From 2024add29943c30b568cb9f57536bc7bb1475e7e Mon Sep 17 00:00:00 2001
From: aidan garske <aidangarske03@gmail.com>
Date: Wed, 22 Jul 2026 12:33:18 -0700
Subject: [PATCH] Wire the harness to run make check for mode check examples
 starting with ecc

---
 .github/examples-manifest.yml  | 21 ++-------------------
 .github/scripts/manifest.py    |  7 ++++---
 .github/scripts/run_example.py | 21 +++++++++++++++++++++
 3 files changed, 27 insertions(+), 22 deletions(-)

diff --git a/.github/examples-manifest.yml b/.github/examples-manifest.yml
index 8eb408f0..9dffa62d 100644
--- a/.github/examples-manifest.yml
+++ b/.github/examples-manifest.yml
@@ -383,25 +383,8 @@ examples:
   - id: ecc
     path: ecc
     profile: ecc
-    run:
-      - exec: [./ecc-key-decode]
-        expect: "Success"
-      - exec: [./ecc-params]
-        expect: "Gy: 32"
-      # the last of 10 rounds; a failure in any earlier one now exits non-zero
-      - exec: [./ecc-sign]
-        expect: "Firmware Signature 9: Ret 0"
-      - exec: [./ecc-stack]
-        expect: "stack used ="
-      - exec: [./ecc-verify]
-        expect: "hash_firmware_verify: 0"
-      - exec: [./ecc-verify-minimal]
-        expect: "wc_ecc_verify_hash: ret=0, is_valid_sig=1"
-      # must follow ecc-key-export, which writes the .der it reads
-      - exec: [./ecc-key-export]
-        expect: "ECC Public Key Exported to ./ECC_SECP256K1_pub.pem"
-      - exec: [./ecc-export-Qx-Qy, ECC_SECP256K1.der, qxqy.raw]
-        expect: "Exported Qx and Qy"
+    # asserts via ecc/Makefile's check target
+    mode: check
 
   - id: hash
     path: hash
diff --git a/.github/scripts/manifest.py b/.github/scripts/manifest.py
index a7843e32..58398039 100644
--- a/.github/scripts/manifest.py
+++ b/.github/scripts/manifest.py
@@ -69,7 +69,7 @@ def validate(data):
             sys.exit(f"manifest: duplicate id '{e['id']}'")
         seen.add(e["id"])
         mode = e.get("mode", "run")
-        if mode not in ("run", "build-only", "skip"):
+        if mode not in ("run", "check", "build-only", "skip"):
             sys.exit(f"manifest: {e['id']}: bad mode '{mode}'")
         if mode == "skip" and not e.get("reason"):
             sys.exit(f"manifest: {e['id']}: mode 'skip' requires a 'reason'")
@@ -258,8 +258,9 @@ def cmd_check(data):
         if isinstance(s, dict) and "expect_fail" in s
     )
     print(
-        f"tested: {modes['run']} run, {modes['build-only']} build-only, "
-        f"{modes['skip']} skip -- {asserts} output assertions, {xfails} known-fail"
+        f"tested: {modes['run']} run, {modes['check']} make-check, "
+        f"{modes['build-only']} build-only, {modes['skip']} skip -- "
+        f"{asserts + modes['check']} output assertions, {xfails} known-fail"
     )
 
 
diff --git a/.github/scripts/run_example.py b/.github/scripts/run_example.py
index 327436db..0856dab7 100644
--- a/.github/scripts/run_example.py
+++ b/.github/scripts/run_example.py
@@ -658,6 +658,27 @@ def run_entry(entry, expect_sha, results, wolfssl_ref):
         if binary.exists():
             assert_binary_links_ours(binary, expect_sha)
 
+    # mode: check delegates the run+assert to the example's own `make check`
+    # target, so the assertions live in the Makefile and are user-runnable.
+    if entry.get("mode") == "check":
+        try:
+            p = subprocess.run(["make", "check"], cwd=cwd, capture_output=True,
+                               text=True, env=env, timeout=600)
+            ok = p.returncode == 0
+            detail = "" if ok else f"make check rc={p.returncode}"
+            log = (p.stdout + p.stderr)[-4000:]
+        except subprocess.TimeoutExpired as e:
+            out = e.output or ""
+            if isinstance(out, bytes):
+                out = out.decode(errors="replace")
+            ok, detail, log = False, "make check timed out", out[-4000:]
+        results.append({
+            "id": eid, "target": "make check",
+            "status": "pass" if ok else "fail", "stage": "run",
+            "detail": detail, "log": log,
+        })
+        return ok
+
     all_ok = True
     for step in entry.get("run") or []:
         if "exec" in step and step.get("must_fail"):