Add CI that builds and runs every example #221
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Emulated Examples | |
| # Examples that need hardware -- run against a simulator instead. No boards, | |
| # no licences, all on a stock runner. | |
| on: | |
| push: | |
| branches: [ '**' ] | |
| paths: | |
| - 'tpm/**' | |
| - 'SGX_Linux/**' | |
| - 'can-bus/**' | |
| - '.github/workflows/emulated.yml' | |
| - '.github/examples-manifest.yml' | |
| pull_request: | |
| types: [opened, synchronize, reopened, ready_for_review] | |
| # No cron: nightly.yml calls this, so the nightly stays one run and one triage writer | |
| workflow_call: | |
| inputs: | |
| caller_run_id: | |
| description: 'run id of the calling workflow; keeps a called run in its own concurrency group' | |
| type: string | |
| default: '' | |
| workflow_dispatch: | |
| # github.workflow is the CALLER's name in a called workflow, so hardcode ours | |
| concurrency: | |
| group: ${{ inputs.caller_run_id && format('emulated-call-{0}', inputs.caller_run_id) || format('emulated-{0}', github.ref) }} | |
| cancel-in-progress: ${{ !inputs.caller_run_id }} | |
| permissions: | |
| contents: read | |
| jobs: | |
| resolve: | |
| uses: ./.github/workflows/_resolve-wolfssl.yml | |
| with: | |
| stable_count: 1 | |
| tpm: | |
| needs: resolve | |
| name: Run / tpm (${{ matrix.simulator }}) wolfSSL ${{ matrix.wolfssl_ref }} | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 30 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| wolfssl_ref: ${{ fromJson(needs.resolve.outputs.refs_json) }} | |
| # Both TPMs: a disagreement between them is a real finding | |
| simulator: [ibmswtpm2, fwtpm] | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: ./.github/actions/apt-update | |
| - run: | | |
| sudo apt-get install -y --no-install-recommends autoconf automake libtool | |
| pip install --quiet pyyaml | |
| - uses: ./.github/actions/setup-wolfssl | |
| id: wolfssl | |
| with: | |
| ref: ${{ matrix.wolfssl_ref }} | |
| flags: --enable-all --enable-wolftpm --enable-cryptocb --enable-static --enable-shared | |
| # fwTPM's RSA_Encrypt/Decrypt return TPM_RC_SCHEME without it, and | |
| # --enable-all does not imply it (only the FIPS and provider paths do) | |
| cflags: -DWC_RSA_NO_PADDING | |
| # fwtpm builds wolfTPM's own simulator; swtpm gives both legs the socket transport | |
| - name: Build wolfTPM | |
| run: | | |
| set -euo pipefail | |
| git clone --depth 1 --branch v4.1.0 https://github.com/wolfSSL/wolfTPM /tmp/wolftpm | |
| cd /tmp/wolftpm | |
| ./autogen.sh | |
| ./configure --enable-fwtpm --enable-swtpm | |
| make -j"$(nproc)" | |
| sudo make install | |
| sudo ldconfig | |
| - name: Start ibmswtpm2 | |
| if: matrix.simulator == 'ibmswtpm2' | |
| run: | | |
| set -euo pipefail | |
| git clone --depth 1 --branch rev1682 https://github.com/kgoldman/ibmswtpm2 /tmp/ibmswtpm2 | |
| make -C /tmp/ibmswtpm2/src -j"$(nproc)" | |
| (cd /tmp/ibmswtpm2/src && ./tpm_server &) | |
| - name: Start fwtpm_server | |
| if: matrix.simulator == 'fwtpm' | |
| run: | | |
| set -euo pipefail | |
| # --clear wipes NV state so a rerun cannot inherit the last run's keys | |
| (cd /tmp/wolftpm && ./src/fwtpm/fwtpm_server --clear &) | |
| # both simulators speak the swtpm command interface on TCP 2321, which is | |
| # what makes them interchangeable under the same example | |
| - name: Wait for the TPM on :2321 | |
| run: | | |
| for _ in $(seq 1 200); do | |
| ss -tln | grep -q ':2321 ' && break | |
| sleep 0.05 | |
| done | |
| ss -tln | grep ':2321 ' \ | |
| || { echo "${{ matrix.simulator }} never listened on 2321"; exit 1; } | |
| - name: Build and run tpm example | |
| run: | | |
| python3 .github/scripts/run_example.py --only tpm --no-netns \ | |
| --expect-sha '${{ steps.wolfssl.outputs.sha256 }}' \ | |
| --results results-tpm-${{ matrix.simulator }}.json | |
| - uses: actions/upload-artifact@v4 | |
| if: always() | |
| with: | |
| name: results-tpm-${{ matrix.simulator }}-attempt${{ github.run_attempt }} | |
| path: results-*.json | |
| retention-days: 5 | |
| if-no-files-found: ignore | |
| sgx: | |
| needs: resolve | |
| name: Run / SGX_Linux (SGX_MODE=SIM) wolfSSL ${{ matrix.wolfssl_ref }} | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 40 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| wolfssl_ref: ${{ fromJson(needs.resolve.outputs.refs_json) }} | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - name: Install Intel SGX SDK | |
| run: | | |
| set -euo pipefail | |
| # Simulation mode needs only the SDK -- no PSW, no aesmd, no /dev/sgx_enclave. | |
| url=https://download.01.org/intel-sgx/sgx-linux/2.29/distro/ubuntu24.04-server | |
| wget -q "$url/sgx_linux_x64_sdk_2.29.100.1.bin" | |
| chmod +x sgx_linux_x64_sdk_2.29.100.1.bin | |
| # The installer is interactive. | |
| echo yes | ./sgx_linux_x64_sdk_2.29.100.1.bin | |
| - name: Build wolfSSL for SGX | |
| run: | | |
| set -euo pipefail | |
| git clone -q --depth 1 --branch '${{ matrix.wolfssl_ref }}' \ | |
| https://github.com/wolfSSL/wolfssl /tmp/wolfssl | |
| source sgxsdk/environment | |
| # test.c includes <wolfssl/options.h>, which the SGX build never generates | |
| : > /tmp/wolfssl/wolfssl/options.h | |
| # HAVE_WOLFSSL_TEST must match the App build below: the enclave | |
| # references wolfcrypt_test, so the static lib has to contain it. | |
| make -C /tmp/wolfssl/IDE/LINUX-SGX -f sgx_t_static.mk HAVE_WOLFSSL_TEST=1 | |
| - name: Build enclave and run in simulation | |
| run: | | |
| set -euo pipefail | |
| source sgxsdk/environment | |
| # SKIP_INTELCPU_CHECK: runners are often AMD and SIM mode uses no SGX instructions | |
| make -C SGX_Linux \ | |
| SGX_MODE=SIM SGX_PRERELEASE=0 SGX_DEBUG=0 \ | |
| SGX_WOLFSSL_LIB=/tmp/wolfssl/IDE/LINUX-SGX/ \ | |
| WOLFSSL_ROOT=/tmp/wolfssl \ | |
| HAVE_WOLFSSL_TEST=1 | |
| cd SGX_Linux && SKIP_INTELCPU_CHECK=TRUE ./App | |
| can-bus: | |
| needs: resolve | |
| name: Run / can-bus (vcan) wolfSSL ${{ matrix.wolfssl_ref }} | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 25 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| wolfssl_ref: ${{ fromJson(needs.resolve.outputs.refs_json) }} | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: ./.github/actions/apt-update | |
| - run: | | |
| sudo apt-get install -y --no-install-recommends autoconf automake libtool openssl | |
| pip install --quiet pyyaml | |
| - name: Set up vcan0 | |
| run: | | |
| set -euo pipefail | |
| # vcan ships in linux-modules-extra and must match the running kernel exactly | |
| sudo apt-get install -y "linux-modules-extra-$(uname -r)" | |
| sudo modprobe can | |
| sudo modprobe can-raw | |
| sudo modprobe vcan | |
| sudo ip link add dev vcan0 type vcan | |
| sudo ip link set vcan0 mtu 16 # 16 = classic CAN (72 for CAN FD) | |
| sudo ip link set up vcan0 | |
| ip -details link show vcan0 | |
| - uses: ./.github/actions/setup-wolfssl | |
| id: wolfssl | |
| with: | |
| ref: ${{ matrix.wolfssl_ref }} | |
| flags: --enable-all --enable-static --enable-shared | |
| cflags: "-DWOLFSSL_ISOTP" | |
| - name: Generate certs and build | |
| working-directory: can-bus | |
| run: | | |
| ./generate_ssl.sh | |
| make | |
| - name: Run over vcan0 | |
| working-directory: can-bus | |
| run: | | |
| set -euo pipefail | |
| sudo apt-get install -y --no-install-recommends can-utils | |
| candump -L vcan0 >/tmp/candump.log 2>&1 & | |
| dump=$! | |
| ./server vcan0 >/tmp/can-server.log 2>&1 & | |
| srv=$! | |
| sleep 1 | |
| # The client getline()s stdin, so </dev/null would send nothing | |
| printf 'hello over can\n' | timeout 30 ./client vcan0 || rc=$? | |
| kill "$srv" 2>/dev/null || true | |
| sleep 1; kill "$dump" 2>/dev/null || true | |
| echo "--- server output:" | |
| cat /tmp/can-server.log || true | |
| echo "--- frames on vcan0 ($(wc -l </tmp/candump.log) total), last 16:" | |
| tail -16 /tmp/candump.log || true | |
| exit "${rc:-0}" |