115 lines
3.9 KiB
YAML
115 lines
3.9 KiB
YAML
name: Maven Build (pom.xml)
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
os:
|
|
required: true
|
|
type: string
|
|
jdk_distro:
|
|
required: true
|
|
type: string
|
|
jdk_version:
|
|
required: true
|
|
type: string
|
|
wolfssl_configure:
|
|
required: true
|
|
type: string
|
|
|
|
jobs:
|
|
build_wolfcryptjni:
|
|
runs-on: ${{ inputs.os }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
# Cache the installed wolfSSL build. It depends only on the wolfSSL
|
|
# commit, configure flags, and OS/arch, so jobs across workflows
|
|
# can share one build.
|
|
- name: Resolve wolfSSL cache key
|
|
id: wolfssl-key
|
|
env:
|
|
WOLFSSL_CONFIGURE: ${{ inputs.wolfssl_configure }}
|
|
run: |
|
|
SHA=$(git ls-remote https://github.com/wolfSSL/wolfssl.git \
|
|
refs/heads/master | cut -f1)
|
|
if [ -z "$SHA" ]; then
|
|
echo "Failed to resolve wolfSSL master SHA" >&2
|
|
exit 1
|
|
fi
|
|
CFG_HASH=$(printf '%s' "$WOLFSSL_CONFIGURE" | \
|
|
shasum -a 256 | cut -c1-16)
|
|
KEY="wolfssl-${{ runner.os }}-${{ runner.arch }}-$SHA-$CFG_HASH"
|
|
echo "sha=$SHA" >> "$GITHUB_OUTPUT"
|
|
echo "key=$KEY" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Restore cached wolfSSL install
|
|
id: cache-wolfssl
|
|
uses: actions/cache/restore@v4
|
|
with:
|
|
path: build-dir
|
|
key: ${{ steps.wolfssl-key.outputs.key }}
|
|
|
|
# Build the exact commit the cache key was computed from so the
|
|
# key and contents cannot drift if master advances mid-run.
|
|
- name: Build native wolfSSL
|
|
if: steps.cache-wolfssl.outputs.cache-hit != 'true'
|
|
uses: wolfSSL/actions-build-autotools-project@v1
|
|
with:
|
|
repository: wolfSSL/wolfssl
|
|
ref: ${{ steps.wolfssl-key.outputs.sha }}
|
|
path: wolfssl
|
|
configure: ${{ inputs.wolfssl_configure }}
|
|
check: false
|
|
install: true
|
|
|
|
# Save right after building (not at job end) so a later test
|
|
# failure does not prevent the cache from being populated.
|
|
- name: Save wolfSSL install to cache
|
|
if: steps.cache-wolfssl.outputs.cache-hit != 'true'
|
|
uses: actions/cache/save@v4
|
|
with:
|
|
path: build-dir
|
|
key: ${{ steps.wolfssl-key.outputs.key }}
|
|
|
|
- name: Setup java
|
|
uses: actions/setup-java@v4
|
|
with:
|
|
distribution: ${{ inputs.jdk_distro }}
|
|
java-version: ${{ inputs.jdk_version }}
|
|
cache: 'maven'
|
|
|
|
- name: Set LD_LIBRARY_PATH
|
|
run: |
|
|
echo "LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$GITHUB_WORKSPACE/build-dir/lib" >> "$GITHUB_ENV"
|
|
|
|
- name: Build JNI library
|
|
run: ./java.sh $GITHUB_WORKSPACE/build-dir
|
|
|
|
# Resolve declared dependencies into the local Maven repository so
|
|
# the test dependency bytes can be verified before any test runs.
|
|
- name: Resolve Maven dependencies
|
|
run: mvn -B dependency:resolve
|
|
|
|
# Verify the resolved JUnit test dependencies against the same
|
|
# independently trusted SHA-256 digests pinned in the setup-junit
|
|
# composite action, before mvn package compiles and runs the tests.
|
|
- name: Verify test dependency checksums
|
|
shell: bash
|
|
run: |
|
|
M2="$HOME/.m2/repository"
|
|
echo "8e495b634469d64fb8acfa3495a065cbacc8a0fff55ce1e31007be4c16dc57d3 $M2/junit/junit/4.13.2/junit-4.13.2.jar" \
|
|
| shasum -a 256 -c -
|
|
echo "4877670629ab96f34f5f90ab283125fcd9acb7e683e66319a68be6eb2cca60de $M2/org/hamcrest/hamcrest-all/1.3/hamcrest-all-1.3.jar" \
|
|
| shasum -a 256 -c -
|
|
|
|
# Maven build. A single mvn package runs the compile, test, and
|
|
# package phases in one lifecycle pass. Separate compile, test,
|
|
# and package steps would run the whole test suite twice, once
|
|
# for the test step and again inside package.
|
|
- name: mvn package
|
|
run: mvn package
|
|
|
|
- name: mvn clean
|
|
run: mvn clean
|
|
|