ci: openssl-version.yml moves to nightly (58 versions is too much per PR)

The dynamic resolver turned openssl-version.yml's matrix into ~58
upstream openssl-3.X.Y releases x 2 wolfssl refs = ~116 jobs. That's
the load nightly was built to absorb, not something to fire on every
push.

  - openssl-version.yml: on: { workflow_call, workflow_dispatch }
    (was push + pull_request). The `if: github.event.pull_request.draft`
    guards are removed -- workflow_call inherits caller context.
  - nightly-osp.yml: added openssl-version to both the dispatch list
    and the notify job's `needs:` so it shows up in the Slack summary
    alongside the OSP integration results.

PR-side OpenSSL coverage stays adequate via simple.yml:
  wolfssl_ref:  master + latest-stable        (resolved dynamically)
  openssl_ref:  openssl_latest_ref + openssl-3.0.17

2 x 2 = 4 combos x 2 replace_default = 8 jobs. Exercises latest
upstream and the oldest still-maintained 3.0.x LTS, against both
wolfssl master and the latest -stable tag, on every PR. The full
58-version sweep runs once a night.

Author: aidangarske

.github/workflows/nightly-osp.yml

@@ -73,6 +73,8 @@ jobs:
   tpm2-tools:     { uses: ./.github/workflows/tpm2-tools.yml }
   x11vnc:         { uses: ./.github/workflows/x11vnc.yml }
   xmlsec:         { uses: ./.github/workflows/xmlsec.yml }
+  # Internal sweep: every upstream openssl-3.X.Y release tag.
+  openssl-version: { uses: ./.github/workflows/openssl-version.yml }
 
   notify:
     name: Slack notification
@@ -117,6 +119,7 @@ jobs:
       - tpm2-tools
       - x11vnc
       - xmlsec
+      - openssl-version
     if: always()
     runs-on: ubuntu-latest
     # Job-level env so step `if:` blocks can see SLACK_WEBHOOK_URL --

.github/workflows/openssl-version.yml

@@ -1,37 +1,28 @@
 name: OpenSSL Version Tests
 
-# START OF COMMON SECTION
+# Full sweep across every upstream openssl-3.X.Y release tag, resolved
+# at run time by _discover-versions.yml. ~58 versions x 2 wolfssl refs
+# = ~116 jobs, which is nightly-shaped work, not per-PR.
+#
+# Runs nightly via the Nightly OSP Suite orchestrator
+# (.github/workflows/nightly-osp.yml) or manually via workflow_dispatch.
+# PR-side OpenSSL coverage comes from simple.yml (newest upstream +
+# oldest 3.0.x LTS, against master + latest-stable wolfssl).
+
 on:
-  push:
-    branches: [ 'master', 'main', 'release/**' ]
-  pull_request:
-    branches: [ '*' ]
-    types: [opened, synchronize, reopened, ready_for_review]
-    paths-ignore:
-      - '**.md'
-      - 'docs/**'
-      - 'LICENSE*'
-      - '.github/ISSUE_TEMPLATE/**'
-      - '.github/dependabot.yml'
-      - '.gitignore'
-      - 'AUTHORS'
-      - 'COPYING'
-      - 'README*'
-      - 'CHANGELOG*'
+  workflow_call: {}
+  workflow_dispatch: {}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
-# END OF COMMON SECTION
 
 jobs:
   discover_versions:
-    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
     uses: ./.github/workflows/_discover-versions.yml
 
   openssl_version_test:
     needs: discover_versions
-    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
     continue-on-error: true
     name: OpenSSL Version Test
     runs-on: ubuntu-22.04

.github/workflows/simple.yml

@@ -39,8 +39,8 @@ jobs:
       fail-fast: false
       matrix:
         # 2 wolfssl (master + latest-stable, resolved at run time) x
-        # 2 openssl (latest upstream, resolved at run time, plus oldest
-        # still-maintained 3.0.x) x 2 replace-default = 8 jobs.
+        # 2 openssl (latest upstream release + oldest 3.0.x LTS)
+        # x 2 replace-default = 8 jobs.
         wolfssl_ref: ${{ fromJson(needs.discover_versions.outputs.wolfssl_ref_array) }}
         openssl_ref:
           - ${{ needs.discover_versions.outputs.openssl_latest_ref }}