multi-compiler.yml

name: Multiple Compilers

on:
  push:
    branches: [ 'master', 'main', 'release/**' ]
  pull_request:
    branches: [ '*' ]
    types: [opened, synchronize, reopened, ready_for_review]
  repository_dispatch:
    types: [nightly-trigger]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build_wolfssl:
    name: Build wolfSSL
    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      # Cache the built wolfSSL tree keyed on the resolved upstream commit so it
      # is rebuilt only when wolfSSL master moves, not on every CI run.
      - name: Resolve wolfSSL commit
        id: wolfssl_rev
        run: echo "sha=$(git ls-remote https://github.com/wolfSSL/wolfssl.git master | awk 'NR==1{print $1}')" >> "$GITHUB_OUTPUT"

      - name: Cache wolfSSL build
        id: wolfssl_cache
        uses: actions/cache@v4
        with:
          path: wolfssl
          key: wolfssl-multicompiler-${{ runner.os }}-${{ steps.wolfssl_rev.outputs.sha }}-v1

      - name: Checkout wolfSSL
        if: steps.wolfssl_cache.outputs.cache-hit != 'true'
        uses: actions/checkout@v4
        with:
          repository: wolfssl/wolfssl
          path: wolfssl
          ref: ${{ steps.wolfssl_rev.outputs.sha }}

      - name: Build wolfSSL
        if: steps.wolfssl_cache.outputs.cache-hit != 'true'
        working-directory: ./wolfssl
        run: |
          ./autogen.sh
          ./configure --enable-wolftpm --enable-pkcallbacks
          make -j$(nproc)

      - name: Install wolfSSL
        working-directory: ./wolfssl
        run: |
          sudo make install
          sudo ldconfig

      - name: tar build-dir
        run: tar -zcf wolfssl-install.tgz /usr/local/lib/libwolfssl* /usr/local/include/wolfssl

      - name: Upload built lib
        uses: actions/upload-artifact@v4
        with:
          name: wolfssl-multi-compiler
          path: wolfssl-install.tgz
          retention-days: 5

  compiler_test:
    name: ${{ matrix.cc }}
    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
    runs-on: ubuntu-latest
    # Headroom for an occasionally-slow apt mirror installing a version-specific
    # compiler (apt-retry handles real failures; this avoids a hard cancel).
    timeout-minutes: 12
    needs: build_wolfssl
    strategy:
      fail-fast: false
      matrix:
        include:
          - cc: gcc-11
            cxx: g++-11
          - cc: gcc-12
            cxx: g++-12
          - cc: gcc-13
            cxx: g++-13
          - cc: clang-14
            cxx: clang++-14
          - cc: clang-15
            cxx: clang++-15
          - cc: clang-17
            cxx: clang++-17

    steps:
      # Checkout first so the local apt-retry composite action is on disk.
      - name: Checkout wolfTPM
        uses: actions/checkout@v4

      # Version-specific compilers are not baked into the CI image; keep this
      # job on the host runner and just make apt resilient to mirror timeouts.
      - name: Install compiler
        uses: ./.github/actions/apt-retry
        with:
          packages: ${{ matrix.cc }}

      - name: Download wolfSSL
        uses: actions/download-artifact@v4
        with:
          name: wolfssl-multi-compiler

      - name: Install wolfSSL
        run: |
          sudo tar -xzf wolfssl-install.tgz -C /
          sudo ldconfig

      - name: Build wolfTPM with ${{ matrix.cc }}
        env:
          CC: ${{ matrix.cc }}
          CXX: ${{ matrix.cxx }}
        run: |
          ./autogen.sh
          ./configure --disable-fwtpm CFLAGS="-Wall -Wextra -Wpedantic"
          make -j$(nproc)

      - name: Make dist
        run: make dist

      - name: Show log on errors
        if: failure()
        run: cat config.log