forked from tlspuffin/tlspuffin
-
Notifications
You must be signed in to change notification settings - Fork 0
182 lines (163 loc) · 7.25 KB
/
ci.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
name: Build & Deploy
on:
workflow_dispatch:
push:
branches:
- main
- trailofbits
pull_request:
permissions:
pull-requests: read # needed for label-based CI/CD configuration
contents: write # needed for deployment jobs
jobs:
configure:
runs-on: ubuntu-22.04
outputs:
checks: ${{ steps.set-checks-profiles.outputs.checks }}
deploy: ${{ steps.set-deploy-profiles.outputs.deploy }}
defaults:
run:
shell: bash
steps:
- id: set-checks-profiles
name: Set CI profiles
run: |
#!/usr/bin/env bash
CI_CHECKS=()
HAS_LABEL_CI_NONE=${{ contains(github.event.pull_request.labels.*.name, 'ci:none') }}
HAS_LABEL_CI_FAST=${{ contains(github.event.pull_request.labels.*.name, 'ci:fast') }}
HAS_LABEL_CI_FULL=${{ contains(github.event.pull_request.labels.*.name, 'ci:full') }}
# set defaults
case "${{ github.event_name == 'pull_request' }}" in
true) CI_CHECKS=( check smoke docs );;
false) CI_CHECKS=( check smoke docs base extra );;
esac
[[ ${HAS_LABEL_CI_NONE} == true ]] && CI_CHECKS=()
[[ ${HAS_LABEL_CI_FAST} == true ]] && CI_CHECKS=( check smoke docs )
[[ ${HAS_LABEL_CI_FULL} == true ]] && CI_CHECKS=( check smoke docs base extra )
json_result=$(printf ', "%s"' "x" "${CI_CHECKS[@]}")
json_result="[${json_result:6}]"
printf 'checks=%s\n' "${json_result}" >> "${GITHUB_OUTPUT}"
- id: set-deploy-profiles
name: Set CD profiles
run: |
#!/usr/bin/env bash
CD_DEPLOYEMENTS=()
if [[ ${{ github.event_name == 'push' && (github.ref == 'refs/heads/main') }} == true ]]; then
CD_DEPLOYEMENTS+=( docs )
fi
json_result=$(printf ', "%s"' "x" "${CD_DEPLOYEMENTS[@]}")
json_result="[${json_result:6}]"
printf 'deploy=%s\n' "${json_result}" >> "${GITHUB_OUTPUT}"
- id: print-configuration
name: print CI/CD profiles
run: |
#!/usr/bin/env bash
printf 'selected CI profiles: %s\n' '${{ steps.set-checks-profiles.outputs.checks }}'
printf 'selected CD profiles: %s\n' '${{ steps.set-deploy-profiles.outputs.deploy }}'
printf 'triggering event:\n'
cat "${GITHUB_EVENT_PATH}"
check:
needs: [configure]
if: ${{ contains(fromJson(needs.configure.outputs.checks), 'check') }}
uses: ./.github/workflows/run-checks.yml
smoke-test:
needs: [configure]
if: ${{ contains(fromJson(needs.configure.outputs.checks), 'smoke') }}
uses: ./.github/workflows/run-smoke-test.yml
docs:
needs: [configure]
if: ${{ contains(fromJson(needs.configure.outputs.checks), 'docs') }}
uses: ./.github/workflows/build-docs.yml
run-benchmarks:
needs: [configure, smoke-test]
if: ${{ contains(fromJson(needs.configure.outputs.checks), 'extra') }}
uses: ./.github/workflows/run-benchmarks.yml
test-tlspuffin:
needs: [configure, smoke-test]
strategy:
fail-fast: false
matrix:
include:
- name: openssl111
features: openssl111
save-cache: "true" # We only save the cache once, else we get too mache cache entries
if: ${{ contains(fromJson(needs.configure.outputs.checks), 'base') }}
- name: openssl111j
features: openssl111j
if: ${{ contains(fromJson(needs.configure.outputs.checks), 'extra') }}
- name: openssl101f_asan
features: openssl101f,asan
apt-dependencies: xutils-dev
if: ${{ contains(fromJson(needs.configure.outputs.checks), 'base') }}
- name: openssl102u
features: openssl102u
if: ${{ contains(fromJson(needs.configure.outputs.checks), 'base') }}
- name: libressl
features: libressl
if: ${{ contains(fromJson(needs.configure.outputs.checks), 'base') }}
- name: wolfssl430
features: wolfssl430
if: ${{ contains(fromJson(needs.configure.outputs.checks), 'base') }}
- name: wolfssl510
features: wolfssl510
if: ${{ contains(fromJson(needs.configure.outputs.checks), 'base') }}
- name: wolfssl510-sig
features: wolfssl510,fix-CVE-2022-25640,fix-CVE-2022-39173
if: ${{ contains(fromJson(needs.configure.outputs.checks), 'extra') }}
- name: wolfssl510-skip
features: wolfssl510,fix-CVE-2022-25638,fix-CVE-2022-39173
if: ${{ contains(fromJson(needs.configure.outputs.checks), 'extra') }}
- name: wolfssl520
features: wolfssl520
if: ${{ contains(fromJson(needs.configure.outputs.checks), 'extra') }}
- name: wolfssl520_asan
features: wolfssl520,asan
if: ${{ contains(fromJson(needs.configure.outputs.checks), 'extra') }}
- name: wolfssl530
features: wolfssl530
if: ${{ contains(fromJson(needs.configure.outputs.checks), 'base') }}
- name: wolfssl530_asan
features: wolfssl530,asan
if: ${{ contains(fromJson(needs.configure.outputs.checks), 'base') }}
- name: wolfssl540
features: wolfssl540
if: ${{ contains(fromJson(needs.configure.outputs.checks), 'base') }}
- name: wolfssl540-sdos2
features: wolfssl540,wolfssl-disable-postauth,fix-CVE-2022-39173
if: ${{ contains(fromJson(needs.configure.outputs.checks), 'extra') }}
- name: wolfssl530-cdos
features: wolfssl530,fix-CVE-2022-39173
if: ${{ contains(fromJson(needs.configure.outputs.checks), 'extra') }}
- name: wolfssl540_asan
features: wolfssl540,asan
if: ${{ contains(fromJson(needs.configure.outputs.checks), 'extra') }}
- name: wolfssl540-buf
features: wolfssl540,fix-CVE-2022-42905
if: ${{ contains(fromJson(needs.configure.outputs.checks), 'extra') }}
- name: wolfssl540-heap
features: wolfssl540,asan,fix-CVE-2022-39173
if: ${{ contains(fromJson(needs.configure.outputs.checks), 'extra') }}
- name: wolfssl540_asan-perf
features: wolfssl540,asan,fix-CVE-2022-39173,fix-CVE-2022-42905
if: ${{ contains(fromJson(needs.configure.outputs.checks), 'extra') }}
- name: wolfssl540-perf
features: wolfssl540,fix-CVE-2022-39173,fix-CVE-2022-42905
if: ${{ contains(fromJson(needs.configure.outputs.checks), 'extra') }}
- name: boringssl202403
features: boringssl202403
if: ${{ contains(fromJson(needs.configure.outputs.checks), 'extra') }}
- name: boringssl202403_asan
features: boringssl202403,asan
if: ${{ contains(fromJson(needs.configure.outputs.checks), 'base') }}
uses: ./.github/workflows/run-tlspuffin-tests.yml
with:
name: ${{ matrix.name }}
features: ${{ matrix.features }}
apt-dependencies: ${{ matrix.apt-dependencies }}
save-cache: ${{ matrix.save-cache }}
if: ${{ matrix.if }}
deploy-docs:
needs: [configure, docs]
if: ${{ contains(fromJson(needs.configure.outputs.deploy), 'docs') }}
uses: ./.github/workflows/deploy-docs.yml