Skip to content

Commit 22e505b

Browse files
kareem-wolfsslkareem-wolfssl
authored
Merge pull request #10507 from dgarske/ci_opt
CI Optimizations
2 parents fc2f4fc + 6605060 commit 22e505b

94 files changed

Lines changed: 1106 additions & 300 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/actions/install-apt-deps/action.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,8 @@ runs:
5454
5555
- name: Install packages
5656
shell: bash
57+
env:
58+
APT_CACHE_HIT: ${{ steps.apt-cache.outputs.cache-hit }}
5759
run: |
5860
export DEBIAN_FRONTEND=noninteractive
5961
RETRIES=${{ inputs.retries }}
@@ -62,6 +64,18 @@ runs:
6264
if [ "${{ inputs.no-install-recommends }}" = "true" ]; then
6365
NO_REC="--no-install-recommends"
6466
fi
67+
68+
# Fast path: on cache hit the .debs are already pre-seeded into
69+
# /var/cache/apt/archives. Try installing directly first; if that
70+
# fails (e.g. the cached .debs were superseded in the index) fall
71+
# through to the regular update + install path.
72+
if [ "$APT_CACHE_HIT" = "true" ]; then
73+
if sudo apt-get install -y $NO_REC ${{ inputs.packages }}; then
74+
exit 0
75+
fi
76+
echo "::warning::install from cached .debs failed, falling back to apt-get update"
77+
fi
78+
6579
for i in $(seq 1 $RETRIES); do
6680
if sudo apt-get update -q && \
6781
sudo apt-get install -y $NO_REC ${{ inputs.packages }}; then

‎.github/actions/wait-for-smoke/action.yml‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
name: 'Wait for Smoke Test'
2+
description: 'Polls the Smoke Test workflow for the current commit and fails if it failed.'
3+
4+
# Designed to be the leading job in pull_request-triggered workflows so that
5+
# expensive integration CI does not run unless the smoke build passes.
6+
#
7+
# Push events bypass the wait entirely (we still get smoke results for those
8+
# pushes, but other CI is not gated on push). For drafts, callers should
9+
# skip dependent jobs via `if: github.event.pull_request.draft == false` -
10+
# this action will still pass through if smoke is skipped or absent.
11+
12+
inputs:
13+
workflow:
14+
description: 'Name of the smoke workflow file to wait on'
15+
required: false
16+
default: 'smoke-test.yml'
17+
timeout-seconds:
18+
description: 'Maximum time to wait for smoke to complete'
19+
required: false
20+
default: '1800'
21+
poll-seconds:
22+
description: 'Polling interval'
23+
required: false
24+
default: '20'
25+
github-token:
26+
description: 'GITHUB_TOKEN with actions:read permission'
27+
required: true
28+
29+
runs:
30+
using: 'composite'
31+
steps:
32+
- name: Wait for smoke
33+
shell: bash
34+
env:
35+
GH_TOKEN: ${{ inputs.github-token }}
36+
SMOKE_WORKFLOW: ${{ inputs.workflow }}
37+
TIMEOUT: ${{ inputs.timeout-seconds }}
38+
POLL: ${{ inputs.poll-seconds }}
39+
REPO: ${{ github.repository }}
40+
run: |
41+
set -u
42+
# Only gate pull_request events. Push events are not gated.
43+
if [ "${{ github.event_name }}" != "pull_request" ]; then
44+
echo "Not a pull_request event - skipping smoke gate."
45+
exit 0
46+
fi
47+
48+
HEAD_SHA="${{ github.event.pull_request.head.sha }}"
49+
echo "Waiting for $SMOKE_WORKFLOW on $HEAD_SHA (timeout ${TIMEOUT}s)"
50+
51+
START=$(date +%s)
52+
while :; do
53+
NOW=$(date +%s)
54+
ELAPSED=$((NOW - START))
55+
if [ "$ELAPSED" -ge "$TIMEOUT" ]; then
56+
echo "::error::Timed out after ${TIMEOUT}s waiting for $SMOKE_WORKFLOW on $HEAD_SHA"
57+
exit 1
58+
fi
59+
60+
# Look up the latest run for this workflow + head SHA.
61+
RUN_JSON=$(gh api \
62+
"repos/${REPO}/actions/workflows/${SMOKE_WORKFLOW}/runs?head_sha=${HEAD_SHA}&per_page=1" \
63+
2>/dev/null || echo '{}')
64+
65+
STATUS=$(echo "$RUN_JSON" | jq -r '.workflow_runs[0].status // "missing"')
66+
CONCLUSION=$(echo "$RUN_JSON" | jq -r '.workflow_runs[0].conclusion // ""')
67+
RUN_URL=$(echo "$RUN_JSON" | jq -r '.workflow_runs[0].html_url // ""')
68+
69+
case "$STATUS" in
70+
completed)
71+
case "$CONCLUSION" in
72+
success)
73+
echo "Smoke test passed: $RUN_URL"
74+
exit 0
75+
;;
76+
skipped|neutral)
77+
echo "Smoke test was $CONCLUSION - treating as pass: $RUN_URL"
78+
exit 0
79+
;;
80+
*)
81+
echo "::error::Smoke test concluded as '$CONCLUSION': $RUN_URL"
82+
exit 1
83+
;;
84+
esac
85+
;;
86+
missing)
87+
echo "[$ELAPSED s] No smoke run yet for $HEAD_SHA"
88+
;;
89+
*)
90+
echo "[$ELAPSED s] Smoke status=$STATUS ($RUN_URL)"
91+
;;
92+
esac
93+
94+
sleep "$POLL"
95+
done

‎.github/scripts/check-headers.sh‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
#!/usr/bin/env bash
2+
#
3+
# check-headers.sh
4+
#
5+
# Verifies that every public-facing wolfSSL header compiles standalone
6+
# from a fresh consumer's perspective:
7+
#
8+
# #include <wolfssl/options.h>
9+
# #include <wolfssl/...the header...>
10+
# int main(void) { return 0; }
11+
#
12+
# Catches the common breakage where a header silently relies on a
13+
# transitive include from an earlier `.c` file and stops compiling
14+
# when downstream code includes it first.
15+
#
16+
# Requires:
17+
# * ./configure has been run (so wolfssl/options.h exists).
18+
# * gcc and standard build env.
19+
#
20+
# Usage:
21+
# .github/scripts/check-headers.sh # scan default header set
22+
# .github/scripts/check-headers.sh <files> # scan a specific list
23+
24+
set -u
25+
26+
ROOT="$(git rev-parse --show-toplevel)"
27+
cd "$ROOT" || exit 2
28+
29+
if [ ! -f wolfssl/options.h ]; then
30+
echo "::error::wolfssl/options.h not found - run ./configure first" >&2
31+
exit 2
32+
fi
33+
34+
CC="${CC:-gcc}"
35+
GHA="${GITHUB_ACTIONS:-}"
36+
37+
emit() {
38+
local file="$1" msg="$2"
39+
if [ -n "$GHA" ]; then
40+
printf '::error file=%s,line=1,title=header-self-include::%s\n' "$file" "$msg"
41+
else
42+
printf '%s: %s\n' "$file" "$msg"
43+
fi
44+
}
45+
46+
# Default scope: public wolfssl headers excluding vendor/port subdirs and
47+
# files that are intentionally not standalone-includable.
48+
if [ "$#" -gt 0 ]; then
49+
HEADERS=("$@")
50+
else
51+
# Exclusions:
52+
# * generated / private / test-data headers.
53+
# * wolfcrypt math backends (tfm vs sp_int are mutually exclusive).
54+
# * port/* headers whose first-line vendor SDK include can't be
55+
# satisfied in a generic CI environment (mcapi.h, kcapi.h,
56+
# em_device.h, fsl_dcp.h, hw/inout.h, etc.) or that reference
57+
# vendor-only types. Fix the offending header's vendor #include
58+
# with an #ifdef guard and drop the exclusion in a follow-up.
59+
mapfile -t HEADERS < <(
60+
git ls-files 'wolfssl/*.h' 'wolfssl/wolfcrypt/*.h' \
61+
'wolfssl/wolfcrypt/port/**/*.h' 'wolfssl/openssl/*.h' \
62+
| grep -vE '^wolfssl/(options|internal|certs_test|certs_test_sm|debug-trace-error-codes|debug-untrace-error-codes)\.h$' \
63+
| grep -vE '^wolfssl/wolfcrypt/(fips_test|selftest|tfm)\.h$' \
64+
| grep -vE '^wolfssl/wolfcrypt/port/aria/aria-crypt(ocb)?\.h$' \
65+
| grep -vE '^wolfssl/wolfcrypt/port/autosar/(CryIf|Crypto)\.h$' \
66+
| grep -vE '^wolfssl/wolfcrypt/port/caam/(caam_driver|caam_qnx|wolfcaam_hash)\.h$' \
67+
| grep -vE '^wolfssl/wolfcrypt/port/kcapi/' \
68+
| grep -vE '^wolfssl/wolfcrypt/port/nxp/(dcp_port|se050_port)\.h$' \
69+
| grep -vE '^wolfssl/wolfcrypt/port/Renesas/(renesas_fspsm_internal|renesas-rx64-hw-crypt|renesas-tsip-crypt|renesas_tsip_internal)\.h$' \
70+
| grep -vE '^wolfssl/wolfcrypt/port/silabs/silabs_aes\.h$'
71+
)
72+
fi
73+
74+
TMPDIR="$(mktemp -d)"
75+
trap 'rm -rf "$TMPDIR"' EXIT
76+
77+
FAIL=0
78+
PASS=0
79+
for h in "${HEADERS[@]}"; do
80+
[ -f "$h" ] || continue
81+
cat > "$TMPDIR/test.c" <<EOF
82+
#include <wolfssl/options.h>
83+
#include <$h>
84+
int main(void) { return 0; }
85+
EOF
86+
if out="$("$CC" -I. -c -o /dev/null "$TMPDIR/test.c" 2>&1)"; then
87+
PASS=$((PASS + 1))
88+
else
89+
FAIL=$((FAIL + 1))
90+
first_err="$(printf '%s' "$out" | grep -E 'error:' | head -1 | sed 's/.*error: //')"
91+
emit "$h" "header does not compile standalone: ${first_err:-(see build log)}"
92+
if [ -z "$GHA" ]; then
93+
printf '%s\n' "$out" | head -8 | sed 's/^/ /'
94+
fi
95+
fi
96+
done
97+
98+
echo "check-headers: $PASS pass, $FAIL fail"
99+
[ "$FAIL" -eq 0 ]

0 commit comments

Comments
 (0)