From 24ef26a7976474761dc36bc43056ee8e209beccc Mon Sep 17 00:00:00 2001 From: Aidan Garske Date: Mon, 8 Jun 2026 22:40:10 +0100 Subject: [PATCH] ci: remove hardware SPDM workflow, covered by fwtpm spdm-test.yml --- .github/workflows/hw-spdm-test.yml | 189 -------------------------- .github/workflows/make-test-swtpm.yml | 4 +- .github/workflows/nightly.yml | 4 +- src/fwtpm/README.md | 3 +- 4 files changed, 5 insertions(+), 195 deletions(-) delete mode 100644 .github/workflows/hw-spdm-test.yml diff --git a/.github/workflows/hw-spdm-test.yml b/.github/workflows/hw-spdm-test.yml deleted file mode 100644 index 46421506..00000000 --- a/.github/workflows/hw-spdm-test.yml +++ /dev/null @@ -1,189 +0,0 @@ -name: Hardware SPDM Test - -# Runs examples/spdm/spdm_test.sh on the self-hosted Pi with a real TPM. - -on: - push: - branches: [master] - paths: - - 'src/spdm/**' - - 'wolftpm/spdm/**' - - 'examples/spdm/**' - - 'src/tpm2_wrap.c' - - 'src/tpm2_spdm.c' - - 'src/tpm2.c' - - 'hal/tpm_io_linux.c' - - 'configure.ac' - - '.github/workflows/hw-spdm-test.yml' - - 'scripts/hw-runner-health-check.sh' - - 'tests/unit_tests.c' - pull_request_target: - branches: [master] - types: [opened, synchronize, reopened, ready_for_review] - paths: - - 'src/spdm/**' - - 'wolftpm/spdm/**' - - 'examples/spdm/**' - - 'src/tpm2_wrap.c' - - 'src/tpm2_spdm.c' - - 'src/tpm2.c' - - 'hal/tpm_io_linux.c' - - 'configure.ac' - - '.github/workflows/hw-spdm-test.yml' - - 'scripts/hw-runner-health-check.sh' - - 'tests/unit_tests.c' - -permissions: read-all - -jobs: - hw-spdm: - if: > - github.event_name != 'pull_request_target' || - (github.event.pull_request.draft == false && - contains(fromJSON('["OWNER","MEMBER"]'), - github.event.pull_request.author_association)) - runs-on: [self-hosted, Linux, ARM64, "${{ matrix.runner_label }}"] - timeout-minutes: 25 - - # Serialize per-vendor only — nuvoton and nations now run on separate - # physical Pis, so they can execute in parallel. Group prefixed with - # github.workflow to avoid collisions with other workflows' concurrency - # groups (groups are repo-wide). - concurrency: - group: ${{ github.workflow }}-hw-spdm-runner-${{ matrix.vendor }} - cancel-in-progress: false - - strategy: - fail-fast: false - matrix: - include: - - vendor: nuvoton - runner_label: wolftpm-nuvoton - wolftpm_config: "--enable-spdm --enable-nuvoton --enable-debug" - spi_cs: "0" - modes: "nuvoton" - - vendor: nations - runner_label: wolftpm-nations - wolftpm_config: "--enable-spdm --enable-nations --enable-debug" - spi_cs: "0" - modes: "nations nations-psk" - - steps: - - name: Harden Runner - uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0 - with: - egress-policy: audit - - - name: Checkout wolfTPM - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - with: - ref: ${{ github.event.pull_request.head.sha || github.sha }} - persist-credentials: false - - - name: Hardware health check - id: health - continue-on-error: true - run: bash scripts/hw-runner-health-check.sh "${{ matrix.spi_cs }}" - - - name: Warn if health check failed - if: steps.health.outcome == 'failure' - run: echo "::warning::Runner hardware check failed on ${{ runner.name }}. Skipping hardware tests." - - - name: Clean workspace (preserve wolfssl cache dir) - if: steps.health.outcome == 'success' - run: git clean -xdf - - - name: Resolve wolfSSL SHA and choose prefix - id: wolfssl - if: steps.health.outcome == 'success' - run: | - MAX_CACHE_AGE_SECS=86400 - SHA=$(curl -sf https://api.github.com/repos/wolfssl/wolfssl/commits/master | jq -r .sha) - echo "sha=$SHA" >> "$GITHUB_OUTPUT" - HIT=false - if [ "${{ github.event_name }}" = "push" ]; then - PREFIX="$HOME/wolfssl-install" - if [ -f "$PREFIX/.sha" ] && [ "$(cat "$PREFIX/.sha")" = "$SHA" ]; then - AGE=$(( $(date +%s) - $(stat -c %Y "$PREFIX/.sha") )) - [ "$AGE" -lt "$MAX_CACHE_AGE_SECS" ] && HIT=true - fi - else - PREFIX="$RUNNER_TEMP/wolfssl-install" - mkdir -p "$PREFIX" - fi - echo "prefix=$PREFIX" >> "$GITHUB_OUTPUT" - echo "hit=$HIT" >> "$GITHUB_OUTPUT" - - - name: Checkout wolfSSL - if: steps.health.outcome == 'success' && steps.wolfssl.outputs.hit != 'true' - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - with: - repository: wolfssl/wolfssl - path: wolfssl - ref: ${{ steps.wolfssl.outputs.sha }} - persist-credentials: false - - - name: Build & install wolfSSL (user prefix, no sudo) - if: steps.health.outcome == 'success' && steps.wolfssl.outputs.hit != 'true' - working-directory: ./wolfssl - run: | - ./autogen.sh - ./configure --prefix=${{ steps.wolfssl.outputs.prefix }} \ - --enable-wolftpm --enable-ecc --enable-sha384 \ - --enable-aesgcm --enable-hkdf --enable-sp - make -j"$(nproc)" - make install - echo '${{ steps.wolfssl.outputs.sha }}' > '${{ steps.wolfssl.outputs.prefix }}/.sha' - - - name: Build wolfTPM (${{ matrix.vendor }}) - if: steps.health.outcome == 'success' - run: | - ./autogen.sh - ./configure ${{ matrix.wolftpm_config }} \ - CPPFLAGS='-DTPM2_SPI_DEV_CS="${{ matrix.spi_cs }}"' \ - CFLAGS="-I${{ steps.wolfssl.outputs.prefix }}/include" \ - LDFLAGS="-L${{ steps.wolfssl.outputs.prefix }}/lib" - make -j"$(nproc)" - - - name: Run SPDM hardware tests (${{ matrix.vendor }}) - if: steps.health.outcome == 'success' - env: - LD_LIBRARY_PATH: ${{ steps.wolfssl.outputs.prefix }}/lib - run: | - # spdm_test.sh handles vendor-specific reset (gpio_reset for nuvoton, - # no-reset for nations) and SPDM-lock state internally. No pre-detect - # needed: each runner is dedicated to a single known chip. - # pipefail so `spdm_test.sh | tee` propagates spdm_test.sh's non-zero - # exit — without it, tee always returns 0 and internal test failures - # silently pass CI. - set -eo pipefail - for mode in ${{ matrix.modes }}; do - echo "=== spdm_test.sh mode=$mode ===" - ./examples/spdm/spdm_test.sh ./examples/spdm/spdm_ctrl "$mode" 2>&1 \ - | tee "spdm-${{ matrix.vendor }}-${mode}.log" - done - - - name: Post-job cleanup - if: always() && steps.health.outcome == 'success' - env: - LD_LIBRARY_PATH: ${{ steps.wolfssl.outputs.prefix }}/lib - run: | - pgrep -u "$(id -u)" -a | grep -vE '(Runner\.Listener|Runner\.Worker|actions-runner)' || true - pkill -u "$(id -u)" -f 'spdm_ctrl|unit\.test|caps$' 2>/dev/null || true - sleep 1 - gpioset gpiochip0 4=0 2>/dev/null && sleep 0.1 && gpioset gpiochip0 4=1 2>/dev/null || true - sleep 2 - # unlock/flush only meaningful if the chip was detected; ignore errors otherwise - ./examples/spdm/spdm_ctrl --connect --unlock 2>/dev/null || true - ./examples/management/flush 2>/dev/null || true - echo "[cleanup] done" - - - name: Upload logs on failure - if: failure() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 - with: - name: hw-spdm-logs-${{ matrix.vendor }} - path: | - *.log - config.log - retention-days: 14 diff --git a/.github/workflows/make-test-swtpm.yml b/.github/workflows/make-test-swtpm.yml index 9ee63356..ef49413e 100644 --- a/.github/workflows/make-test-swtpm.yml +++ b/.github/workflows/make-test-swtpm.yml @@ -151,8 +151,8 @@ jobs: - name: nuvoton-explicit-swtpm wolftpm_config: --enable-swtpm --enable-nuvoton --disable-fwtpm - # SPDM + vendor without any --disable flags (CI-path mirror of - # the hw-spdm-test.yml build line). + # SPDM + vendor without any --disable flags (build-only check of + # the vendor SPDM configure path). - name: spdm-nuvoton-autodisable wolfssl_config: --enable-wolftpm --enable-ecc --enable-sha384 --enable-aesgcm --enable-hkdf --enable-sp wolftpm_config: --enable-spdm --enable-nuvoton --enable-debug diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index e58d0ff5..392a7d35 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -10,8 +10,8 @@ name: Nightly CI # # repository_dispatch is API-only — there is no UI button to trigger # these workflows by hand. Maintainers cannot accidentally fire them. -# Workflows that should never be batch-triggered (e.g. hw-spdm-test on -# the self-hosted Pi runner) simply don't add the listener. +# Workflows that should never be batch-triggered (e.g. self-hosted Pi +# runner jobs) simply don't add the listener. on: schedule: diff --git a/src/fwtpm/README.md b/src/fwtpm/README.md index 53e6c442..fbc05c19 100644 --- a/src/fwtpm/README.md +++ b/src/fwtpm/README.md @@ -175,8 +175,7 @@ End-to-end coverage runs via the same script that drives real silicon: ``` CI exercises 7 build-only configure permutations + the two e2e modes on -`ubuntu-latest`; the original `hw-spdm-test.yml` still runs the same -script against Nuvoton + Nations on self-hosted Pi runners. +`ubuntu-latest` via `spdm-test.yml`, against the fwTPM SPDM responder. ## TPM 2.0 Command Coverage