ci: productionize OSP nightly + report for merge

aidangarske · aidangarske · commit 057605809564 · 2026-05-28T17:52:25.000-07:00
Remove all temporary testing scaffolding so everything points at the canonical
repos and runs on the nightly schedule:
- OSP checkout back to wolfssl/osp (drop the fork-branch override)
- nightly-osp: schedule + workflow_dispatch only (drop the ci-draft-pause push
  trigger and paths-ignore)
- nightly-osp: drop the old flat Slack notify; the new osp-report
  (on: workflow_run) handles notification + auto-retry
- osp-report: workflow_run + workflow_dispatch only (drop push trigger and the
  hardcoded fixture run id)
diff --git a/.github/workflows/bind9.yml b/.github/workflows/bind9.yml
@@ -100,8 +100,7 @@ jobs:
       - name: Checkout OSP
         uses: actions/checkout@v4
         with:
-          repository: aidangarske/osp
-          ref: 5.9.1-wolfprov-patches
+          repository: wolfssl/osp
           path: osp
           fetch-depth: 1
       - run: |
diff --git a/.github/workflows/curl.yml b/.github/workflows/curl.yml
@@ -99,8 +99,7 @@ jobs:
       - name: Checkout OSP
         uses: actions/checkout@v4
         with:
-          repository: aidangarske/osp
-          ref: 5.9.1-wolfprov-patches
+          repository: wolfssl/osp
           path: osp
           fetch-depth: 1
 
diff --git a/.github/workflows/grpc.yml b/.github/workflows/grpc.yml
@@ -116,8 +116,7 @@ jobs:
       - name: Checkout OSP
         uses: actions/checkout@v4
         with:
-          repository: aidangarske/osp
-          ref: 5.9.1-wolfprov-patches
+          repository: wolfssl/osp
           path: osp
           fetch-depth: 1
       - run: |
diff --git a/.github/workflows/hostap.yml b/.github/workflows/hostap.yml
@@ -117,8 +117,7 @@ jobs:
       - name: Checkout OSP
         uses: actions/checkout@v4
         with:
-          repository: aidangarske/osp
-          ref: 5.9.1-wolfprov-patches
+          repository: wolfssl/osp
           path: osp
           fetch-depth: 1
 
diff --git a/.github/workflows/krb5.yml b/.github/workflows/krb5.yml
@@ -100,8 +100,7 @@ jobs:
       - name: Checkout OSP
         uses: actions/checkout@v4
         with:
-          repository: aidangarske/osp
-          ref: 5.9.1-wolfprov-patches
+          repository: wolfssl/osp
           path: osp
           fetch-depth: 1
       - run: |
diff --git a/.github/workflows/libcryptsetup.yml b/.github/workflows/libcryptsetup.yml
@@ -100,8 +100,7 @@ jobs:
       - name: Checkout OSP
         uses: actions/checkout@v4
         with:
-          repository: aidangarske/osp
-          ref: 5.9.1-wolfprov-patches
+          repository: wolfssl/osp
           path: osp
           fetch-depth: 1
       - run: |
diff --git a/.github/workflows/libeac3.yml b/.github/workflows/libeac3.yml
@@ -102,8 +102,7 @@ jobs:
       - name: Checkout OSP
         uses: actions/checkout@v4
         with:
-          repository: aidangarske/osp
-          ref: 5.9.1-wolfprov-patches
+          repository: wolfssl/osp
           path: osp
           fetch-depth: 1
       - run: |
diff --git a/.github/workflows/libfido2.yml b/.github/workflows/libfido2.yml
@@ -99,8 +99,7 @@ jobs:
       - name: Checkout OSP
         uses: actions/checkout@v4
         with:
-          repository: aidangarske/osp
-          ref: 5.9.1-wolfprov-patches
+          repository: wolfssl/osp
           path: osp
           fetch-depth: 1
       - run: |
diff --git a/.github/workflows/libnice.yml b/.github/workflows/libnice.yml
@@ -98,8 +98,7 @@ jobs:
       - name: Checkout OSP
         uses: actions/checkout@v4
         with:
-          repository: aidangarske/osp
-          ref: 5.9.1-wolfprov-patches
+          repository: wolfssl/osp
           path: osp
           fetch-depth: 1
       - run: |
diff --git a/.github/workflows/liboauth2.yml b/.github/workflows/liboauth2.yml
@@ -91,8 +91,7 @@ jobs:
       - name: Checkout OSP
         uses: actions/checkout@v4
         with:
-          repository: aidangarske/osp
-          ref: 5.9.1-wolfprov-patches
+          repository: wolfssl/osp
           path: osp
           fetch-depth: 1
 
diff --git a/.github/workflows/libssh2.yml b/.github/workflows/libssh2.yml
@@ -99,8 +99,7 @@ jobs:
       - name: Checkout OSP
         uses: actions/checkout@v4
         with:
-          repository: aidangarske/osp
-          ref: 5.9.1-wolfprov-patches
+          repository: wolfssl/osp
           path: osp
           fetch-depth: 1
       - run: |
diff --git a/.github/workflows/libtss2.yml b/.github/workflows/libtss2.yml
@@ -66,8 +66,7 @@ jobs:
       - name: Checkout OSP
         uses: actions/checkout@v4
         with:
-          repository: aidangarske/osp
-          ref: 5.9.1-wolfprov-patches
+          repository: wolfssl/osp
           path: osp
           fetch-depth: 1
       - run: |
diff --git a/.github/workflows/net-snmp.yml b/.github/workflows/net-snmp.yml
@@ -100,8 +100,7 @@ jobs:
       - name: Checkout OSP
         uses: actions/checkout@v4
         with:
-          repository: aidangarske/osp
-          ref: 5.9.1-wolfprov-patches
+          repository: wolfssl/osp
           path: osp
           fetch-depth: 1
       - run: |
diff --git a/.github/workflows/nightly-osp.yml b/.github/workflows/nightly-osp.yml
@@ -8,17 +8,6 @@ name: Nightly OSP Suite
 # outside the waves.
 
 on:
-  # TEMP(testing): run the full OSP suite on push to the test branch so
-  # Wave 1 (5.9.1) + Wave 2 (5.8.4) run in CI now instead of waiting for
-  # the nightly schedule. REVERT before merge - leave only schedule +
-  # workflow_dispatch.
-  push:
-    branches: [ ci-draft-pause ]
-    # TEMP(testing): report-only pushes must not re-trigger the 2-hour suite.
-    paths-ignore:
-      - '.github/workflows/osp-report.yml'
-      - '.github/workflows/nightly-osp.yml'
-      - '.github/scripts/osp-triage.py'
   schedule:
     - cron: '0 6 * * *'
   workflow_dispatch:
@@ -176,169 +165,3 @@ jobs:
   # === Out-of-wave: not wolfssl-version-split ===
   static-analysis: { uses: ./.github/workflows/static-analysis.yml }
   multi-compiler:  { uses: ./.github/workflows/nightly-multi-compiler.yml }
-
-  notify:
-    name: Slack notification
-    needs:
-      - bind9-591
-      - cjose-591
-      - curl-591
-      - debian-package-591
-      - git-ssh-dr-591
-      - grpc-591
-      - hostap-591
-      - iperf-591
-      - krb5-591
-      - libcryptsetup-591
-      - libeac3-591
-      - libfido2-591
-      - libhashkit2-591
-      - libnice-591
-      - liboauth2-591
-      - librelp-591
-      - libssh2-591
-      - libtss2-591
-      - libwebsockets-591
-      - net-snmp-591
-      - nginx-591
-      - openldap-591
-      - opensc-591
-      - openssh-591
-      - openssl-version-591
-      - openvpn-591
-      - pam-pkcs11-591
-      - ppp-591
-      - python3-ntp-591
-      - qt5network5-591
-      - rsync-591
-      - socat-591
-      - sscep-591
-      - sssd-591
-      - stunnel-591
-      - systemd-591
-      - tcpdump-591
-      - tnftp-591
-      - tpm2-tools-591
-      - x11vnc-591
-      - xmlsec-591
-      - bind9-584
-      - cjose-584
-      - curl-584
-      - debian-package-584
-      - git-ssh-dr-584
-      - grpc-584
-      - hostap-584
-      - iperf-584
-      - krb5-584
-      - libcryptsetup-584
-      - libeac3-584
-      - libfido2-584
-      - libhashkit2-584
-      - libnice-584
-      - liboauth2-584
-      - librelp-584
-      - libssh2-584
-      - libtss2-584
-      - libwebsockets-584
-      - net-snmp-584
-      - nginx-584
-      - openldap-584
-      - opensc-584
-      - openssh-584
-      - openssl-version-584
-      - openvpn-584
-      - pam-pkcs11-584
-      - ppp-584
-      - python3-ntp-584
-      - qt5network5-584
-      - rsync-584
-      - socat-584
-      - sscep-584
-      - sssd-584
-      - stunnel-584
-      - systemd-584
-      - tcpdump-584
-      - tnftp-584
-      - tpm2-tools-584
-      - x11vnc-584
-      - xmlsec-584
-      - static-analysis
-      - multi-compiler
-    if: always()
-    runs-on: ubuntu-latest
-    env:
-      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-    steps:
-      - name: Compose summary
-        id: summary
-        env:
-          NEEDS_JSON: ${{ toJSON(needs) }}
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-        run: |
-          set -euo pipefail
-          PASSED=$(echo "$NEEDS_JSON" | jq -r '
-            to_entries[]
-            | select(.value.result == "success")
-            | .key' | sort)
-          FAILED=$(echo "$NEEDS_JSON" | jq -r '
-            to_entries[]
-            | select(.value.result != "success")
-            | "\(.key) (\(.value.result))"' | sort)
-          PASS_COUNT=$(echo "$PASSED" | awk 'NF{c++} END{print c+0}')
-          FAIL_COUNT=$(echo "$FAILED" | awk 'NF{c++} END{print c+0}')
-          TOTAL=$((PASS_COUNT + FAIL_COUNT))
-
-          if [ "$FAIL_COUNT" -eq 0 ]; then
-            COLOR="good"
-            TITLE=":large_green_circle: Nightly OSP: ALL ${TOTAL} PASSED"
-            DETAILS="All OSP workflows green for $(date -u +%Y-%m-%d)."
-          else
-            COLOR="danger"
-            TITLE=":red_circle: Nightly OSP: ${FAIL_COUNT} of ${TOTAL} FAILED"
-            DETAILS=$'Failed:\n```\n'"${FAILED}"$'\n```'
-          fi
-
-          {
-            echo "color=$COLOR"
-            echo "title<<SUMMARY_EOF"
-            echo "$TITLE"
-            echo "SUMMARY_EOF"
-            echo "details<<SUMMARY_EOF"
-            echo "$DETAILS"
-            echo "Run: $RUN_URL"
-            echo "SUMMARY_EOF"
-          } >> "$GITHUB_OUTPUT"
-
-      - name: Post to Slack
-        if: env.SLACK_WEBHOOK_URL != ''
-        env:
-          TITLE: ${{ steps.summary.outputs.title }}
-          DETAILS: ${{ steps.summary.outputs.details }}
-          COLOR: ${{ steps.summary.outputs.color }}
-        run: |
-          set -euo pipefail
-          PAYLOAD=$(jq -n \
-            --arg title "$TITLE" \
-            --arg details "$DETAILS" \
-            --arg color "$COLOR" \
-            '{
-              attachments: [{
-                color: $color,
-                title: $title,
-                text: $details,
-                mrkdwn_in: ["text"]
-              }]
-            }')
-          curl -fsS -X POST -H 'Content-type: application/json' \
-            --data "$PAYLOAD" "$SLACK_WEBHOOK_URL" >/dev/null
-
-      - name: Log to job output (always)
-        env:
-          TITLE: ${{ steps.summary.outputs.title }}
-          DETAILS: ${{ steps.summary.outputs.details }}
-        run: |
-          {
-            echo "## $TITLE"
-            echo ""
-            echo "$DETAILS"
-          } >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/openldap.yml b/.github/workflows/openldap.yml
@@ -99,8 +99,7 @@ jobs:
       - name: Checkout OSP
         uses: actions/checkout@v4
         with:
-          repository: aidangarske/osp
-          ref: 5.9.1-wolfprov-patches
+          repository: wolfssl/osp
           path: osp
           fetch-depth: 1
       - run: |
diff --git a/.github/workflows/opensc.yml b/.github/workflows/opensc.yml
@@ -100,8 +100,7 @@ jobs:
       - name: Checkout OSP
         uses: actions/checkout@v4
         with:
-          repository: aidangarske/osp
-          ref: 5.9.1-wolfprov-patches
+          repository: wolfssl/osp
           path: osp
           fetch-depth: 1
       - run: |
diff --git a/.github/workflows/openssh.yml b/.github/workflows/openssh.yml
@@ -120,8 +120,7 @@ jobs:
       - name: Checkout OSP
         uses: actions/checkout@v4
         with:
-          repository: aidangarske/osp
-          ref: 5.9.1-wolfprov-patches
+          repository: wolfssl/osp
           path: osp
           fetch-depth: 1
       - run: |
diff --git a/.github/workflows/openvpn.yml b/.github/workflows/openvpn.yml
@@ -106,8 +106,7 @@ jobs:
       - name: Checkout OSP
         uses: actions/checkout@v4
         with:
-          repository: aidangarske/osp
-          ref: 5.9.1-wolfprov-patches
+          repository: wolfssl/osp
           path: osp
           fetch-depth: 1
       - run: |
diff --git a/.github/workflows/osp-report.yml b/.github/workflows/osp-report.yml
@@ -1,9 +1,6 @@
 name: OSP Triage Report
 
 on:
-  # TEMP(testing): one-shot report against a finished run. REVERT before merge.
-  push:
-    branches: [ ci-draft-pause ]
   workflow_run:
     workflows: ["Nightly OSP Suite"]
     types: [completed]
@@ -28,7 +25,6 @@ jobs:
     # Skip untrusted fork-PR runs; only analyze canonical-repo runs.
     if: >
       github.event_name == 'workflow_dispatch' ||
-      github.event_name == 'push' ||
       github.event.workflow_run.head_repository.full_name == github.repository
     steps:
       - uses: actions/checkout@v4
@@ -38,7 +34,7 @@ jobs:
       - name: Triage and report
         env:
           GH_REPO: ${{ github.repository }}
-          RUN_ID: ${{ github.event_name == 'workflow_dispatch' && inputs.run_id || github.event_name == 'push' && '26607404315' || github.event.workflow_run.id }}
+          RUN_ID: ${{ github.event_name == 'workflow_dispatch' && inputs.run_id || github.event.workflow_run.id }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
diff --git a/.github/workflows/ppp.yml b/.github/workflows/ppp.yml
@@ -104,8 +104,7 @@ jobs:
       - name: Checkout OSP
         uses: actions/checkout@v4
         with:
-          repository: aidangarske/osp
-          ref: 5.9.1-wolfprov-patches
+          repository: wolfssl/osp
           path: osp
           fetch-depth: 1
       - run: |
diff --git a/.github/workflows/python3-ntp.yml b/.github/workflows/python3-ntp.yml
diff --git a/.github/workflows/qt5network5.yml b/.github/workflows/qt5network5.yml
diff --git a/.github/workflows/socat.yml b/.github/workflows/socat.yml
diff --git a/.github/workflows/sssd.yml b/.github/workflows/sssd.yml
diff --git a/.github/workflows/stunnel.yml b/.github/workflows/stunnel.yml
diff --git a/.github/workflows/tcpdump.yml b/.github/workflows/tcpdump.yml
diff --git a/.github/workflows/x11vnc.yml b/.github/workflows/x11vnc.yml
diff --git a/.github/workflows/xmlsec.yml b/.github/workflows/xmlsec.yml
