From 1e6a8b010e801aa11ff0a619eb40d0f79da4fcc0 Mon Sep 17 00:00:00 2001 From: Paul Adelsbach Date: Fri, 24 Jul 2026 13:26:45 -0700 Subject: [PATCH 1/2] CI: split build-and-test workflows with matrix --- .github/workflows/build-and-test-refactor.yml | 35 +++++++++++++++++- .github/workflows/build-and-test.yml | 37 ++++++++++++++++++- 2 files changed, 70 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build-and-test-refactor.yml b/.github/workflows/build-and-test-refactor.yml index 15253f618..3b9741337 100644 --- a/.github/workflows/build-and-test-refactor.yml +++ b/.github/workflows/build-and-test-refactor.yml @@ -15,7 +15,20 @@ jobs: strategy: fail-fast: false matrix: - os: [ubuntu-latest, macos-latest] + # ubuntu runs the configs as parallel groups to shorten the + # critical path; macos stays a single job running everything + # because its org-wide runner pool is much smaller + include: + - os: ubuntu-latest + group: pq-dma + - os: ubuntu-latest + group: wolfcrypt + - os: ubuntu-latest + group: threadsafe + - os: ubuntu-latest + group: light + - os: macos-latest + group: all runs-on: ${{ matrix.os }} @@ -39,81 +52,101 @@ jobs: # Build and test standard build - name: Build and test refactor + if: matrix.group == 'light' || matrix.group == 'all' run: cd test-refactor/posix && make clean && make -j WOLFSSL_DIR=../../wolfssl && make run # Build and test standard build, with DMA and ASAN enabled - name: Build and test refactor DMA ASAN + if: matrix.group == 'pq-dma' || matrix.group == 'all' run: cd test-refactor/posix && make clean && make -j DMA=1 ASAN=1 WOLFSSL_DIR=../../wolfssl && make run # Build and test with LMS and XMSS both in verify-only mode - name: Build and test refactor DMA ASAN LMS/XMSS verify-only + if: matrix.group == 'pq-dma' || matrix.group == 'all' run: cd test-refactor/posix && make clean && make -j DMA=1 ASAN=1 LMS_VERIFY_ONLY=1 XMSS_VERIFY_ONLY=1 WOLFSSL_DIR=../../wolfssl && make run # Build and test mixed: LMS verify-only, XMSS full (exercises shared gating) - name: Build and test refactor DMA ASAN LMS verify-only XMSS full + if: matrix.group == 'pq-dma' || matrix.group == 'all' run: cd test-refactor/posix && make clean && make -j DMA=1 ASAN=1 LMS_VERIFY_ONLY=1 WOLFSSL_DIR=../../wolfssl && make run # Build and test ASAN build, with wolfCrypt tests enabled. - name: Build and test refactor ASAN TESTWOLFCRYPT + if: matrix.group == 'wolfcrypt' || matrix.group == 'all' run: cd test-refactor/posix && make clean && make -j ASAN=1 TESTWOLFCRYPT=1 WOLFSSL_DIR=../../wolfssl && make run # Build and test ASAN build, with wolfCrypt tests enabled and using the DMA devId. - name: Build and test refactor ASAN TESTWOLFCRYPT TESTWOLFCRYPT_DMA + if: matrix.group == 'wolfcrypt' || matrix.group == 'all' run: cd test-refactor/posix && make clean && make -j ASAN=1 TESTWOLFCRYPT=1 TESTWOLFCRYPT_DMA=1 DMA=1 WOLFSSL_DIR=../../wolfssl && make run # Build and test debug build with ASAN and NOCRYPTO - name: Build and test refactor ASAN DEBUG NOCRYPTO + if: matrix.group == 'light' || matrix.group == 'all' run: cd test-refactor/posix && make clean && make -j DEBUG=1 ASAN=1 NOCRYPTO=1 WOLFSSL_DIR=../../wolfssl && make run # Build and test debug build with ASAN and DMA - name: Build and test refactor ASAN DEBUG DMA + if: matrix.group == 'wolfcrypt' || matrix.group == 'all' run: cd test-refactor/posix && make clean && make -j DEBUG=1 ASAN=1 DMA=1 WOLFSSL_DIR=../../wolfssl && make run # Build and test with SHE and ASAN - name: Build and test refactor ASAN SHE + if: matrix.group == 'wolfcrypt' || matrix.group == 'all' run: cd test-refactor/posix && make clean && make -j SHE=1 ASAN=1 WOLFSSL_DIR=../../wolfssl && make run # Build and test with per-client crypto affinity enabled (runs the crypto # affinity unit test, gated behind WOLFHSM_CFG_CRYPTO_AFFINITY) - name: Build and test refactor CRYPTO_AFFINITY ASAN + if: matrix.group == 'wolfcrypt' || matrix.group == 'all' run: cd test-refactor/posix && make clean && make -j CRYPTO_AFFINITY=1 ASAN=1 WOLFSSL_DIR=../../wolfssl && make run # Build and test crypto affinity alongside DMA (exercises HW-devId path) - name: Build and test refactor CRYPTO_AFFINITY DMA ASAN + if: matrix.group == 'wolfcrypt' || matrix.group == 'all' run: cd test-refactor/posix && make clean && make -j CRYPTO_AFFINITY=1 DMA=1 ASAN=1 WOLFSSL_DIR=../../wolfssl && make run # Build and test with DEBUG=1 - name: Build and test refactor with DEBUG + if: matrix.group == 'light' || matrix.group == 'all' run: cd test-refactor/posix && make clean && make -j DEBUG=1 WOLFSSL_DIR=../../wolfssl && make run # Build and test with DEBUG_VERBOSE=1 (includes DEBUG) - name: Build and test refactor with DEBUG_VERBOSE + if: matrix.group == 'light' || matrix.group == 'all' run: cd test-refactor/posix && make clean && make -j DEBUG_VERBOSE=1 WOLFSSL_DIR=../../wolfssl && make run # Build and test in multithreaded mode with everything enabled - name: Build and test refactor with THREADSAFE and everything + if: matrix.group == 'threadsafe' || matrix.group == 'all' run: cd test-refactor/posix && make clean && make -j THREADSAFE=1 DMA=1 SHE=1 ASAN=1 WOLFSSL_DIR=../../wolfssl && make run # Build and test in multithreaded mode with everything enabled and wolfCrypt tests - name: Build and test refactor with THREADSAFE and TESTWOLFCRYPT and everything + if: matrix.group == 'threadsafe' || matrix.group == 'all' run: cd test-refactor/posix && make clean && make -j THREADSAFE=1 TESTWOLFCRYPT=1 DMA=1 SHE=1 ASAN=1 WOLFSSL_DIR=../../wolfssl && make run # Build and test in multithreaded mode with everything enabled and wolfCrypt tests with dma - name: Build and test refactor with THREADSAFE and TESTWOLFCRYPT with DMA + if: matrix.group == 'threadsafe' || matrix.group == 'all' run: cd test-refactor/posix && make clean && make -j THREADSAFE=1 TESTWOLFCRYPT=1 TESTWOLFCRYPT_DMA=1 DMA=1 SHE=1 ASAN=1 WOLFSSL_DIR=../../wolfssl && make run # Build and test with AUTH=1 - name: Build and test refactor with AUTH + if: matrix.group == 'light' || matrix.group == 'all' run: cd test-refactor/posix && make clean && make -j AUTH=1 WOLFSSL_DIR=../../wolfssl && make run # Build and test with AUTH=1 and ASAN - name: Build and test refactor with AUTH ASAN + if: matrix.group == 'light' || matrix.group == 'all' run: cd test-refactor/posix && make clean && make -j AUTH=1 ASAN=1 WOLFSSL_DIR=../../wolfssl && make run # Build and test with AUTH=1 and THREADSAFE - name: Build and test refactor with AUTH THREADSAFE ASAN + if: matrix.group == 'light' || matrix.group == 'all' run: cd test-refactor/posix && make clean && make -j AUTH=1 THREADSAFE=1 ASAN=1 WOLFSSL_DIR=../../wolfssl && make run # Build and test with AUTH=1 and NOCRYPTO=1 (auth on, crypto off) - name: Build and test refactor with AUTH NOCRYPTO + if: matrix.group == 'light' || matrix.group == 'all' run: cd test-refactor/posix && make clean && make -j AUTH=1 NOCRYPTO=1 WOLFSSL_DIR=../../wolfssl && make run diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml index d1af2729b..ff413e905 100644 --- a/.github/workflows/build-and-test.yml +++ b/.github/workflows/build-and-test.yml @@ -15,7 +15,20 @@ jobs: strategy: fail-fast: false matrix: - os: [ubuntu-latest, macos-latest] + # ubuntu runs the configs as parallel groups to shorten the + # critical path; macos stays a single job running everything + # because its org-wide runner pool is much smaller + include: + - os: ubuntu-latest + group: pq-dma + - os: ubuntu-latest + group: wolfcrypt + - os: ubuntu-latest + group: threadsafe + - os: ubuntu-latest + group: light + - os: macos-latest + group: all runs-on: ${{ matrix.os }} @@ -39,89 +52,111 @@ jobs: # Build and test standard build - name: Build and test + if: matrix.group == 'light' || matrix.group == 'all' run: cd test && make clean && make -j WOLFSSL_DIR=../wolfssl && make run # Build and test standard build, with DMA and ASAN enabled - name: Build and test DMA ASAN + if: matrix.group == 'pq-dma' || matrix.group == 'all' run: cd test && make clean && make -j DMA=1 ASAN=1 WOLFSSL_DIR=../wolfssl && make run # Build and test with LMS and XMSS both in verify-only mode - name: Build and test DMA ASAN LMS/XMSS verify-only + if: matrix.group == 'pq-dma' || matrix.group == 'all' run: cd test && make clean && make -j DMA=1 ASAN=1 LMS_VERIFY_ONLY=1 XMSS_VERIFY_ONLY=1 WOLFSSL_DIR=../wolfssl && make run # Build and test mixed: LMS verify-only, XMSS full (exercises shared gating) - name: Build and test DMA ASAN LMS verify-only XMSS full + if: matrix.group == 'pq-dma' || matrix.group == 'all' run: cd test && make clean && make -j DMA=1 ASAN=1 LMS_VERIFY_ONLY=1 WOLFSSL_DIR=../wolfssl && make run # Build and test ASAN build, with wolfCrypt tests enabled. - name: Build and test ASAN TESTWOLFCRYPT + if: matrix.group == 'wolfcrypt' || matrix.group == 'all' run: cd test && make clean && make -j ASAN=1 TESTWOLFCRYPT=1 WOLFSSL_DIR=../wolfssl && make run # Build and test ASAN build, with wolfCrypt tests enabled and using the DMA devId. - name: Build and test ASAN TESTWOLFCRYPT TESTWOLFCRYPT_DMA + if: matrix.group == 'wolfcrypt' || matrix.group == 'all' run: cd test && make clean && make -j ASAN=1 TESTWOLFCRYPT=1 TESTWOLFCRYPT_DMA=1 DMA=1 WOLFSSL_DIR=../wolfssl && make run # Build and test debug build with ASAN and NOCRYPTO - name: Build and test ASAN DEBUG NOCRYPTO + if: matrix.group == 'light' || matrix.group == 'all' run: cd test && make clean && make -j DEBUG=1 ASAN=1 NOCRYPTO=1 WOLFSSL_DIR=../wolfssl && make run # Build and test debug build with ASAN and DMA - name: Build and test ASAN DEBUG DMA + if: matrix.group == 'wolfcrypt' || matrix.group == 'all' run: cd test && make clean && make -j DEBUG=1 ASAN=1 DMA=1 WOLFSSL_DIR=../wolfssl && make run # Build and test with SHE and ASAN - name: Build and test ASAN SHE + if: matrix.group == 'wolfcrypt' || matrix.group == 'all' run: cd test && make clean && make -j SHE=1 ASAN=1 WOLFSSL_DIR=../wolfssl && make run # Build and test with per-client crypto affinity enabled (runs the crypto # affinity unit test, gated behind WOLFHSM_CFG_CRYPTO_AFFINITY) - name: Build and test CRYPTO_AFFINITY ASAN + if: matrix.group == 'wolfcrypt' || matrix.group == 'all' run: cd test && make clean && make -j CRYPTO_AFFINITY=1 ASAN=1 WOLFSSL_DIR=../wolfssl && make run # Build and test crypto affinity alongside DMA (exercises HW-devId path) - name: Build and test CRYPTO_AFFINITY DMA ASAN + if: matrix.group == 'wolfcrypt' || matrix.group == 'all' run: cd test && make clean && make -j CRYPTO_AFFINITY=1 DMA=1 ASAN=1 WOLFSSL_DIR=../wolfssl && make run # Build and test with DEBUG=1 - name: Build and test with DEBUG + if: matrix.group == 'light' || matrix.group == 'all' run: cd test && make clean && make -j DEBUG=1 WOLFSSL_DIR=../wolfssl && make run # Build and test with DEBUG_VERBOSE=1 (includes DEBUG) - name: Build and test with DEBUG_VERBOSE + if: matrix.group == 'light' || matrix.group == 'all' run: cd test && make clean && make -j DEBUG_VERBOSE=1 WOLFSSL_DIR=../wolfssl && make run # Build and test in multithreaded mode with everything enabled - name: Build and test with THREADSAFE and everything + if: matrix.group == 'threadsafe' || matrix.group == 'all' run: cd test && make clean && make -j THREADSAFE=1 DMA=1 SHE=1 ASAN=1 WOLFSSL_DIR=../wolfssl && make run # Build and test in multithreaded mode with everything enabled and wolfCrypt tests - name: Build and test with THREADSAFE and TESTWOLFCRYPT and everything + if: matrix.group == 'threadsafe' || matrix.group == 'all' run: cd test && make clean && make -j THREADSAFE=1 TESTWOLFCRYPT=1 DMA=1 SHE=1 ASAN=1 WOLFSSL_DIR=../wolfssl && make run # Build and test in multithreaded mode with everything enabled and wolfCrypt tests with dma - name: Build and test with THREADSAFE and TESTWOLFCRYPT with DMA + if: matrix.group == 'threadsafe' || matrix.group == 'all' run: cd test && make clean && make -j THREADSAFE=1 TESTWOLFCRYPT=1 TESTWOLFCRYPT_DMA=1 DMA=1 SHE=1 ASAN=1 WOLFSSL_DIR=../wolfssl && make run # Build and test with AUTH=1 - name: Build and test with AUTH + if: matrix.group == 'light' || matrix.group == 'all' run: cd test && make clean && make -j AUTH=1 WOLFSSL_DIR=../wolfssl && make run # Build and test with AUTH=1 and ASAN - name: Build and test with AUTH ASAN + if: matrix.group == 'light' || matrix.group == 'all' run: cd test && make clean && make -j AUTH=1 ASAN=1 WOLFSSL_DIR=../wolfssl && make run # Build and test with AUTH=1 and THREADSAFE - name: Build and test with AUTH THREADSAFE ASAN + if: matrix.group == 'light' || matrix.group == 'all' run: cd test && make clean && make -j AUTH=1 THREADSAFE=1 ASAN=1 WOLFSSL_DIR=../wolfssl && make run # Build and test with AUTH=1 and NOCRYPTO=1 (auth on, crypto off) - name: Build and test with AUTH NOCRYPTO + if: matrix.group == 'light' || matrix.group == 'all' run: cd test && make clean && make -j AUTH=1 NOCRYPTO=1 WOLFSSL_DIR=../wolfssl && make run # Build and test the per-client trusted certificate verify cache - name: Build and test with CERT_VERIFY_CACHE ASAN + if: matrix.group == 'light' || matrix.group == 'all' run: cd test && make clean && make -j CERT_VERIFY_CACHE=1 ASAN=1 WOLFSSL_DIR=../wolfssl && make run # Build and test the global (cross-client) trusted certificate verify cache - name: Build and test with CERT_VERIFY_CACHE_GLOBAL ASAN + if: matrix.group == 'light' || matrix.group == 'all' run: cd test && make clean && make -j CERT_VERIFY_CACHE_GLOBAL=1 ASAN=1 WOLFSSL_DIR=../wolfssl && make run From 0ab74a36ec73df070c5a99560b21932f8ffd83d4 Mon Sep 17 00:00:00 2001 From: Paul Adelsbach Date: Fri, 24 Jul 2026 13:27:14 -0700 Subject: [PATCH 2/2] CI: combine examples workflows by reducing matrix --- .github/workflows/build-and-run-examples.yml | 111 ++++++++++--------- 1 file changed, 56 insertions(+), 55 deletions(-) diff --git a/.github/workflows/build-and-run-examples.yml b/.github/workflows/build-and-run-examples.yml index 1f9be462e..9f6f7cd64 100644 --- a/.github/workflows/build-and-run-examples.yml +++ b/.github/workflows/build-and-run-examples.yml @@ -14,12 +14,8 @@ jobs: strategy: matrix: transport: [ 'tcp', 'shm', 'dma', 'tls', 'psk' ] - asan: [ 'ASAN=1', 'ASAN=0' ] - debug: [ '', 'DEBUG_VERBOSE=1' ] - test: [ '', '--test' ] - auth: [ '', 'AUTH=1' ] runs-on: ubuntu-latest - timeout-minutes: 5 + timeout-minutes: 15 steps: - uses: actions/checkout@v4 @@ -31,56 +27,61 @@ jobs: repository: wolfssl/wolfssl path: wolfssl - - name: Set TLS Environment Variable + # One job per transport; the flag combos run as a loop because a + # matrix job per combo spends about half its time on runner setup. + # The --test variants reuse the same binaries, so each of the 8 + # flag builds serves two client runs. + - name: Build and run examples (all flag combos) run: | - if [ "${{ matrix.transport }}" = "tls" ] || [ "${{ matrix.transport }}" = "psk" ]; then - echo "TLS=1" >> $GITHUB_ENV + WS="$(pwd)" + SERVER_DIR="$WS/examples/posix/wh_posix_server" + CLIENT_DIR="$WS/examples/posix/wh_posix_client" + TRANSPORT="${{ matrix.transport }}" + if [ "$TRANSPORT" = "tls" ] || [ "$TRANSPORT" = "psk" ]; then + TLS=1 else - echo "TLS=0" >> $GITHUB_ENV + TLS=0 fi - - # Build examples - - name: Build POSIX server - run: | - if [ "${{ matrix.transport }}" = "dma" ]; then - cd examples/posix/wh_posix_server && ${{ matrix.asan }} ${{ matrix.debug }} ${{ matrix.auth }} DMA=1 DEMO_KEK=1 make -j WOLFSSL_DIR=../../../wolfssl - else - cd examples/posix/wh_posix_server && ${{ matrix.asan }} ${{ matrix.debug }} ${{ matrix.auth }} TLS=${{ env.TLS }} DEMO_KEK=1 make -j WOLFSSL_DIR=../../../wolfssl - fi - - - name: Build POSIX client - run: | - if [ "${{ matrix.transport }}" = "dma" ]; then - cd examples/posix/wh_posix_client && ${{ matrix.asan }} ${{ matrix.debug }} ${{ matrix.auth }} DMA=1 make -j WOLFSSL_DIR=../../../wolfssl - else - cd examples/posix/wh_posix_client && ${{ matrix.asan }} ${{ matrix.debug }} ${{ matrix.auth }} TLS=${{ env.TLS }} make -j WOLFSSL_DIR=../../../wolfssl - fi - - # Start the server in the background - - name: Run POSIX server - run: | - cd examples/posix/wh_posix_server - if [ "${{ matrix.transport }}" = "psk" ]; then - echo "test_password" | ./Build/wh_posix_server.elf --type ${{ matrix.transport }} & - else - ./Build/wh_posix_server.elf --type ${{ matrix.transport }} & - fi - POSIX_SERVER_PID=$! - echo "POSIX_SERVER_PID=$POSIX_SERVER_PID" >> $GITHUB_ENV - - # Run the client that connects to the server - - name: Run POSIX client - run: | - cd examples/posix/wh_posix_client - if [ "${{ matrix.transport }}" = "psk" ]; then - echo "test_password" | ./Build/wh_posix_client.elf --type ${{ matrix.transport }} ${{ matrix.test }} - else - ./Build/wh_posix_client.elf --type ${{ matrix.transport }} ${{ matrix.test }} - fi - - # Optional: Kill the server process if it doesn't exit on its own - - name: Cleanup POSIX server - if: always() - run: kill $POSIX_SERVER_PID || true - - + for ASAN in ASAN=1 ASAN=0; do + for DEBUG in "" DEBUG_VERBOSE=1; do + for AUTH in "" AUTH=1; do + echo "::group::build $TRANSPORT $ASAN $DEBUG $AUTH" + make -C "$SERVER_DIR" clean + make -C "$CLIENT_DIR" clean + if [ "$TRANSPORT" = "dma" ]; then + env $ASAN $DEBUG $AUTH DMA=1 DEMO_KEK=1 \ + make -C "$SERVER_DIR" -j WOLFSSL_DIR=../../../wolfssl + env $ASAN $DEBUG $AUTH DMA=1 \ + make -C "$CLIENT_DIR" -j WOLFSSL_DIR=../../../wolfssl + else + env $ASAN $DEBUG $AUTH TLS=$TLS DEMO_KEK=1 \ + make -C "$SERVER_DIR" -j WOLFSSL_DIR=../../../wolfssl + env $ASAN $DEBUG $AUTH TLS=$TLS \ + make -C "$CLIENT_DIR" -j WOLFSSL_DIR=../../../wolfssl + fi + echo "::endgroup::" + for TEST in "" --test; do + echo "::group::run $TRANSPORT $ASAN $DEBUG $AUTH test='$TEST'" + rm -f "$SERVER_DIR"/*.bin + cd "$SERVER_DIR" + if [ "$TRANSPORT" = "psk" ]; then + echo "test_password" | ./Build/wh_posix_server.elf --type "$TRANSPORT" & + else + ./Build/wh_posix_server.elf --type "$TRANSPORT" & + fi + SERVER_PID=$! + sleep 1 + cd "$CLIENT_DIR" + if [ "$TRANSPORT" = "psk" ]; then + echo "test_password" | ./Build/wh_posix_client.elf --type "$TRANSPORT" $TEST + else + ./Build/wh_posix_client.elf --type "$TRANSPORT" $TEST + fi + kill $SERVER_PID 2>/dev/null || true + wait $SERVER_PID 2>/dev/null || true + cd "$WS" + echo "::endgroup::" + done + done + done + done