    name: 
     runs-on: ubuntu-latest
     strategy:
       matrix:

From 1caf79b08d3cee6b00013a590d9d86dff72d91ab Mon Sep 17 00:00:00 2001
From: Ximon Eighteen <3304436+ximon18@users.noreply.github.com>
Date: Thu, 9 Apr 2026 17:56:21 +0200
Subject: [PATCH 4/4] Fix port number used.

---
 integration-tests/tests/persist-zone/action.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/integration-tests/tests/persist-zone/action.yml b/integration-tests/tests/persist-zone/action.yml
index 12ef22b18..c54e09d94 100644
--- a/integration-tests/tests/persist-zone/action.yml
+++ b/integration-tests/tests/persist-zone/action.yml
@@ -55,7 +55,7 @@ runs:
 
     - name: Query zone
       run: |
-        dig +noall @127.0.0.1 -p 4543 example.test AXFR
+        dig +noall @127.0.0.1 -p 4542 example.test AXFR
 
     - name: Stop Cascade
       run: |