build_and_test.yml

name: Build and test

on:
  push:
    branches: [ master ]
  pull_request:
    branches: [ master ]

jobs:
  test:
    name: ${{ matrix.name }}
    runs-on: ubuntu-latest

    strategy:
      fail-fast: false
      matrix:
        include:
          - name: "nginx 1.29.4 + OpenSSL"
            NGINX_VERSION: "1.29.4"
            TEST_NGINX_TIMEOUT: "5"

          - name: "nginx 1.29.4 + OpenSSL + HTTP/2"
            NGINX_VERSION: "1.29.4"
            TEST_NGINX_TIMEOUT: "5"
            TEST_NGINX_USE_HTTP2: "1"

          - name: "nginx 1.29.4 + OpenSSL + HTTP/3"
            NGINX_VERSION: "1.29.4"
            TEST_NGINX_USE_HTTP3: "1"
            TEST_NGINX_QUIC_IDLE_TIMEOUT: "3"

          - name: "nginx 1.29.4 + BoringSSL + HTTP/3"
            NGINX_VERSION: "1.29.4"
            BORINGSSL: "1"
            TEST_NGINX_USE_HTTP3: "1"
            TEST_NGINX_QUIC_IDLE_TIMEOUT: "3"

    services:
      redis:
        image: redis:7-alpine
        ports:
          - 6379:6379
      mysql:
        image: mysql:8.0
        env:
          MYSQL_ALLOW_EMPTY_PASSWORD: yes
        ports:
          - 3306:3306
        options: >-
          --health-cmd="mysqladmin ping --silent"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=10

    env:
      JOBS: 3
      NGX_BUILD_JOBS: 3
      CC: gcc
      DRIZZLE_VER: "2011.07.21"
      LUAJIT_PREFIX: /opt/luajit21
      LUAJIT_LIB: /opt/luajit21/lib
      LUAJIT_INC: /opt/luajit21/include/luajit-2.1
      LUA_INCLUDE_DIR: /opt/luajit21/include/luajit-2.1
      PCRE2_PREFIX: /usr/local/openresty/pcre2
      PCRE2_LIB: /usr/local/openresty/pcre2/lib
      PCRE2_INC: /usr/local/openresty/pcre2/include
      OPENSSL_PREFIX: /usr/local/openresty/openssl3
      OPENSSL_LIB: /usr/local/openresty/openssl3/lib
      OPENSSL_INC: /usr/local/openresty/openssl3/include
      LIBDRIZZLE_PREFIX: /opt/drizzle
      LIBDRIZZLE_INC: /opt/drizzle/include/libdrizzle-1.0
      LIBDRIZZLE_LIB: /opt/drizzle/lib
      TEST_NGINX_SLEEP: "0.006"
      TEST_NGINX_SKIP_COSOCKET_LOG_TEST: "1"
      MALLOC_PERTURB_: "9"

    steps:
      - uses: actions/checkout@v4

      - name: Install system packages
        run: |
          sudo apt-get update -q
          sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
            ack axel cpanminus \
            libtest-base-perl libtext-diff-perl liburi-perl libwww-perl \
            libtest-longstring-perl liblist-moreutils-perl \
            libgd-dev time cmake libunwind-dev wget \
            libbrotli1 lsb-release gnupg ca-certificates dnsutils

      - name: Install Perl test modules
        run: |
          /usr/bin/env perl $(command -v cpanm) --sudo --notest \
            Test::Nginx IPC::Run Test2::Util > build.log 2>&1 || (cat build.log && exit 1)

      - name: Add OpenResty apt repository
        run: |
          wget -qO- https://openresty.org/package/pubkey.gpg | gpg --dearmor | sudo tee /usr/share/keyrings/openresty.gpg > /dev/null
          echo "deb [signed-by=/usr/share/keyrings/openresty.gpg] https://openresty.org/package/ubuntu $(lsb_release -sc) main" \
            | sudo tee /etc/apt/sources.list.d/openresty.list
          sudo apt-get update -q
          sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
            openresty-pcre2 openresty-openssl3 openresty-pcre2-dev openresty-openssl3-dev

      - name: Cache download directory
        uses: actions/cache@v4
        with:
          path: download-cache
          key: download-cache-${{ runner.os }}-drizzle-${{ env.DRIZZLE_VER }}

      - name: Source code style check
        run: |
          ! grep -n -P '(?<=.{80}).+' --color $(find src -name '*.c') $(find . -name '*.h') \
            || (echo "ERROR: Found C source lines exceeding 80 columns." >&2; exit 1)
          ! grep -n -P '\t+' --color $(find src -name '*.c') $(find . -name '*.h') \
            || (echo "ERROR: Cannot use tabs." >&2; exit 1)

      - name: Clone dependency repositories
        run: |
          # Sibling repos — build scripts reference them via $root/../<name>
          git clone --depth=1 https://github.com/openresty/openresty.git             ../openresty
          git clone --depth=1 https://github.com/openresty/no-pool-nginx.git         ../no-pool-nginx
          git clone --depth=1 https://github.com/openresty/lua-upstream-nginx-module.git ../lua-upstream-nginx-module
          git clone --depth=1 https://github.com/openresty/echo-nginx-module.git         ../echo-nginx-module
          git clone --depth=1 https://github.com/openresty/nginx-eval-module.git         ../nginx-eval-module
          git clone --depth=1 https://github.com/simpl/ngx_devel_kit.git                 ../ndk-nginx-module
          git clone --depth=1 https://github.com/FRiCKLE/ngx_coolkit.git                 ../coolkit-nginx-module
          git clone --depth=1 https://github.com/openresty/headers-more-nginx-module.git ../headers-more-nginx-module
          git clone --depth=1 https://github.com/openresty/drizzle-nginx-module.git      ../drizzle-nginx-module
          git clone --depth=1 https://github.com/openresty/set-misc-nginx-module.git     ../set-misc-nginx-module
          git clone --depth=1 https://github.com/openresty/memc-nginx-module.git         ../memc-nginx-module
          git clone --depth=1 https://github.com/openresty/rds-json-nginx-module.git     ../rds-json-nginx-module
          git clone --depth=1 https://github.com/openresty/srcache-nginx-module.git      ../srcache-nginx-module
          git clone --depth=1 https://github.com/openresty/redis2-nginx-module.git       ../redis2-nginx-module
          git clone --depth=1 https://github.com/openresty/lua-resty-core.git            ../lua-resty-core
          git clone --depth=1 https://github.com/openresty/lua-resty-lrucache.git        ../lua-resty-lrucache
          git clone --depth=1 https://github.com/openresty/lua-resty-mysql.git           ../lua-resty-mysql
          git clone --depth=1 https://github.com/spacewander/lua-resty-rsa.git           ../lua-resty-rsa
          git clone --depth=1 https://github.com/openresty/lua-resty-string.git          ../lua-resty-string
          git clone --depth=1 https://github.com/openresty/stream-lua-nginx-module.git   ../stream-lua-nginx-module

          # Local repos — used directly from the working directory
          git clone --depth=1 https://github.com/openresty/test-nginx.git
          git clone --depth=1 https://github.com/openresty/openresty-devel-utils.git
          git clone --depth=1 https://github.com/openresty/mockeagain.git
          git clone --depth=1 https://github.com/openresty/lua-cjson.git lua-cjson
          git clone -b v2.1-agentzh --depth=1 https://github.com/openresty/luajit2.git luajit2

      - name: Download prebuilt tarballs
        run: |
          mkdir -p download-cache
          if [ ! -f download-cache/drizzle7-$DRIZZLE_VER.tar.gz ]; then
            wget -P download-cache \
              https://github.com/openresty/openresty-deps-prebuild/releases/download/v20230902/drizzle7-$DRIZZLE_VER.tar.gz
          fi
          wget https://github.com/openresty/openresty-deps-prebuild/releases/download/v20230902/boringssl-20230902-x64-focal.tar.gz
          wget https://github.com/openresty/openresty-deps-prebuild/releases/download/v20230902/curl-h3-x64-focal.tar.gz

      - name: Install curl-h3
        run: sudo tar -C / -xf curl-h3-x64-focal.tar.gz

      - name: Start memcached (native, UDP enabled)
        run: |
          sudo apt-get install -y --no-install-recommends memcached
          sudo systemctl stop memcached
          # Ubuntu's default /etc/memcached.conf has "-U 0" which disables UDP.
          # Start manually with UDP on port 11211 so udp-socket tests pass.
          memcached -d -l 127.0.0.1 -p 11211 -U 11211 -m 64
          sudo ss -lntup | grep 11211


      - name: Set up MySQL test database
        run: |
          mysql -h 127.0.0.1 -P 3306 -uroot \
            -e "CREATE DATABASE ngx_test; \
                CREATE USER 'ngx_test'@'%' IDENTIFIED WITH mysql_native_password BY 'ngx_test'; \
                GRANT ALL ON ngx_test.* TO 'ngx_test'@'%'; \
                FLUSH PRIVILEGES;"

      - name: Set up network rules
        run: |
          sudo iptables -I OUTPUT 1 -p udp --dport 10086 -j REJECT
          sudo iptables -I OUTPUT   -p tcp --dst 127.0.0.2 --dport 12345 -j DROP
          sudo iptables -I OUTPUT   -p udp --dst 127.0.0.2 --dport 12345 -j DROP
          sudo ip route add prohibit 0.0.0.1/32
          sudo sysctl -w kernel.pid_max=10000

      - name: Build LuaJIT
        run: |
          cd luajit2
          make -j$JOBS CCDEBUG=-g Q= PREFIX=$LUAJIT_PREFIX CC=$CC \
            XCFLAGS='-DLUA_USE_APICHECK -DLUA_USE_ASSERT -msse4.2' \
            > build.log 2>&1 || (cat build.log && exit 1)
          sudo make install PREFIX=$LUAJIT_PREFIX > build.log 2>&1 || (cat build.log && exit 1)

      - name: Build drizzle7
        run: |
          tar xzf download-cache/drizzle7-$DRIZZLE_VER.tar.gz
          cd drizzle7-$DRIZZLE_VER
          ./configure --prefix=$LIBDRIZZLE_PREFIX --without-server \
            > build.log 2>&1 || (cat build.log && exit 1)
          make libdrizzle-1.0 -j$JOBS > build.log 2>&1 || (cat build.log && exit 1)
          sudo make install-libdrizzle-1.0 > build.log 2>&1 || (cat build.log && exit 1)

      - name: Build mockeagain
        run: cd mockeagain && make CC=$CC -j$JOBS

      - name: Build lua-cjson
        run: cd lua-cjson && make -j$JOBS && sudo make install

      - name: Set up BoringSSL
        if: matrix.BORINGSSL == '1'
        run: |
          sudo rm -fr $OPENSSL_PREFIX
          sudo mkdir -p $OPENSSL_PREFIX
          sudo tar -C $OPENSSL_PREFIX -xf boringssl-20230902-x64-focal.tar.gz --strip-components=1

      - name: Build nginx
        run: |
          export LD_LIBRARY_PATH=$LUAJIT_LIB:$LD_LIBRARY_PATH
          export PATH=$PWD/work/nginx/sbin:$PWD/openresty-devel-utils:/opt/curl-h3/bin:$PATH
          export NGX_BUILD_CC=$CC
          sh util/build-without-ssl.sh ${{ matrix.NGINX_VERSION }} > build.log 2>&1 || (cat build.log && exit 1)
          sh util/build-with-dd.sh     ${{ matrix.NGINX_VERSION }} > build.log 2>&1 || (cat build.log && exit 1)
          rm -fr buildroot
          sh util/build.sh             ${{ matrix.NGINX_VERSION }} > build.log 2>&1 || (cat build.log && exit 1)
          nginx -V
          ldd $(which nginx) | grep -E 'luajit|ssl|pcre'

      - name: Run releng check
        run: |
          export PATH=$PWD/work/nginx/sbin:$PWD/openresty-devel-utils:/opt/curl-h3/bin:$PATH
          ngx-releng > check.txt || true
          lines=$(wc -l check.txt | awk '{print $1}')
          if [ "$lines" -gt 5 ]; then cat check.txt; exit 1; fi

      - name: Set matrix-specific test env vars
        run: |
          # Only export vars that have actual values — Perl's defined() treats
          # empty strings as defined, which would cause false positives in tests
          # like t/103-req-http-ver.t that branch on defined $ENV{TEST_NGINX_USE_HTTP3}.
          [ -n "${{ matrix.TEST_NGINX_TIMEOUT }}" ] \
            && echo "TEST_NGINX_TIMEOUT=${{ matrix.TEST_NGINX_TIMEOUT }}" >> $GITHUB_ENV || true
          [ -n "${{ matrix.TEST_NGINX_USE_HTTP2 }}" ] \
            && echo "TEST_NGINX_USE_HTTP2=${{ matrix.TEST_NGINX_USE_HTTP2 }}" >> $GITHUB_ENV || true
          [ -n "${{ matrix.TEST_NGINX_USE_HTTP3 }}" ] \
            && echo "TEST_NGINX_USE_HTTP3=${{ matrix.TEST_NGINX_USE_HTTP3 }}" >> $GITHUB_ENV || true
          [ -n "${{ matrix.TEST_NGINX_QUIC_IDLE_TIMEOUT }}" ] \
            && echo "TEST_NGINX_QUIC_IDLE_TIMEOUT=${{ matrix.TEST_NGINX_QUIC_IDLE_TIMEOUT }}" >> $GITHUB_ENV || true

      - name: Run tests
        run: |
          export LD_LIBRARY_PATH=$LUAJIT_LIB:$PWD/mockeagain:$LD_LIBRARY_PATH
          export PATH=$PWD/work/nginx/sbin:$PWD/openresty-devel-utils:/opt/curl-h3/bin:$PATH
          export LD_PRELOAD=$PWD/mockeagain/mockeagain.so
          export TEST_NGINX_HTTP3_CRT=$PWD/t/cert/http3/http3.crt
          export TEST_NGINX_HTTP3_KEY=$PWD/t/cert/http3/http3.key
          export TEST_NGINX_RESOLVER=8.8.4.4
          dig +short myip.opendns.com @resolver1.opendns.com || exit 0
          dig +short @$TEST_NGINX_RESOLVER openresty.org || exit 0
          dig +short @$TEST_NGINX_RESOLVER agentzh.org || exit 0
          python3 ./util/nc_server.py &
          /usr/bin/env perl $(command -v prove) -I. -Itest-nginx/inc -Itest-nginx/lib -r t/