Add CI that builds and runs every example #111
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: PSA | |
| on: | |
| push: | |
| branches: [master] | |
| paths: | |
| - 'psa/**' | |
| - '.github/workflows/psa.yml' | |
| pull_request: | |
| types: [opened, synchronize, reopened, ready_for_review] | |
| paths: | |
| - 'psa/**' | |
| - '.github/workflows/psa.yml' | |
| # No cron: nightly.yml calls this, so the nightly stays one run and one triage writer | |
| workflow_call: | |
| inputs: | |
| caller_run_id: | |
| description: 'run id of the calling workflow; keeps a called run in its own concurrency group' | |
| type: string | |
| default: '' | |
| workflow_dispatch: | |
| # github.workflow is the CALLER's name in a called workflow, so hardcode ours | |
| concurrency: | |
| group: ${{ inputs.caller_run_id && format('psa-call-{0}', inputs.caller_run_id) || format('psa-{0}', github.ref) }} | |
| cancel-in-progress: ${{ !inputs.caller_run_id }} | |
| permissions: | |
| contents: read | |
| jobs: | |
| resolve: | |
| uses: ./.github/workflows/_resolve-wolfssl.yml | |
| with: | |
| stable_count: 1 | |
| psa: | |
| needs: resolve | |
| name: Run / psa (tls13-ecc) wolfSSL ${{ matrix.wolfssl_ref }} | |
| if: github.event_name != 'pull_request' || github.event.pull_request.draft == false | |
| runs-on: ubuntu-24.04 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| wolfssl_ref: ${{ fromJson(needs.resolve.outputs.refs_json) }} | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: ./.github/actions/apt-update | |
| - name: Install build deps | |
| run: | | |
| set -euo pipefail | |
| sudo apt-get install -y --no-install-recommends cmake python3 >/dev/null | |
| # The example's own script pins mbedTLS and runs ./configure --enable-psa itself | |
| - name: Build mbedTLS PSA and wolfSSL with the example's own script | |
| run: | | |
| set -euo pipefail | |
| bash "$GITHUB_WORKSPACE/.github/scripts/git-clone-retry.sh" -q --depth 1 --branch '${{ matrix.wolfssl_ref }}' \ | |
| https://github.com/wolfSSL/wolfssl /tmp/wolfssl | |
| cd /tmp/wolfssl | |
| "$GITHUB_WORKSPACE/psa/build_with_mbedtls_psa.sh" | |
| sudo make install >/dev/null | |
| sudo ldconfig | |
| - name: Build the PSA client and server | |
| env: | |
| PSA_INCLUDE: /tmp/mbedtls/build/include | |
| PSA_LIB_PATH: /tmp/mbedtls/build/library/libmbedcrypto.a | |
| run: | | |
| set -euo pipefail | |
| cd psa | |
| make | |
| test -x ./server-tls13-ecc-psa && test -x ./client-tls13-ecc-psa | |
| # Building proves the PSA glue compiles; only a handshake proves wolfSSL | |
| # actually drove ECDH/ECDSA/HKDF/AES-GCM through mbedTLS's PSA API. | |
| - name: Run the TLS 1.3 PSA handshake | |
| env: | |
| LD_LIBRARY_PATH: /usr/local/lib | |
| run: | | |
| set -uo pipefail | |
| cd psa | |
| # The PSA ECC handshake intermittently rejects with a fatal alert (-313), | |
| # and the server exits on any accept failure, so restart it and retry. | |
| ok=0 | |
| for a in 1 2 3 4 5; do | |
| pkill -f server-tls13-ecc-psa 2>/dev/null || true | |
| for _ in $(seq 1 50); do ss -tln | grep -q ':11111 ' || break; sleep 0.1; done | |
| stdbuf -oL -eL ./server-tls13-ecc-psa > server.log 2>&1 & | |
| for _ in $(seq 1 100); do ss -tln | grep -q ':11111 ' && break; sleep 0.2; done | |
| ss -tln | grep -q ':11111 ' \ | |
| || { echo "attempt $a: server never listened"; cat server.log; continue; } | |
| rc=0 | |
| echo "hello psa" | stdbuf -oL -eL ./client-tls13-ecc-psa 127.0.0.1 > client.log 2>&1 || rc=$? | |
| # The server sends a fixed reply, not an echo (server-tls13-ecc-psa.c:185) | |
| if [ "$rc" -eq 0 ] \ | |
| && grep -q 'Server: I hear ya fa shizzle' client.log \ | |
| && grep -q 'Client: hello psa' server.log; then | |
| ok=1; break | |
| fi | |
| echo "attempt $a failed (client rc=$rc):" | |
| echo "--- client:"; cat client.log | |
| echo "--- server:"; cat server.log | |
| done | |
| pkill -f server-tls13-ecc-psa 2>/dev/null || true | |
| [ "$ok" -eq 1 ] \ | |
| || { echo "FAIL: PSA handshake did not succeed in 5 attempts"; exit 1; } | |
| echo "verified: TLS 1.3 handshake over mbedTLS PSA" |