Add CI that builds and runs every example #42
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Analysis | |
| on: | |
| # ASan+UBSan gates every PR (fast, verified). valgrind is heavier and | |
| # leak-noise prone, so the nightly (workflow_call) runs it -- see setup job. | |
| push: | |
| branches: [master] | |
| paths: | |
| - '**/*.c' | |
| - '**/*.h' | |
| - '.github/workflows/analysis.yml' | |
| - '.github/scripts/sanitize-run.sh' | |
| pull_request: | |
| types: [opened, synchronize, reopened, ready_for_review] | |
| paths: | |
| - '**/*.c' | |
| - '**/*.h' | |
| - '.github/workflows/analysis.yml' | |
| - '.github/scripts/sanitize-run.sh' | |
| workflow_call: | |
| inputs: | |
| caller_run_id: | |
| description: 'run id of the calling workflow; keeps a called run in its own concurrency group' | |
| type: string | |
| default: '' | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ inputs.caller_run_id && format('analysis-call-{0}', inputs.caller_run_id) || format('analysis-{0}', github.ref) }} | |
| cancel-in-progress: ${{ !inputs.caller_run_id }} | |
| permissions: | |
| contents: read | |
| jobs: | |
| setup: | |
| if: github.event_name != 'pull_request' || github.event.pull_request.draft == false | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 1 | |
| outputs: | |
| modes: ${{ steps.pick.outputs.modes }} | |
| steps: | |
| - id: pick | |
| run: | | |
| # github.event_name is the caller's event (never workflow_call), so key valgrind off the nightly's caller_run_id input | |
| if [ -n "${{ inputs.caller_run_id }}" ] || [ "${{ github.event_name }}" = workflow_dispatch ]; then | |
| echo 'modes=["asan","valgrind"]' >> "$GITHUB_OUTPUT" | |
| else | |
| echo 'modes=["asan"]' >> "$GITHUB_OUTPUT" | |
| fi | |
| analysis: | |
| needs: setup | |
| name: ${{ matrix.mode }} (self-contained crypto examples) | |
| if: github.event_name != 'pull_request' || github.event.pull_request.draft == false | |
| runs-on: ubuntu-24.04 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| mode: ${{ fromJson(needs.setup.outputs.modes) }} | |
| timeout-minutes: 40 | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: ./.github/actions/apt-update | |
| - name: Install toolchain | |
| run: | | |
| set -euo pipefail | |
| sudo apt-get install -y --no-install-recommends autoconf automake libtool | |
| [ "${{ matrix.mode }}" = valgrind ] && sudo apt-get install -y --no-install-recommends valgrind || true | |
| # Deep analysis tracks master, the moving ref -- that is where a new leak or | |
| # UB would land. A sanitized build cannot be shared with a valgrind build. | |
| - name: Build wolfSSL for ${{ matrix.mode }} | |
| run: | | |
| set -euo pipefail | |
| bash "$GITHUB_WORKSPACE/.github/scripts/git-clone-retry.sh" -q --depth 1 --branch master https://github.com/wolfSSL/wolfssl /tmp/wolfssl | |
| cd /tmp/wolfssl | |
| ./autogen.sh >/dev/null | |
| if [ "${{ matrix.mode }}" = asan ]; then | |
| ./configure --enable-all --enable-static --enable-shared \ | |
| CFLAGS="-fsanitize=address,undefined -fno-sanitize-recover=all -g -O1" \ | |
| LDFLAGS="-fsanitize=address,undefined" --prefix=/tmp/wolfssl-inst >/dev/null | |
| else | |
| ./configure --enable-all --enable-static --enable-shared \ | |
| CFLAGS="-g -O1" --prefix=/tmp/wolfssl-inst >/dev/null | |
| fi | |
| make -j"$(nproc)" >/dev/null | |
| make install >/dev/null | |
| - name: Run examples under ${{ matrix.mode }} | |
| run: ./.github/scripts/sanitize-run.sh ${{ matrix.mode }} /tmp/wolfssl-inst |