Add per-job `if:` guard against draft PRs and the `ready_for_review`
trigger type so CI does not run while a PR is a draft and fires
automatically when the PR is marked ready. Push and repository_dispatch
(nightly) behavior is unchanged.
The job-level `if:` form is:
if: github.event_name != 'pull_request' ||
github.event.pull_request.draft == false
The wider `github.event_name != 'pull_request' || ...` form is used
(rather than the bare `draft == false` check) so the rationale is
explicit and not dependent on GitHub Actions' loose-equality coercion
behavior on push/repository_dispatch events.
For hw-spdm-test.yml (pull_request_target) the draft guard is composed
with the existing OWNER/MEMBER author_association gate inside parens so
both conditions must hold on PRs.
Also adds a workflow-level concurrency block to the workflows that
didn't already have one (cmake-build, fwtpm-test, make-test-swtpm,
pqc-examples, seal-test, win-test, zephyr) so superseded in-flight
runs are cancelled by newer commits on the same PR/branch. hw-spdm-test
keeps only its existing job-level per-vendor serialization to avoid
aborting a hardware test mid-run. fuzz.yml intentionally does not get
the cancel-in-progress block (cancelling a multi-minute fuzz run
throws away coverage).
Workflows NOT touched: coverity-scan-fixes.yml and nightly.yml — these
have no pull_request trigger.
configure.ac: add LIBWOLFSSL_VERSION_HEX check so --enable-v185/--enable-pqc
fails fast against unsupported wolfSSL releases (kyber.h era), instead of
relying on transitive header aliasing through wc_mlkem.h.
Add .github/workflows/wolfssl-versions.yml matrix: builds wolfTPM PQC
against wolfSSL v5.8.0-stable, v5.8.4-stable, v5.9.1-stable, and master.
Catches the next upstream rename within the matrix run, not 9 days later.
Add .github/workflows/nightly.yml: cron 02:17 UTC fan-out via
repository_dispatch[nightly-trigger]. 12 workflows opt in (cmake-build,
codespell, fwtpm-test, make-test-swtpm, multi-compiler, pqc-examples,
release-checks, sanitizer, seal-test, win-test, wolfssl-versions, zephyr).
hw-spdm-test deliberately does NOT opt in so the self-hosted Pi runner
cannot be batch-triggered. repository_dispatch is API-only (no UI button)
so only the nightly job can fire these.
aidan garske
Aidan Garske
David Garske