sssd.yml

name: SSSD Tests


on:
  workflow_call:
    inputs:
      wolfssl_refs_json:
        description: "JSON array of wolfssl refs to test; empty = use discover_versions output"
        required: false
        type: string
        default: ""
  workflow_dispatch: {}

jobs:
  test_sssd:
    runs-on: ubuntu-22.04
    permissions:
      contents: read
      packages: write
    timeout-minutes: 60
    container:
      image: quay.io/sssd/ci-client-devel:ubuntu-latest
      env:
        LD_LIBRARY_PATH: /usr/local/lib:/github/home/wolfssl-install/lib:/github/home/openssl-install/lib64
    strategy:
      fail-fast: false
      matrix:
        sssd_ref: [ '2.9.1' ]
        # Caller-passed refs (e.g. nightly-osp 5.8.4 wave) override the default.
        wolfssl_ref: ${{ inputs.wolfssl_refs_json != '' && fromJson(inputs.wolfssl_refs_json) || fromJson('["master","v5.8.0-stable"]') }}
        openssl_ref: [ 'openssl-3.5.0' ]
        force_fail: ['WOLFPROV_FORCE_FAIL=1', '']
        exclude:
          - sssd_ref: 'master'
            force_fail: 'WOLFPROV_FORCE_FAIL=1'
    steps:
      - name: Checkout wolfProvider
        uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Cache build dependencies
        id: deps
        uses: ./.github/actions/oras-build-deps
        with:
          variant: sssd
          openssl_ref: ${{ matrix.openssl_ref }}
          wolfssl_ref: ${{ matrix.wolfssl_ref }}
          github_token: ${{ secrets.GITHUB_TOKEN }}

      - name: Build wolfProvider
        run: |
          OPENSSL_TAG=${{ matrix.openssl_ref }} WOLFSSL_TAG=${{ matrix.wolfssl_ref }} ./scripts/build-wolfprovider.sh

      - name: Push build dependencies
        uses: ./.github/actions/oras-build-deps-push
        with:
          registry: ${{ steps.deps.outputs.registry }}
          openssl_install_tag: ${{ steps.deps.outputs.openssl_install_tag }}
          wolfssl_install_tag: ${{ steps.deps.outputs.wolfssl_install_tag }}
          openssl_hit: ${{ steps.deps.outputs.openssl_hit }}
          wolfssl_hit: ${{ steps.deps.outputs.wolfssl_hit }}

      - name: Install dependencies
        run: |
          # Don't prompt for anything
          export DEBIAN_FRONTEND=noninteractive
          apt-get update
          apt-get install -y build-essential autoconf libldb-dev \
          libldb2 python3-ldb bc libcap-dev libutf8proc-dev

      - name: Setup env
        run: |
          ln -s samba-4.0/ldb.h /usr/include/ldb.h
          ln -s samba-4.0/ldb_errors.h /usr/include/ldb_errors.h
          ln -s samba-4.0/ldb_handlers.h /usr/include/ldb_handlers.h
          ln -s samba-4.0/ldb_module.h /usr/include/ldb_module.h
          ln -s samba-4.0/ldb_version.h /usr/include/ldb_version.h

      - name: Checkout OSP
        uses: actions/checkout@v4
        with:
          repository: wolfssl/osp
          path: osp
          fetch-depth: 1

      - name: Build and test sssd with wolfProvider
        run: |
          # Clone SSSD
          git clone https://github.com/SSSD/sssd.git
          cd sssd
          git checkout ${{ matrix.sssd_ref }}

          # Apply patch for testing
          PATCH=$($GITHUB_WORKSPACE/scripts/resolve-osp-patch.sh $GITHUB_WORKSPACE/osp sssd ${{ matrix.sssd_ref }} ${{ matrix.wolfssl_ref }})
          patch -p1 < "$PATCH"

          # Configure and build SSSD with wolfProvider
          autoreconf -ivf
          ./configure --without-samba --disable-cifs-idmap-plugin \
          --without-nfsv4-idmapd-plugin --with-oidc-child=no
          make -j

      - name: Run tests
        working-directory: sssd
        shell: bash
        run: |
          # Set environment variables
          export LD_LIBRARY_PATH=$GITHUB_WORKSPACE/wolfssl-install/lib:$GITHUB_WORKSPACE/openssl-install/lib64
          export OPENSSL_CONF=$GITHUB_WORKSPACE/provider.conf
          export OPENSSL_MODULES=$GITHUB_WORKSPACE/wolfprov-install/lib
          export ${{ matrix.force_fail }}

          echo "Checking OpenSSL providers:"
          $GITHUB_WORKSPACE/openssl-install/bin/openssl list -providers | tee provider-list.log
          grep -q libwolfprov provider-list.log || (echo "ERROR: libwolfprov not found in OpenSSL providers" && exit 1)

          # If force fail is enabled dont exit with error
          if [ "${{ matrix.force_fail }}" == "WOLFPROV_FORCE_FAIL=1" ]; then
            set +e
          fi

          # Run tests and save result
          make check 2>&1 | tee sssd-test.log
          TEST_RESULT=${PIPESTATUS[0]}
          $GITHUB_WORKSPACE/.github/scripts/check-workflow-result.sh $TEST_RESULT ${{ matrix.force_fail }} sssd