Build fullstack, java and rt1060 instead of skipping them

Author: aidangarske

.github/examples-manifest.yml

@@ -1121,8 +1121,7 @@ examples:
     path: RT1060
     tier: cross
     profile: all
-    mode: skip
-    reason: "needs the NXP MCUXpresso SDK, which README.md says to generate by hand from mcuxpresso.nxp.com; not fetchable in CI"
+    mode: build-only
   - id: puf
     path: puf
     tier: cross
@@ -1152,8 +1151,7 @@ examples:
     path: fullstack/freertos-wolfip-wolfssl-https
     tier: cross
     profile: all
-    mode: skip
-    reason: "wants wolfssl and wolfip checked out as repo siblings (src/https_server.h hardcodes ../../../../wolfssl/certs); no job wired yet"
+    mode: build-only
   - id: android-wolfcryptjni
     path: android/wolfcryptjni-ndk-gradle
     tier: cross
@@ -1253,8 +1251,7 @@ examples:
     path: java/https-url
     tier: cross
     profile: default
-    mode: skip
-    reason: "plain javac against wolfssljni; needs the wolfssljni jar + JNI lib built first, not wired yet"
+    mode: build-only
     build: none
 
   - id: kernel-bsdkm

.github/scripts/manifest.py

@@ -108,7 +108,10 @@ def job_built_paths():
         for sk in matrix.get("sketch") or []:
             paths.add("Arduino/sketches/" + sk)
     # jobs that build one hardcoded dir rather than a matrix
-    for job, path in (("puf", "puf"), ("rpi-pico", "RPi-Pico")):
+    for job, path in (("puf", "puf"), ("rpi-pico", "RPi-Pico"),
+                      ("fullstack", "fullstack/freertos-wolfip-wolfssl-https"),
+                      ("java", "java/https-url"),
+                      ("rt1060", "RT1060")):
         if job in jobs:
             paths.add(path)
     # the pico job builds the whole cmake tree, so its subdirs come with it

.github/workflows/cross-build.yml

@@ -17,6 +17,9 @@ on:
       - 'uefi-library/**'
       - 'android/**'
       - 'Arduino/sketches/**'
+      - 'fullstack/**'
+      - 'java/**'
+      - 'RT1060/**'
       - '.github/workflows/cross-build.yml'
   pull_request:
     types: [opened, synchronize, reopened, ready_for_review]
@@ -319,6 +322,125 @@ jobs:
           arduino-cli compile --fqbn esp32:esp32:esp32 \
             --libraries "$HOME/Arduino/libraries" . --warnings none
 
+  fullstack:
+    name: fullstack (freertos + wolfip + wolfssl)
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v5
+
+      # setup.sh clones FreeRTOS, wolfSSL and wolfIP as siblings of the repo and
+      # builds them; CMakeLists.txt reaches them via ../../../wolfip etc.
+      # setup_network.sh is only needed to run the sim, not to build it.
+      - name: Run the example's own setup.sh
+        run: |
+          set -euo pipefail
+          cd fullstack/freertos-wolfip-wolfssl-https
+          chmod +x setup.sh
+          ./setup.sh
+
+      - name: Build
+        run: |
+          set -euo pipefail
+          cd fullstack/freertos-wolfip-wolfssl-https
+          mkdir -p build && cd build
+          cmake ..
+          make
+
+      - name: Assert the sim binary came out
+        run: |
+          set -euo pipefail
+          cd fullstack/freertos-wolfip-wolfssl-https
+          f=$(find . -name 'freertos_sim' -type f | head -n1)
+          [ -n "$f" ] || { echo "FAIL: freertos_sim not built"; exit 1; }
+          file "$f"
+
+  java:
+    name: java (https-url)
+    runs-on: ubuntu-24.04
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+
+      # README: javac -cp <wolfssljni>/lib/wolfssl-jsse.jar URLClient.java
+      # so wolfSSL must be built with JNI support and wolfssljni built on top.
+      - name: Build wolfSSL and wolfssljni
+        run: |
+          set -euo pipefail
+          sudo apt-get update -qq
+          sudo apt-get install -y --no-install-recommends ant >/dev/null
+          git clone -q --depth 1 https://github.com/wolfSSL/wolfssl /tmp/wolfssl
+          cd /tmp/wolfssl
+          ./autogen.sh >/dev/null 2>&1
+          ./configure --enable-jni --enable-static --enable-shared >/dev/null
+          make -j"$(nproc)" >/dev/null
+          sudo make install >/dev/null
+          sudo ldconfig
+          git clone -q --depth 1 https://github.com/wolfSSL/wolfssljni /tmp/wolfssljni
+          cd /tmp/wolfssljni
+          ./java.sh
+          ant
+          test -f lib/wolfssl-jsse.jar || { echo "FAIL: wolfssl-jsse.jar not built"; exit 1; }
+
+      - name: Compile URLClient
+        run: |
+          set -euo pipefail
+          cd java/https-url
+          javac -cp /tmp/wolfssljni/lib/wolfssl-jsse.jar URLClient.java
+          test -f URLClient.class || { echo "FAIL: no class produced"; exit 1; }
+          echo "verified: URLClient.class"
+
+  rt1060:
+    name: rt1060 (arm-none-eabi)
+    runs-on: ubuntu-24.04
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install toolchain
+        run: |
+          set -euo pipefail
+          sudo apt-get update -qq
+          sudo apt-get install -y --no-install-recommends \
+            gcc-arm-none-eabi libnewlib-arm-none-eabi build-essential >/dev/null
+
+      # README.md says to generate the SDK by hand from mcuxpresso.nxp.com, but
+      # NXP publishes the same tree on GitHub. CMSIS is a separate repo there,
+      # which the SDK Builder zip folds in as $(SDK)/CMSIS.
+      - name: Fetch the MCUXpresso SDK
+        run: |
+          set -euo pipefail
+          git clone -q --depth 1 https://github.com/nxp-mcuxpresso/mcux-sdk /tmp/sdk
+          git clone -q --depth 1 https://github.com/nxp-mcuxpresso/CMSIS_5 /tmp/cmsis
+          cp -r /tmp/cmsis/CMSIS /tmp/sdk/CMSIS
+          test -d /tmp/sdk/devices/MIMXRT1062/drivers || { echo "FAIL: SDK layout unexpected"; exit 1; }
+          test -d /tmp/sdk/CMSIS/Core/Include || { echo "FAIL: CMSIS missing"; exit 1; }
+
+      - name: Build
+        run: |
+          set -euo pipefail
+          git clone -q --depth 1 https://github.com/wolfSSL/wolfssl /tmp/wolfssl
+          cd RT1060
+          make SDK=/tmp/sdk WOLFSSL=/tmp/wolfssl
+
+      - name: Assert it really cross-compiled
+        run: |
+          set -euo pipefail
+          cd RT1060
+          elf=$(find . -name '*.elf' | head -n1)
+          [ -n "$elf" ] || { echo "FAIL: no .elf produced"; exit 1; }
+          arch=$(readelf -h "$elf" | awk -F: '/Machine:/ {print $2}' | xargs)
+          echo "machine: $arch"
+          case "$arch" in
+            *ARM*) echo "cross-compile verified" ;;
+            *) echo "FAIL: not an ARM binary: $arch"; exit 1 ;;
+          esac
+
   # cross-build.yml already triggers on puf/**, but had no job to run: editing
   # puf/ fired CI that ignored it. PUF_TEST defaults to 1 (synthetic SRAM), so
   # this builds without a board.