WolfSSL
/
wolfcrypt-jni
mirror of https://github.com/wolfSSL/wolfcrypt-jni.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Testing: cache wolfSSL builds, cancel superseded PR runs, trim redundant job steps

pull/244/head
Chris Conlon 2026-07-23 14:32:39 -06:00
parent a02707230d
commit d11076ea75
18 changed files with 377 additions and 319 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

83
.github/actions/build-wolfssl-cached/action.yml vendored 100644
View File

@ -0,0 +1,83 @@
name: 'Build wolfSSL (cached)'
description: 'Restore a cached native wolfSSL install keyed on the
wolfSSL commit, configure flags, OS/arch and compiler, building
and saving the exact keyed commit on a cache miss'
# The configure string is passed in once and used for both the cache
# key and the build, so the key and the built contents cannot drift
# apart. The compiler version is part of the key so a runner-image
# toolchain bump rotates the cache; sanitizer-instrumented builds in
# particular must match the runtime (libasan) of the current image.
#
# The install prefix is fixed to build-dir by the wrapped
# actions-build-autotools-project action, so the cache path is
# hard-coded to match rather than exposed as an input.
inputs:
configure:
description: 'Full wolfSSL ./configure arguments'
required: true
ref:
description: 'wolfSSL git ref to build. The default master is
resolved to a commit SHA so the cache key and the built contents
cannot drift if master advances mid-run; any other value is
expected to be an immutable release tag and is used as-is.'
required: false
default: 'master'
runs:
using: 'composite'
steps:
- name: Resolve wolfSSL cache key
id: wolfssl-key
shell: bash
env:
WOLFSSL_CONFIGURE: ${{ inputs.configure }}
WOLFSSL_REF: ${{ inputs.ref }}
run: |
if [ "$WOLFSSL_REF" = "master" ]; then
REF=$(git ls-remote https://github.com/wolfSSL/wolfssl.git \
refs/heads/master | cut -f1)
if [ -z "$REF" ]; then
echo "Failed to resolve wolfSSL master SHA" >&2
exit 1
fi
else
REF="$WOLFSSL_REF"
fi
CFG_HASH=$(printf '%s' "$WOLFSSL_CONFIGURE" | \
shasum -a 256 | cut -c1-16)
CC_HASH=$(cc --version 2>/dev/null | head -n1 | \
shasum -a 256 | cut -c1-8)
KEY="wolfssl-${{ runner.os }}-${{ runner.arch }}"
KEY="$KEY-cc$CC_HASH-$REF-$CFG_HASH"
echo "ref=$REF" >> "$GITHUB_OUTPUT"
echo "key=$KEY" >> "$GITHUB_OUTPUT"
- name: Restore cached wolfSSL install
id: cache-wolfssl
uses: actions/cache/restore@v4
with:
path: build-dir
key: ${{ steps.wolfssl-key.outputs.key }}
# Build the exact ref the cache key was computed from
- name: Build native wolfSSL
if: steps.cache-wolfssl.outputs.cache-hit != 'true'
uses: wolfSSL/actions-build-autotools-project@v1
with:
repository: wolfSSL/wolfssl
ref: ${{ steps.wolfssl-key.outputs.ref }}
path: wolfssl
configure: ${{ inputs.configure }}
check: false
install: true
# Save right after building (not at job end) so a later test
# failure does not prevent the cache from being populated.
- name: Save wolfSSL install to cache
if: steps.cache-wolfssl.outputs.cache-hit != 'true'
uses: actions/cache/save@v4
with:
path: build-dir
key: ${{ steps.wolfssl-key.outputs.key }}

51
.github/actions/setup-junit/action.yml vendored 100644
View File

@ -0,0 +1,51 @@
name: 'Setup JUnit'
description: 'Cache and download the JUnit jars used by ant test, verify
their checksums, and export JUNIT_HOME'
# shasum is used instead of sha256sum because it is available on both
# the Linux and macOS hosted runners.
#
# The v2 cache key retires the junit-jars-v1 entries that older
# workflows populated without checksum verification, so every entry
# under this key is guaranteed to have passed the checks below.
runs:
using: 'composite'
steps:
- name: Restore cached JUnit dependencies
id: cache-junit
uses: actions/cache/restore@v4
with:
path: junit
key: junit-jars-v2
- name: Download junit-4.13.2.jar
if: steps.cache-junit.outputs.cache-hit != 'true'
shell: bash
run: |
wget --directory-prefix=$GITHUB_WORKSPACE/junit \
https://repo1.maven.org/maven2/junit/junit/4.13.2/junit-4.13.2.jar
echo "8e495b634469d64fb8acfa3495a065cbacc8a0fff55ce1e31007be4c16dc57d3 $GITHUB_WORKSPACE/junit/junit-4.13.2.jar" \
| shasum -a 256 -c -
- name: Download hamcrest-all-1.3.jar
if: steps.cache-junit.outputs.cache-hit != 'true'
shell: bash
run: |
wget --directory-prefix=$GITHUB_WORKSPACE/junit \
https://repo1.maven.org/maven2/org/hamcrest/hamcrest-all/1.3/hamcrest-all-1.3.jar
echo "4877670629ab96f34f5f90ab283125fcd9acb7e683e66319a68be6eb2cca60de $GITHUB_WORKSPACE/junit/hamcrest-all-1.3.jar" \
| shasum -a 256 -c -
# Save right after verifying (not at job end) so a later test
# failure does not prevent the cache from being populated.
- name: Save JUnit dependencies to cache
if: steps.cache-junit.outputs.cache-hit != 'true'
uses: actions/cache/save@v4
with:
path: junit
key: junit-jars-v2
- name: Set JUNIT_HOME
shell: bash
run: echo "JUNIT_HOME=$GITHUB_WORKSPACE/junit" >> "$GITHUB_ENV"

4
.github/workflows/android_gradle.yml vendored
View File

@ -7,8 +7,8 @@ on:
branches: [ 'master' ]
concurrency:
group: android-${{ github.head_ref || github.ref }}
cancel-in-progress: true
group: android-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
jobs:
build_wolfcryptjni:

4
.github/workflows/android_gradle_fipsready.yml vendored
View File

@ -7,8 +7,8 @@ on:
branches: [ 'master' ]
concurrency:
group: android-fips-${{ github.head_ref || github.ref }}
cancel-in-progress: true
group: android-fips-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
jobs:
build_wolfcryptjni_fipsready:

5
.github/workflows/comment-style-check.yml vendored
View File

@ -8,6 +8,11 @@ on:
- '**/*.c'
- '**/*.h'
# Cancel superseded in-progress runs for the same PR.
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
jobs:
check-comment-style:
runs-on: ubuntu-latest

17
.github/workflows/filtered-providers.yml vendored
View File

@ -19,20 +19,15 @@ jobs:
steps:
- uses: actions/checkout@v4
- name: Download junit-4.13.2.jar
run: wget --directory-prefix=$GITHUB_WORKSPACE/junit https://repo1.maven.org/maven2/junit/junit/4.13.2/junit-4.13.2.jar
- name: Download hamcrest-all-1.3.jar
run: wget --directory-prefix=$GITHUB_WORKSPACE/junit https://repo1.maven.org/maven2/org/hamcrest/hamcrest-all/1.3/hamcrest-all-1.3.jar
- name: Setup JUnit
uses: ./.github/actions/setup-junit
- name: Setup java
uses: actions/setup-java@v4
with:
distribution: ${{ inputs.jdk_distro }}
java-version: ${{ inputs.jdk_version }}
- name: Set JUNIT_HOME
run: |
echo "JUNIT_HOME=$GITHUB_WORKSPACE/junit" >> "$GITHUB_ENV"
cache: 'maven'
# The filtered-providers sources are pure Java
# (com.wolfssl.security.providers.*) and the tests exercise JDK
@ -54,9 +49,9 @@ jobs:
run: ant test-filtered-providers
# ----- Maven: tests + classified jar (auto-skips on Java 8) ---------
- name: mvn test (filtered-providers tests only)
run: mvn test -Dmain.tests.skip=true
# A single mvn package runs the compile, test, and package phases
# in one lifecycle pass. A separate mvn test step would run the
# filtered-providers test suite twice.
- name: mvn package (filtered-providers tests + jars)
run: mvn package -Dmain.tests.skip=true

117
.github/workflows/infer.yml vendored
View File

@ -1,4 +1,4 @@
name: Common Linux test logic
name: Facebook Infer static analysis
on:
workflow_call:
@ -12,9 +12,6 @@ on:
jdk_version:
required: true
type: string
wolfssl_configure:
required: true
type: string
jobs:
build_wolfcryptjni:
@ -22,32 +19,45 @@ jobs:
steps:
- uses: actions/checkout@v4
# Download Facebook Infer
# Infer runs javac directly over the Java sources (see
# scripts/infer.sh), so this job does not need native wolfSSL,
# the JNI library, JUnit, or the test suite. Tests for this
# configuration run in the main CI matrix (linux-zulu-all).
# Cache the extracted Infer release (~100MB download per run).
- name: Restore cached Infer
id: cache-infer
uses: actions/cache/restore@v4
with:
path: infer-linux64-v1.1.0
key: infer-v1.1.0-${{ runner.os }}-${{ runner.arch }}
# Download Facebook Infer, verifying the release tarball checksum
- name: Download Infer
run: wget https://github.com/facebook/infer/releases/download/v1.1.0/infer-linux64-v1.1.0.tar.xz
if: steps.cache-infer.outputs.cache-hit != 'true'
run: |
wget https://github.com/facebook/infer/releases/download/v1.1.0/infer-linux64-v1.1.0.tar.xz
echo "5f5d453814422e93e2a70998d8946b09a2721628ff427f67ff0123dea87461d4 infer-linux64-v1.1.0.tar.xz" \
| shasum -a 256 -c -
- name: Extract Infer
if: steps.cache-infer.outputs.cache-hit != 'true'
run: tar -xvf infer-linux64-v1.1.0.tar.xz
- name: Symlink Infer
run: ln -s "$GITHUB_WORKSPACE/infer-linux64-v1.1.0/bin/infer" /usr/local/bin/infer
- name: Add Infer to PATH
run: echo "$GITHUB_WORKSPACE/infer-linux64-v1.1.0/bin" >> "$GITHUB_PATH"
- name: Test Infer get version
run: infer --version
# Download Junit JARs
- name: Download junit-4.13.2.jar
run: wget --directory-prefix=$GITHUB_WORKSPACE/junit https://repo1.maven.org/maven2/junit/junit/4.13.2/junit-4.13.2.jar
- name: Download hamcrest-all-1.3.jar
run: wget --directory-prefix=$GITHUB_WORKSPACE/junit https://repo1.maven.org/maven2/org/hamcrest/hamcrest-all/1.3/hamcrest-all-1.3.jar
# Build native wolfSSL
- name: Build native wolfSSL
uses: wolfSSL/actions-build-autotools-project@v1
# Save only after the version sanity check above passes, and
# before the analysis runs, so a failed Infer run (issues found)
# does not prevent the cache from being populated but a broken
# extraction is never cached.
- name: Save Infer to cache
if: steps.cache-infer.outputs.cache-hit != 'true'
uses: actions/cache/save@v4
with:
repository: wolfSSL/wolfssl
ref: master
path: wolfssl
configure: ${{ inputs.wolfssl_configure }}
check: false
install: true
path: infer-linux64-v1.1.0
key: infer-v1.1.0-${{ runner.os }}-${{ runner.arch }}
# Setup Java
- name: Setup java
@ -56,66 +66,6 @@ jobs:
distribution: ${{ inputs.jdk_distro }}
java-version: ${{ inputs.jdk_version }}
- name: Set JUNIT_HOME
run: |
echo "JUNIT_HOME=$GITHUB_WORKSPACE/junit" >> "$GITHUB_ENV"
- name: Set LD_LIBRARY_PATH
run: |
echo "LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$GITHUB_WORKSPACE/build-dir/lib" >> "$GITHUB_ENV"
# Only copy appropriate makefile for platform currently being tested
- name: Copy makefile
run: |
if [ "$RUNNER_OS" == "Linux" ]; then
cp makefile.linux makefile
elif [ "$RUNNER_OS" == "macOS" ]; then
cp makefile.macosx makefile
else
echo "$RUNNER_OS not supported"
exit 1
fi
shell: bash
- name: Build JNI library
run: PREFIX=$GITHUB_WORKSPACE/build-dir make
# ant build-jni-debug
- name: Build jce-debug JAR (ant build-jni-debug)
run: ant build-jni-debug
- name: Run Java tests (ant test)
run: ant test
- name: Clean JAR
run: ant clean
# ant build-jni-release
- name: Build jce-debug JAR (ant build-jni-release)
run: ant build-jni-release
- name: Run Java tests (ant test)
run: ant test
- name: Clean JAR
run: ant clean
# ant build-jce-debug
- name: Build jce-debug JAR (ant build-jce-debug)
run: ant build-jce-debug
- name: Run Java tests (ant test)
run: ant test
- name: Clean JAR
run: ant clean
# ant build-jce-release
- name: Build jce-debug JAR (ant build-jce-release)
run: ant build-jce-release
- name: Run Java tests (ant test)
run: ant test
- name: Clean JAR
run: ant clean
- name: Show logs on failure
if: failure() || cancelled()
run: |
cat build/reports/*.txt
# Run Facebook Infer
- name: Run Facebook Infer
run: ./scripts/infer.sh
@ -123,4 +73,3 @@ jobs:
- name: Shows Infer report on failure
if: failure()
run: cat infer-out/report.txt

79
.github/workflows/java-module-test.yml vendored
View File

@ -6,6 +6,13 @@ on:
pull_request:
branches: [ '*' ]
# Cancel superseded in-progress runs for the same PR. In-progress
# push runs are never cancelled, though a still-queued push run may
# be superseded by a newer queued one.
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
jobs:
# Test Java 9+ module support (JPMS)
# Verifies that module-info.java is properly compiled and the resulting
@ -21,30 +28,16 @@ jobs:
steps:
- uses: actions/checkout@v4
- name: Cache JUnit dependencies
uses: actions/cache@v4
id: cache-junit
- name: Setup JUnit
uses: ./.github/actions/setup-junit
# Cache the installed wolfSSL build. The key matches the one built
# in linux-common.yml for the same configure flags, so this job
# shares the cache with the main CI matrix.
- name: Build native wolfSSL (cached)
uses: ./.github/actions/build-wolfssl-cached
with:
path: junit
key: junit-jars-v1
- name: Download junit-4.13.2.jar
if: steps.cache-junit.outputs.cache-hit != 'true'
run: wget --directory-prefix=$GITHUB_WORKSPACE/junit https://repo1.maven.org/maven2/junit/junit/4.13.2/junit-4.13.2.jar
- name: Download hamcrest-all-1.3.jar
if: steps.cache-junit.outputs.cache-hit != 'true'
run: wget --directory-prefix=$GITHUB_WORKSPACE/junit https://repo1.maven.org/maven2/org/hamcrest/hamcrest-all/1.3/hamcrest-all-1.3.jar
- name: Build native wolfSSL
uses: wolfSSL/actions-build-autotools-project@v1
with:
repository: wolfSSL/wolfssl
ref: master
path: wolfssl
configure: --enable-jni
check: false
install: true
configure: '--enable-jni'
- name: Setup Java
uses: actions/setup-java@v4
@ -52,10 +45,6 @@ jobs:
distribution: 'zulu'
java-version: ${{ matrix.jdk_version }}
- name: Set JUNIT_HOME
run: |
echo "JUNIT_HOME=$GITHUB_WORKSPACE/junit" >> "$GITHUB_ENV"
- name: Set LD_LIBRARY_PATH
run: |
echo "LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$GITHUB_WORKSPACE/build-dir/lib" >> "$GITHUB_ENV"
@ -184,30 +173,16 @@ jobs:
steps:
- uses: actions/checkout@v4
- name: Cache JUnit dependencies
uses: actions/cache@v4
id: cache-junit
- name: Setup JUnit
uses: ./.github/actions/setup-junit
# Cache the installed wolfSSL build. The key matches the one built
# in linux-common.yml for the same configure flags, so this job
# shares the cache with the main CI matrix.
- name: Build native wolfSSL (cached)
uses: ./.github/actions/build-wolfssl-cached
with:
path: junit
key: junit-jars-v1
- name: Download junit-4.13.2.jar
if: steps.cache-junit.outputs.cache-hit != 'true'
run: wget --directory-prefix=$GITHUB_WORKSPACE/junit https://repo1.maven.org/maven2/junit/junit/4.13.2/junit-4.13.2.jar
- name: Download hamcrest-all-1.3.jar
if: steps.cache-junit.outputs.cache-hit != 'true'
run: wget --directory-prefix=$GITHUB_WORKSPACE/junit https://repo1.maven.org/maven2/org/hamcrest/hamcrest-all/1.3/hamcrest-all-1.3.jar
- name: Build native wolfSSL
uses: wolfSSL/actions-build-autotools-project@v1
with:
repository: wolfSSL/wolfssl
ref: master
path: wolfssl
configure: --enable-jni
check: false
install: true
configure: '--enable-jni'
- name: Setup Java 8
uses: actions/setup-java@v4
@ -215,10 +190,6 @@ jobs:
distribution: 'zulu'
java-version: '8'
- name: Set JUNIT_HOME
run: |
echo "JUNIT_HOME=$GITHUB_WORKSPACE/junit" >> "$GITHUB_ENV"
- name: Set LD_LIBRARY_PATH
run: |
echo "LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$GITHUB_WORKSPACE/build-dir/lib" >> "$GITHUB_ENV"

5
.github/workflows/line-length-check.yml vendored
View File

@ -4,6 +4,11 @@ on:
pull_request:
branches: [ '*' ]
# Cancel superseded in-progress runs for the same PR.
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
jobs:
line-length-check:
runs-on: ubuntu-latest

72
.github/workflows/linux-32bit.yml vendored
View File

@ -6,6 +6,13 @@ on:
pull_request:
branches: [ 'master' ]
# Cancel superseded in-progress runs for the same PR. In-progress
# push runs are never cancelled, though a still-queued push run may
# be superseded by a newer queued one.
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
jobs:
# Linux 32-bit build using Zulu x86 JDK
# Tests JNI pointer handling and 32-bit specific code paths
@ -44,25 +51,48 @@ jobs:
java -version
file $(which java)
- name: Cache JUnit dependencies
uses: actions/cache@v4
id: cache-junit
with:
path: junit
key: junit-jars-v1
- name: Setup JUnit
uses: ./.github/actions/setup-junit
- name: Download junit-4.13.2.jar
if: steps.cache-junit.outputs.cache-hit != 'true'
run: wget --directory-prefix=$GITHUB_WORKSPACE/junit https://repo1.maven.org/maven2/junit/junit/4.13.2/junit-4.13.2.jar
- name: Download hamcrest-all-1.3.jar
if: steps.cache-junit.outputs.cache-hit != 'true'
run: wget --directory-prefix=$GITHUB_WORKSPACE/junit https://repo1.maven.org/maven2/org/hamcrest/hamcrest-all/1.3/hamcrest-all-1.3.jar
- name: Clone and build wolfSSL (32-bit)
# Cache the installed wolfSSL build. The m32 key segment keeps
# these 32-bit builds separate from the 64-bit cache entries.
- name: Resolve wolfSSL cache key
id: wolfssl-key
env:
WOLFSSL_CONFIGURE: ${{ matrix.wolfssl_configure }}
run: |
git clone --depth 1 https://github.com/wolfSSL/wolfssl.git /tmp/wolfssl
SHA=$(git ls-remote https://github.com/wolfSSL/wolfssl.git \
refs/heads/master | cut -f1)
if [ -z "$SHA" ]; then
echo "Failed to resolve wolfSSL master SHA" >&2
exit 1
fi
CFG_HASH=$(printf '%s' "$WOLFSSL_CONFIGURE" | \
shasum -a 256 | cut -c1-16)
CC_HASH=$(cc --version 2>/dev/null | head -n1 | \
shasum -a 256 | cut -c1-8)
KEY="wolfssl-m32-${{ runner.os }}-${{ runner.arch }}"
KEY="$KEY-cc$CC_HASH-$SHA-$CFG_HASH"
echo "sha=$SHA" >> "$GITHUB_OUTPUT"
echo "key=$KEY" >> "$GITHUB_OUTPUT"
- name: Restore cached wolfSSL install
id: cache-wolfssl
uses: actions/cache/restore@v4
with:
path: wolfssl-install
key: ${{ steps.wolfssl-key.outputs.key }}
# Fetch the exact commit the cache key was computed from so the
# key and contents cannot drift if master advances mid-run.
- name: Clone and build wolfSSL (32-bit)
if: steps.cache-wolfssl.outputs.cache-hit != 'true'
run: |
git init /tmp/wolfssl
cd /tmp/wolfssl
git fetch --depth 1 https://github.com/wolfSSL/wolfssl.git \
${{ steps.wolfssl-key.outputs.sha }}
git checkout FETCH_HEAD
./autogen.sh
./configure ${{ matrix.wolfssl_configure }} \
--prefix=$GITHUB_WORKSPACE/wolfssl-install \
@ -70,9 +100,17 @@ jobs:
make
make install
# Save right after building (not at job end) so a later test
# failure does not prevent the cache from being populated.
- name: Save wolfSSL install to cache
if: steps.cache-wolfssl.outputs.cache-hit != 'true'
uses: actions/cache/save@v4
with:
path: wolfssl-install
key: ${{ steps.wolfssl-key.outputs.key }}
- name: Set environment variables
run: |
echo "JUNIT_HOME=$GITHUB_WORKSPACE/junit" >> $GITHUB_ENV
echo "LD_LIBRARY_PATH=$GITHUB_WORKSPACE/wolfssl-install/lib" >> $GITHUB_ENV
- name: Copy makefile

22
.github/workflows/linux-common.yml vendored
View File

@ -22,20 +22,17 @@ jobs:
steps:
- uses: actions/checkout@v4
- name: Download junit-4.13.2.jar
run: wget --directory-prefix=$GITHUB_WORKSPACE/junit https://repo1.maven.org/maven2/junit/junit/4.13.2/junit-4.13.2.jar
- name: Download hamcrest-all-1.3.jar
run: wget --directory-prefix=$GITHUB_WORKSPACE/junit https://repo1.maven.org/maven2/org/hamcrest/hamcrest-all/1.3/hamcrest-all-1.3.jar
- name: Setup JUnit
uses: ./.github/actions/setup-junit
- name: Build native wolfSSL
uses: wolfSSL/actions-build-autotools-project@v1
# Cache the installed wolfSSL build. It depends only on the wolfSSL
# commit, configure flags, OS/arch and compiler, not on the JDK in
# use, so jobs across the matrix (and other workflows) can share
# one build.
- name: Build native wolfSSL (cached)
uses: ./.github/actions/build-wolfssl-cached
with:
repository: wolfSSL/wolfssl
ref: master
path: wolfssl
configure: ${{ inputs.wolfssl_configure }}
check: false
install: true
- name: Setup java
uses: actions/setup-java@v4
@ -43,9 +40,6 @@ jobs:
distribution: ${{ inputs.jdk_distro }}
java-version: ${{ inputs.jdk_version }}
- name: Set JUNIT_HOME
run: |
echo "JUNIT_HOME=$GITHUB_WORKSPACE/junit" >> "$GITHUB_ENV"
- name: Set LD_LIBRARY_PATH
run: |
echo "LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$GITHUB_WORKSPACE/build-dir/lib" >> "$GITHUB_ENV"

17
.github/workflows/main.yml vendored
View File

@ -5,6 +5,13 @@ on:
pull_request:
branches: [ '*' ]
# Cancel superseded in-progress runs for the same PR. In-progress
# push runs are never cancelled, though a still-queued push run may
# be superseded by a newer queued one.
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
jobs:
# Oracle JDK (Linux, Mac)
# Oracle JDK requires JAR to be signed for some classes to load/run
@ -217,21 +224,21 @@ jobs:
wolfssl_configure: ${{ matrix.wolfssl_configure }}
# ------------------ Facebook Infer static analysis -------------------
# Run Facebook infer over PR code, only running on Linux with one
# JDK/version for now.
# Run Facebook Infer over the Java sources, only running on Linux with
# one JDK/version for now. Infer only compiles the .java files with
# javac, so no native wolfSSL build or test run is needed here. Tests
# for the equivalent configuration run in linux-zulu-all above.
fb-infer:
strategy:
matrix:
os: [ 'ubuntu-latest' ]
jdk_version: [ '11' ]
wolfssl_configure: [ '--enable-jni --enable-all' ]
name: Facebook Infer (${{ matrix.os }} Zulu JDK ${{ matrix.jdk_version }}, ${{ matrix.wolfssl_configure }})
name: Facebook Infer (${{ matrix.os }} Zulu JDK ${{ matrix.jdk_version }})
uses: ./.github/workflows/infer.yml
with:
os: ${{ matrix.os }}
jdk_distro: "zulu"
jdk_version: ${{ matrix.jdk_version }}
wolfssl_configure: ${{ matrix.wolfssl_configure }}
# --------------------- Maven build - test pom.xml --------------------
# Run Maven build over PR code, running on Linux and Mac with only one

24
.github/workflows/maven.yml vendored
View File

@ -22,21 +22,20 @@ jobs:
steps:
- uses: actions/checkout@v4
- name: Build native wolfSSL
uses: wolfSSL/actions-build-autotools-project@v1
# Cache the installed wolfSSL build. The key matches the one built
# in linux-common.yml for the same configure flags, so this job
# shares the cache with the main CI matrix.
- name: Build native wolfSSL (cached)
uses: ./.github/actions/build-wolfssl-cached
with:
repository: wolfSSL/wolfssl
ref: master
path: wolfssl
configure: ${{ inputs.wolfssl_configure }}
check: false
install: true
- name: Setup java
uses: actions/setup-java@v4
with:
distribution: ${{ inputs.jdk_distro }}
java-version: ${{ inputs.jdk_version }}
cache: 'maven'
- name: Set LD_LIBRARY_PATH
run: |
@ -62,13 +61,10 @@ jobs:
- name: Build JNI library
run: PREFIX=$GITHUB_WORKSPACE/build-dir make
# Maven build
- name: mvn compile
run: mvn compile
- name: mvn test
run: mvn test
# Maven build. A single mvn package runs the compile, test, and
# package phases in one lifecycle pass. Separate compile, test,
# and package steps would run the whole test suite twice, once
# for the test step and again inside package.
- name: mvn package
run: mvn package

39
.github/workflows/sanitizer-common.yml vendored
View File

@ -19,32 +19,28 @@ on:
jobs:
build_wolfcryptjni:
runs-on: ${{ inputs.os }}
# Full effective wolfSSL configure string, defined once so the
# build step and the cache key below cannot drift apart.
env:
WOLFSSL_CONFIGURE: >-
${{ inputs.wolfssl_configure }}
CFLAGS="-fsanitize=address -fno-omit-frame-pointer"
LDFLAGS="-fsanitize=address"
steps:
- uses: actions/checkout@v4
- name: Cache JUnit dependencies
uses: actions/cache@v4
id: cache-junit
with:
path: junit
key: junit-jars-v1
- name: Setup JUnit
uses: ./.github/actions/setup-junit
- name: Download junit-4.13.2.jar
if: steps.cache-junit.outputs.cache-hit != 'true'
run: wget --directory-prefix=$GITHUB_WORKSPACE/junit https://repo1.maven.org/maven2/junit/junit/4.13.2/junit-4.13.2.jar
- name: Download hamcrest-all-1.3.jar
if: steps.cache-junit.outputs.cache-hit != 'true'
run: wget --directory-prefix=$GITHUB_WORKSPACE/junit https://repo1.maven.org/maven2/org/hamcrest/hamcrest-all/1.3/hamcrest-all-1.3.jar
- name: Build native wolfSSL with AddressSanitizer
uses: wolfSSL/actions-build-autotools-project@v1
# Cache the installed wolfSSL build, keyed on the full configure
# string (including sanitizer flags), wolfSSL commit, OS/arch and
# compiler. The compiler in the key matters here: the sanitizer
# runtime preloaded at test time must match the toolchain that
# built the instrumented library.
- name: Build native wolfSSL with AddressSanitizer (cached)
uses: ./.github/actions/build-wolfssl-cached
with:
repository: wolfSSL/wolfssl
ref: master
path: wolfssl
configure: ${{ inputs.wolfssl_configure }} CFLAGS="-fsanitize=address -fno-omit-frame-pointer" LDFLAGS="-fsanitize=address"
check: false
install: true
configure: ${{ env.WOLFSSL_CONFIGURE }}
- name: Setup java
uses: actions/setup-java@v4
@ -58,7 +54,6 @@ jobs:
# This will let us catch all non-leak issues.
- name: Set environment variables
run: |
echo "JUNIT_HOME=$GITHUB_WORKSPACE/junit" >> "$GITHUB_ENV"
echo "LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$GITHUB_WORKSPACE/build-dir/lib" >> "$GITHUB_ENV"
echo "ASAN_OPTIONS=detect_leaks=0:abort_on_error=1:halt_on_error=1:print_stats=1" >> "$GITHUB_ENV"

51
.github/workflows/scan-build.yml vendored
View File

@ -6,6 +6,13 @@ on:
pull_request:
branches: [ '*' ]
# Cancel superseded in-progress runs for the same PR. In-progress
# push runs are never cancelled, though a still-queued push run may
# be superseded by a newer queued one.
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
jobs:
scan-build:
runs-on: ubuntu-latest
@ -18,54 +25,28 @@ jobs:
sudo apt-get update
sudo apt-get install -y clang-tools
# Cache Junit JARs
- name: Cache Junit JARs
uses: actions/cache@v3
id: cache-junit
# Cache the installed wolfSSL build. The key matches the one built
# in linux-common.yml for the same configure flags, so this job
# shares the cache with the main CI matrix.
- name: Build native wolfSSL (cached)
uses: ./.github/actions/build-wolfssl-cached
with:
path: ${{ github.workspace }}/junit
key: junit-cache-${{ runner.os }}-junit-4.13.2-hamcrest-1.3
restore-keys: |
junit-cache-${{ runner.os }}-
# Download Junit JARs (needed for full build)
- name: Download junit-4.13.2.jar
if: steps.cache-junit.outputs.cache-hit != 'true'
run: wget --directory-prefix=$GITHUB_WORKSPACE/junit https://repo1.maven.org/maven2/junit/junit/4.13.2/junit-4.13.2.jar
- name: Download hamcrest-all-1.3.jar
if: steps.cache-junit.outputs.cache-hit != 'true'
run: wget --directory-prefix=$GITHUB_WORKSPACE/junit https://repo1.maven.org/maven2/org/hamcrest/hamcrest-all/1.3/hamcrest-all-1.3.jar
# Build native wolfSSL
- name: Build native wolfSSL
uses: wolfSSL/actions-build-autotools-project@v1
with:
repository: wolfSSL/wolfssl
ref: master
path: wolfssl
configure: '--enable-jni --enable-all'
check: false
install: true
# Setup Java
# Setup Java (the makefile needs JAVA_HOME for the JNI headers)
- name: Setup java
uses: actions/setup-java@v4
with:
distribution: 'zulu'
java-version: '11'
- name: Set JUNIT_HOME
run: |
echo "JUNIT_HOME=$GITHUB_WORKSPACE/junit" >> "$GITHUB_ENV"
- name: Set LD_LIBRARY_PATH
run: |
echo "LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$GITHUB_WORKSPACE/build-dir/lib" >> "$GITHUB_ENV"
# Copy appropriate makefile for Linux
- name: Copy makefile
run: cp makefile.linux makefile
# Run scan-build over the native JNI C files
# Run scan-build over the native JNI C files. The default make
# target compiles only the native library, so no JUnit jars or
# LD_LIBRARY_PATH are needed since no Java builds or tests run.
- name: Run scan-build
env:
PREFIX: ${{ github.workspace }}/build-dir

20
.github/workflows/spotbugs.yml vendored
View File

@ -8,6 +8,11 @@ on:
- 'build.xml'
- 'spotbugs-exclude.xml'
# Cancel superseded in-progress runs for the same PR.
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
jobs:
spotbugs:
runs-on: ubuntu-latest
@ -23,17 +28,10 @@ jobs:
distribution: 'temurin'
java-version: '17'
- name: Set up Ant
run: |
sudo apt-get update
sudo apt-get install -y ant
- name: Download JUnit
run: |
mkdir -p /tmp/junit
wget -q -P /tmp/junit \
"https://repo1.maven.org/maven2/junit/junit/4.13.2/junit-4.13.2.jar"
echo "JUNIT_HOME=/tmp/junit" >> $GITHUB_ENV
# Ant is preinstalled on the ubuntu-latest runner image, so no
# apt-get install is needed here.
- name: Setup JUnit
uses: ./.github/actions/setup-junit
- name: Download and set up SpotBugs
run: |

40
.github/workflows/stable-wolfssl-releases.yml vendored
View File

@ -4,6 +4,11 @@ on:
pull_request:
branches: [ 'master' ]
# Cancel superseded in-progress runs for the same PR.
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
jobs:
# First job: dynamically fetch the last 5 stable wolfSSL release tags
get-stable-releases:
@ -51,30 +56,17 @@ jobs:
steps:
- uses: actions/checkout@v4
- name: Cache JUnit dependencies
uses: actions/cache@v4
id: cache-junit
- name: Setup JUnit
uses: ./.github/actions/setup-junit
# Cache the installed wolfSSL build. Stable release tags do not
# move, so these entries stay valid until a runner-image
# toolchain bump rotates the key.
- name: Build native wolfSSL ${{ matrix.wolfssl_version }} (cached)
uses: ./.github/actions/build-wolfssl-cached
with:
path: junit
key: junit-jars-v1
- name: Download junit-4.13.2.jar
if: steps.cache-junit.outputs.cache-hit != 'true'
run: wget --directory-prefix=$GITHUB_WORKSPACE/junit https://repo1.maven.org/maven2/junit/junit/4.13.2/junit-4.13.2.jar
- name: Download hamcrest-all-1.3.jar
if: steps.cache-junit.outputs.cache-hit != 'true'
run: wget --directory-prefix=$GITHUB_WORKSPACE/junit https://repo1.maven.org/maven2/org/hamcrest/hamcrest-all/1.3/hamcrest-all-1.3.jar
- name: Build native wolfSSL ${{ matrix.wolfssl_version }}
uses: wolfSSL/actions-build-autotools-project@v1
with:
repository: wolfSSL/wolfssl
ref: ${{ matrix.wolfssl_version }}
path: wolfssl
configure: ${{ matrix.wolfssl_configure }}
check: false
install: true
ref: ${{ matrix.wolfssl_version }}
- name: Setup java
uses: actions/setup-java@v4
@ -82,10 +74,6 @@ jobs:
distribution: zulu
java-version: ${{ matrix.jdk_version }}
- name: Set JUNIT_HOME
run: |
echo "JUNIT_HOME=$GITHUB_WORKSPACE/junit" >> "$GITHUB_ENV"
- name: Set LD_LIBRARY_PATH
run: |
echo "LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$GITHUB_WORKSPACE/build-dir/lib" >> "$GITHUB_ENV"

46
.github/workflows/undefined-sanitizer.yml vendored
View File

@ -6,6 +6,13 @@ on:
pull_request:
branches: [ 'master' ]
# Cancel superseded in-progress runs for the same PR. In-progress
# push runs are never cancelled, though a still-queued push run may
# be superseded by a newer queued one.
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
jobs:
# Run UBSan build and test on Linux only for undefined behavior detection
ubsan:
@ -15,33 +22,29 @@ jobs:
jdk_version: [ '21' ]
wolfssl_configure: [ '--enable-jni --enable-debug' ]
name: UBSan (ubuntu-latest Zulu JDK ${{ matrix.jdk_version }})
# Full effective wolfSSL configure string, defined once so the
# build step and the cache key below cannot drift apart.
env:
WOLFSSL_CONFIGURE: >-
${{ matrix.wolfssl_configure }}
CFLAGS="-fsanitize=undefined -fno-sanitize-recover=all
-fno-omit-frame-pointer" LDFLAGS="-fsanitize=undefined"
steps:
- uses: actions/checkout@v4
- name: Cache JUnit dependencies
uses: actions/cache@v4
id: cache-junit
with:
path: junit
key: junit-jars-v1
- name: Setup JUnit
uses: ./.github/actions/setup-junit
- name: Download junit-4.13.2.jar
if: steps.cache-junit.outputs.cache-hit != 'true'
run: wget --directory-prefix=$GITHUB_WORKSPACE/junit https://repo1.maven.org/maven2/junit/junit/4.13.2/junit-4.13.2.jar
- name: Download hamcrest-all-1.3.jar
if: steps.cache-junit.outputs.cache-hit != 'true'
run: wget --directory-prefix=$GITHUB_WORKSPACE/junit https://repo1.maven.org/maven2/org/hamcrest/hamcrest-all/1.3/hamcrest-all-1.3.jar
- name: Build native wolfSSL with UndefinedBehaviorSanitizer
uses: wolfSSL/actions-build-autotools-project@v1
# Cache the installed wolfSSL build, keyed on the full configure
# string (including sanitizer flags), wolfSSL commit, OS/arch and
# compiler. The compiler in the key matters here: the sanitizer
# runtime linked at test time must match the toolchain that built
# the instrumented library.
- name: Build native wolfSSL with UndefinedBehaviorSanitizer (cached)
uses: ./.github/actions/build-wolfssl-cached
with:
repository: wolfSSL/wolfssl
ref: master
path: wolfssl
configure: ${{ matrix.wolfssl_configure }} CFLAGS="-fsanitize=undefined -fno-sanitize-recover=all -fno-omit-frame-pointer" LDFLAGS="-fsanitize=undefined"
check: false
install: true
configure: ${{ env.WOLFSSL_CONFIGURE }}
- name: Setup java
uses: actions/setup-java@v4
@ -51,7 +54,6 @@ jobs:
- name: Set environment variables
run: |
echo "JUNIT_HOME=$GITHUB_WORKSPACE/junit" >> "$GITHUB_ENV"
echo "LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$GITHUB_WORKSPACE/build-dir/lib" >> "$GITHUB_ENV"
echo "UBSAN_OPTIONS=print_stacktrace=1:halt_on_error=1" >> "$GITHUB_ENV"