Skip to content

Commit a9dbf63

Browse files
denjidenji
committed
ci: refactoring cache, openssl
1 parent bfc76c4 commit a9dbf63

1 file changed

Lines changed: 92 additions & 22 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 92 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -52,10 +52,26 @@ jobs:
5252
- { os: ubuntu-24.04, nginx: "1.29.7", openssl: system, pcre: pcre2 }
5353

5454
# -- Pinned OpenSSL 3.6.1 — exercises the EVP_MAC code path -----------
55-
# Built from source; linked statically via --with-openssl= and
56-
# --with-openssl-opt=no-shared (prevents the dynamic linker from
57-
# falling back to the system OpenSSL at runtime).
58-
# Only ubuntu-24.04; only the three currently maintained versions.
55+
# OpenSSL is built from source as a static-only (no-shared) install
56+
# into ~/openssl, then nginx is pointed at it via --with-cc-opt and
57+
# --with-ld-opt only — NOT --with-openssl=<src>.
58+
#
59+
# Why NOT --with-openssl=<src>:
60+
# nginx's Makefile always injects a bare "-lcrypto" flag before the
61+
# explicit static archive paths in the final link command. When
62+
# --with-openssl=<src> is used, the search path does not include the
63+
# internal .openssl/lib directory, so that bare flag fails with
64+
# "cannot find -lcrypto" once libssl-dev is absent.
65+
#
66+
# Why libssl-dev must NOT be installed for these jobs:
67+
# With libssl-dev present, "-lcrypto" resolves to the system's
68+
# libcrypto.so.3 (OpenSSL 3.0.x) regardless of what comes later in
69+
# the link command, producing a binary that runs with the wrong
70+
# version. Without libssl-dev, "-lcrypto" and "-lssl" resolve
71+
# exclusively to the static archives in ~/openssl/lib64 via the
72+
# -L flag in --with-ld-opt.
73+
#
74+
# Only ubuntu-24.04; only the three currently maintained nginx versions.
5975
- { os: ubuntu-24.04, nginx: "1.26.3", openssl: "3.6.1", pcre: pcre2 }
6076
- { os: ubuntu-24.04, nginx: "1.28.3", openssl: "3.6.1", pcre: pcre2 }
6177
- { os: ubuntu-24.04, nginx: "1.29.7", openssl: "3.6.1", pcre: pcre2 }
@@ -72,10 +88,20 @@ jobs:
7288
sudo apt-get install -y --no-install-recommends \
7389
build-essential \
7490
zlib1g-dev \
75-
libssl-dev \
7691
curl \
7792
ca-certificates
7893
94+
# -----------------------------------------------------------------------
95+
# libssl-dev provides the system OpenSSL headers and shared libraries.
96+
# It is required for system OpenSSL jobs (headers + libcrypto.so for
97+
# nginx's configure feature tests and final linking).
98+
#
99+
# It must NOT be installed for pinned OpenSSL jobs — see matrix comment.
100+
# -----------------------------------------------------------------------
101+
- name: Install system OpenSSL headers (system OpenSSL jobs only)
102+
if: matrix.openssl == 'system'
103+
run: sudo apt-get install -y --no-install-recommends libssl-dev
104+
79105
# -----------------------------------------------------------------------
80106
# PCRE: NGINX 1.20.x requires PCRE1 (libpcre3-dev).
81107
# NGINX 1.26+ uses PCRE2 (libpcre2-dev) by default.
@@ -89,12 +115,32 @@ jobs:
89115
run: sudo apt-get install -y --no-install-recommends libpcre2-dev
90116

91117
# -----------------------------------------------------------------------
92-
# Build a pinned OpenSSL from source when matrix.openssl is not "system".
93-
# Installed into ${HOME}/openssl as a static build; the NGINX configure
94-
# step links against it via --with-openssl= and --with-openssl-opt=no-shared.
118+
# Cache the installed static OpenSSL tree (~/openssl).
119+
# Key: version + OS. Bump -vN to bust manually if needed.
120+
#
121+
# Note on "Failed to save" warnings: GitHub Actions has no write lock on
122+
# cache keys. When several jobs share the same key and finish concurrently
123+
# for the first time, the first writer wins and the rest log a warning.
124+
# This is harmless — all jobs read the cache successfully on subsequent
125+
# runs. It is a first-run-only occurrence.
95126
# -----------------------------------------------------------------------
96-
- name: Build OpenSSL ${{ matrix.openssl }} from source
127+
- name: Cache OpenSSL ${{ matrix.openssl }} build
97128
if: matrix.openssl != 'system'
129+
id: cache-openssl
130+
uses: actions/cache@v4
131+
with:
132+
path: ~/openssl
133+
key: openssl-${{ matrix.openssl }}-${{ matrix.os }}-v1
134+
135+
# -----------------------------------------------------------------------
136+
# Build OpenSSL from source only on cache miss.
137+
#
138+
# "make build_sw" compiles libraries + CLI only — it skips the full test
139+
# suite (200+ binaries) that "make" would build, saving several minutes.
140+
# "make install_sw" installs into ~/openssl without docs or man pages.
141+
# -----------------------------------------------------------------------
142+
- name: Build OpenSSL ${{ matrix.openssl }} from source
143+
if: matrix.openssl != 'system' && steps.cache-openssl.outputs.cache-hit != 'true'
98144
env:
99145
OPENSSL_VERSION: ${{ matrix.openssl }}
100146
run: |
@@ -106,9 +152,8 @@ jobs:
106152
./Configure --prefix="${HOME}/openssl" \
107153
--openssldir="${HOME}/openssl" \
108154
no-shared linux-x86_64
109-
make -j"$(nproc)"
155+
make -j"$(nproc)" build_sw
110156
make install_sw
111-
echo "OPENSSL_SRC=${PWD}" >> "${GITHUB_ENV}"
112157
113158
# -----------------------------------------------------------------------
114159
- name: Download and extract NGINX ${{ matrix.nginx }}
@@ -133,17 +178,26 @@ jobs:
133178
--with-cc-opt="-Wall -Wextra -Wno-unused-parameter" \
134179
2>&1 | tee configure.log
135180
181+
# -----------------------------------------------------------------------
182+
# Pinned OpenSSL: configure nginx using --with-cc-opt / --with-ld-opt
183+
# pointing at ~/openssl. --with-openssl=<src> is intentionally omitted.
184+
#
185+
# --with-cc-opt: supplies the 3.6.1 headers for compilation.
186+
# --with-ld-opt: adds ~/openssl/lib64 to the linker search path so that
187+
# the "-lssl" and "-lcrypto" flags nginx injects resolve to the static
188+
# archives there. -ldl and -pthread satisfy OpenSSL's own link deps
189+
# when statically linked.
190+
# -----------------------------------------------------------------------
136191
- name: Configure NGINX (pinned OpenSSL ${{ matrix.openssl }})
137192
if: matrix.openssl != 'system'
138193
run: |
139194
cd "${NGINX_SRC}"
140195
./configure \
141196
--with-http_ssl_module \
142197
--with-http_v2_module \
143-
--with-openssl="${OPENSSL_SRC}" \
144-
--with-openssl-opt=no-shared \
198+
--with-cc-opt="-Wall -Wextra -Wno-unused-parameter -I${HOME}/openssl/include" \
199+
--with-ld-opt="-L${HOME}/openssl/lib64 -ldl -pthread" \
145200
--add-module="${GITHUB_WORKSPACE}" \
146-
--with-cc-opt="-Wall -Wextra -Wno-unused-parameter" \
147201
2>&1 | tee configure.log
148202
149203
# -----------------------------------------------------------------------
@@ -165,20 +219,39 @@ jobs:
165219
${{ env.NGINX_SRC }}/build.log
166220
167221
# -----------------------------------------------------------------------
222+
# Cache cpanm-installed Perl modules (Test::Nginx + ~17 deps).
223+
# apt packages (cpanminus, libdigest-*) are fast and not cached.
224+
#
225+
# Both paths are required:
226+
# /usr/local/share/perl — pure-Perl modules
227+
# /usr/local/lib/perl5 — XS modules (e.g. List::MoreUtils::XS)
228+
#
229+
# "Failed to save" on first run: see OpenSSL cache note above — same
230+
# mechanism. Harmless; all parallel jobs on subsequent runs get hits.
231+
# -----------------------------------------------------------------------
232+
- name: Cache Perl dependencies
233+
id: cache-perl
234+
uses: actions/cache@v4
235+
with:
236+
path: |
237+
/usr/local/share/perl
238+
/usr/local/lib/perl5
239+
key: perl-test-nginx-0.32-${{ matrix.os }}-v1
240+
168241
- name: Install Perl test dependencies
169242
run: |
170243
sudo apt-get install -y --no-install-recommends \
171244
cpanminus \
172245
libdigest-sha-perl \
173246
libdigest-hmac-perl \
174247
liburi-perl
175-
# Test::Nginx is not packaged in Ubuntu apt repos.
176-
sudo cpanm --notest Test::Nginx
248+
if [ "${{ steps.cache-perl.outputs.cache-hit }}" != "true" ]; then
249+
sudo cpanm --notest Test::Nginx
250+
fi
177251
178252
# -----------------------------------------------------------------------
179253
- name: Verify NGINX binary
180-
run: |
181-
"${NGINX_SRC}/objs/nginx" -V 2>&1
254+
run: "${NGINX_SRC}/objs/nginx" -V 2>&1
182255

183256
# -----------------------------------------------------------------------
184257
- name: Syntax-check test files
@@ -193,10 +266,7 @@ jobs:
193266
env:
194267
TEST_NGINX_BINARY: "${{ env.NGINX_SRC }}/objs/nginx"
195268
TEST_NGINX_SERVROOT: "${{ runner.temp }}/nginx-test"
196-
run: |
197-
# Runs all test files: 01_basic.t 02_timestamps.t 03_algorithms.t
198-
# 04_variables.t 05_integration.t
199-
prove -I t/lib -v --timer t/
269+
run: prove -I t/lib -v --timer t/
200270

201271
# -----------------------------------------------------------------------
202272
- name: Upload nginx error log on test failure

0 commit comments

Comments
 (0)