wolfTPM/.github/workflows/release-checks.yml at master · wolfSSL/wolfTPM · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
name: Release Checks

# Gates intended to mirror the wolfTPM release procedure:
#   - C++ build with CC=g++ (proves headers are C++-safe for consumers)
#   - scan-build --status-bugs (Clang static analysis)
# Both run on every PR and every push to release branches so regressions are
# caught at PR time instead of during release prep.

on:
  push:
    branches: [ 'master', 'main', 'release/**', 'rel_v*_prep' ]
  pull_request:
    branches: [ '**' ]
    types: [opened, synchronize, reopened, ready_for_review]
  repository_dispatch:
    types: [nightly-trigger]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build_wolfssl:
    name: Build wolfSSL
    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      # Cache the wolfSSL install prefix keyed on the resolved upstream commit
      # so wolfSSL is rebuilt only when master moves, not on every CI run.
      - name: Resolve wolfSSL commit
        id: wolfssl_rev
        run: echo "sha=$(git ls-remote https://github.com/wolfSSL/wolfssl.git master | awk 'NR==1{print $1}')" >> "$GITHUB_OUTPUT"

      - name: Cache wolfSSL install
        id: wolfssl_cache
        uses: actions/cache@v4
        with:
          path: /tmp/wolfssl-install
          key: wolfssl-release-checks-${{ runner.os }}-${{ steps.wolfssl_rev.outputs.sha }}-v1

      - name: Checkout wolfSSL
        if: steps.wolfssl_cache.outputs.cache-hit != 'true'
        uses: actions/checkout@v4
        with:
          repository: wolfssl/wolfssl
          path: wolfssl
          ref: ${{ steps.wolfssl_rev.outputs.sha }}

      - name: Build wolfSSL
        if: steps.wolfssl_cache.outputs.cache-hit != 'true'
        working-directory: ./wolfssl
        run: |
          ./autogen.sh
          ./configure --enable-wolftpm --enable-pkcallbacks --enable-keygen \
              --prefix=/tmp/wolfssl-install \
              CFLAGS="-DWC_RSA_NO_PADDING"
          make -j$(nproc)
          make install

      - name: Tar install dir
        run: tar -zcf wolfssl-install.tgz -C /tmp wolfssl-install

      - name: Upload wolfSSL install
        uses: actions/upload-artifact@v4
        with:
          name: wolfssl-release-checks
          path: wolfssl-install.tgz
          retention-days: 1

  cxx_build:
    name: C++ build (CC=g++)
    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
    runs-on: ubuntu-latest
    timeout-minutes: 10
    needs: build_wolfssl
    steps:
      - name: Checkout wolfTPM
        uses: actions/checkout@v4

      - name: Download wolfSSL
        uses: actions/download-artifact@v4
        with:
          name: wolfssl-release-checks

      - name: Install wolfSSL
        run: |
          sudo tar -xzf wolfssl-install.tgz -C /tmp
          sudo ldconfig /tmp/wolfssl-install/lib

      - name: Build wolfTPM with g++ (default config)
        run: |
          ./autogen.sh
          ./configure CC=g++ \
              --with-wolfcrypt=/tmp/wolfssl-install
          make -j$(nproc)

      - name: Build wolfTPM with g++ (--enable-fwtpm)
        run: |
          make distclean
          ./configure CC=g++ --enable-fwtpm \
              --with-wolfcrypt=/tmp/wolfssl-install
          make -j$(nproc)

      - name: Show log on errors
        if: failure()
        run: cat config.log

  scan_build:
    name: scan-build (clang static analysis)
    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
    runs-on: ubuntu-latest
    # clang-tools (scan-build) baked into the CI image — no apt mirror.
    container:
      image: ghcr.io/wolfssl/wolftpm-ci:v1.0
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    timeout-minutes: 15
    needs: build_wolfssl
    steps:
      - name: Checkout wolfTPM
        uses: actions/checkout@v4

      - name: Download wolfSSL
        uses: actions/download-artifact@v4
        with:
          name: wolfssl-release-checks

      - name: Install wolfSSL
        run: |
          sudo tar -xzf wolfssl-install.tgz -C /tmp
          sudo ldconfig /tmp/wolfssl-install/lib

      - name: scan-build default configuration
        run: |
          ./autogen.sh
          scan-build --status-bugs ./configure \
              --with-wolfcrypt=/tmp/wolfssl-install
          scan-build --status-bugs -o scan-results-default make -j$(nproc)

      - name: scan-build with --enable-fwtpm
        run: |
          make distclean
          scan-build --status-bugs ./configure --enable-fwtpm \
              --with-wolfcrypt=/tmp/wolfssl-install
          scan-build --status-bugs -o scan-results-fwtpm make -j$(nproc)

      - name: Upload scan reports on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: scan-build-reports
          path: |
            scan-results-default/
            scan-results-fwtpm/
          retention-days: 7