Repository navigation
Run-checker merge #1099
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Copyright 2021-2026 The OpenSSL Project Authors. All Rights Reserved. | |
| # | |
| # Licensed under the Apache License 2.0 (the "License"). You may not use | |
| # this file except in compliance with the License. You can obtain a copy | |
| # in the file LICENSE in the source distribution or at | |
| # https://www.openssl.org/source/license.html | |
| name: Run-checker merge | |
| # Jobs run per merge to master | |
| on: | |
| push: | |
| workflow_dispatch: | |
| inputs: | |
| pr: | |
| description: 'Internal: openssl-ci-bot PR number. Leave empty for a normal manual run.' | |
| required: false | |
| type: string | |
| head_sha: | |
| description: 'Internal: openssl-ci-bot commit SHA. Leave empty for a normal manual run.' | |
| required: false | |
| type: string | |
| check_run_id: | |
| description: 'Internal: openssl-ci-bot check-run ID. Leave empty for a normal manual run.' | |
| required: false | |
| type: string | |
| # Keep in sync with openssl-ci-bot's run-name parser, and with the Actions statistics | |
| # collector that attributes CI load by parsing this same string. Both break silently. | |
| run-name: >- | |
| ${{ github.event.inputs.pr && format('ci-dispatch pr={0} head={1} check_run_id={2}', github.event.inputs.pr, github.event.inputs.head_sha, github.event.inputs.check_run_id) || github.workflow }} | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.inputs.pr || github.run_id }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| # Only a dispatch carries inputs, so this is skipped on a push. No repository clause: | |
| # the build jobs below keep running in forks on push, and the validator must not claim | |
| # a boundary they do not have. | |
| validate-dispatch-inputs: | |
| if: inputs.pr != '' || inputs.head_sha != '' || inputs.check_run_id != '' | |
| uses: ./.github/workflows/validate-dispatch-inputs.yml | |
| with: | |
| pr: ${{ inputs.pr }} | |
| head_sha: ${{ inputs.head_sha }} | |
| check_run_id: ${{ inputs.check_run_id }} | |
| run-checker: | |
| needs: [validate-dispatch-inputs] | |
| if: | | |
| !cancelled() && | |
| (needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped') | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| opt: [ | |
| enable-asan enable-ubsan no-shared no-asm -DOPENSSL_SMALL_FOOTPRINT -fno-sanitize=function, | |
| no-dso, | |
| no-ec2m enable-fips, | |
| no-shared, | |
| no-err, | |
| no-filenames, | |
| enable-ubsan no-asm -DOPENSSL_SMALL_FOOTPRINT -fno-sanitize=function, | |
| no-module, | |
| no-ocsp, | |
| no-pinshared, | |
| no-srp, | |
| no-srtp, | |
| no-ts, | |
| no-ui, | |
| no-integrity-only-ciphers, | |
| enable-weak-ssl-ciphers, | |
| enable-zlib, | |
| enable-pie, | |
| ] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Adjust ASLR for sanitizer | |
| run: | | |
| sudo cat /proc/sys/vm/mmap_rnd_bits | |
| sudo sysctl -w vm.mmap_rnd_bits=28 | |
| - uses: actions/checkout@v6 | |
| with: | |
| persist-credentials: false | |
| ref: ${{ github.event.inputs.head_sha || github.sha }} | |
| - name: checkout fuzz/corpora submodule | |
| run: git submodule update --init --depth 1 fuzz/corpora | |
| - name: config | |
| run: CC=clang ./config --strict-warnings --banner=Configured ${{ matrix.opt }} | |
| - name: config dump | |
| run: ./configdata.pm --dump | |
| - name: make | |
| run: make -s -j4 | |
| - name: get cpu info | |
| run: | | |
| cat /proc/cpuinfo | |
| if [ -x apps/openssl ] ; then ./util/opensslwrap.sh version -c ; fi | |
| - name: make test | |
| run: make test HARNESS_JOBS=${HARNESS_JOBS:-4} | |
| jitter: | |
| needs: [validate-dispatch-inputs] | |
| if: | | |
| !cancelled() && | |
| (needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped') | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: checkout openssl | |
| uses: actions/checkout@v6 | |
| with: | |
| persist-credentials: false | |
| ref: ${{ github.event.inputs.head_sha || github.sha }} | |
| # Third-party, pinned to a release tag: not repointed at the pull request's choice. | |
| - name: checkout jitter | |
| uses: actions/checkout@v6 | |
| with: | |
| repository: smuellerDD/jitterentropy-library | |
| ref: v3.5.0 | |
| path: jitter | |
| persist-credentials: false | |
| - name: build jitter | |
| run: make -C jitter/ | |
| - name: checkout fuzz/corpora submodule | |
| run: git submodule update --init --depth 1 fuzz/corpora | |
| - name: config | |
| run: ./config --with-rand-seed=none enable-jitter enable-fips-jitter --with-jitter-include=jitter/ --with-jitter-lib=jitter/ -DOPENSSL_DEFAULT_SEED_SRC=JITTER && perl configdata.pm --dump | |
| - name: make | |
| run: make -s -j4 | |
| - name: get cpu info | |
| run: | | |
| cat /proc/cpuinfo | |
| ./util/opensslwrap.sh version -c | |
| - name: make test | |
| run: make test HARNESS_JOBS=${HARNESS_JOBS:-4} | |
| threads_sanitizer_atomic_fallback: | |
| needs: [validate-dispatch-inputs] | |
| if: | | |
| !cancelled() && | |
| (needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped') | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| persist-credentials: false | |
| ref: ${{ github.event.inputs.head_sha || github.sha }} | |
| - name: checkout fuzz/corpora submodule | |
| run: git submodule update --init --depth 1 fuzz/corpora | |
| - name: Adjust ASLR for sanitizer | |
| run: | | |
| sudo cat /proc/sys/vm/mmap_rnd_bits | |
| sudo sysctl -w vm.mmap_rnd_bits=28 | |
| - name: config | |
| run: CC=clang ./config --strict-warnings --banner=Configured no-shared no-fips -g -fsanitize=thread -DBROKEN_CLANG_ATOMICS && perl configdata.pm --dump | |
| - name: make | |
| run: make -s -j4 | |
| - name: get cpu info | |
| run: | | |
| cat /proc/cpuinfo | |
| ./util/opensslwrap.sh version -c | |
| - name: make test | |
| run: make test V=1 TESTS="test_lhash test_threads test_internal_provider test_provfetch test_provider test_pbe test_evp_kdf test_pkcs12 test_store test_evp test_quic* test_dtls_listener_races" |