|
| 1 | +name: Update BoringSSL |
| 2 | + |
| 3 | +on: |
| 4 | + schedule: |
| 5 | + - cron: '0 9 * * 1' |
| 6 | + |
| 7 | + workflow_dispatch: |
| 8 | + inputs: |
| 9 | + boringssl_revision: |
| 10 | + description: 'Specific BoringSSL revision (SHA) to update to (leave empty for latest)' |
| 11 | + required: false |
| 12 | + type: string |
| 13 | + |
| 14 | +jobs: |
| 15 | + update-boringssl: |
| 16 | + runs-on: ubuntu-latest |
| 17 | + permissions: |
| 18 | + contents: write |
| 19 | + pull-requests: write |
| 20 | + |
| 21 | + steps: |
| 22 | + - name: Checkout repository |
| 23 | + uses: actions/checkout@v4 |
| 24 | + with: |
| 25 | + token: ${{ secrets.GITHUB_TOKEN }} |
| 26 | + fetch-depth: 0 |
| 27 | + |
| 28 | + - name: Set up Python |
| 29 | + uses: actions/setup-python@v4 |
| 30 | + with: |
| 31 | + python-version: '3.11' |
| 32 | + |
| 33 | + - name: Set up Dart |
| 34 | + uses: dart-lang/setup-dart@v1 |
| 35 | + with: |
| 36 | + sdk: stable |
| 37 | + |
| 38 | + - name: Set up Git |
| 39 | + run: | |
| 40 | + git config --global user.name 'github-actions[bot]' |
| 41 | + git config --global user.email 'github-actions[bot]@users.noreply.github.com' |
| 42 | +
|
| 43 | + - name: Clone BoringSSL to get latest revision |
| 44 | + id: get-revision |
| 45 | + run: | |
| 46 | + # Clone BoringSSL to a temporary directory to get the latest revision |
| 47 | + TEMP_DIR=$(mktemp -d) |
| 48 | + git clone https://boringssl.googlesource.com/boringssl "$TEMP_DIR/boringssl" |
| 49 | + cd "$TEMP_DIR/boringssl" |
| 50 | + |
| 51 | + if [ -n "${{ github.event.inputs.boringssl_revision }}" ]; then |
| 52 | + LATEST_REVISION="${{ github.event.inputs.boringssl_revision }}" |
| 53 | + echo "Using manually specified revision: $LATEST_REVISION" |
| 54 | + else |
| 55 | + LATEST_REVISION=$(git rev-parse HEAD) |
| 56 | + echo "Latest BoringSSL revision: $LATEST_REVISION" |
| 57 | + fi |
| 58 | + |
| 59 | + # Get current revision from the Python script |
| 60 | + CURRENT_REVISION=$(grep "BORINGSSL_REVISION = " tool/update-boringssl.py | cut -d"'" -f2) |
| 61 | + echo "Current revision in script: $CURRENT_REVISION" |
| 62 | + |
| 63 | + echo "latest_revision=$LATEST_REVISION" >> $GITHUB_OUTPUT |
| 64 | + echo "current_revision=$CURRENT_REVISION" >> $GITHUB_OUTPUT |
| 65 | + |
| 66 | + # Check if update is needed |
| 67 | + if [ "$LATEST_REVISION" = "$CURRENT_REVISION" ]; then |
| 68 | + echo "needs_update=false" >> $GITHUB_OUTPUT |
| 69 | + echo "No update needed - already at latest revision" |
| 70 | + else |
| 71 | + echo "needs_update=true" >> $GITHUB_OUTPUT |
| 72 | + echo "Update needed: $CURRENT_REVISION -> $LATEST_REVISION" |
| 73 | + fi |
| 74 | + |
| 75 | + # Cleanup |
| 76 | + rm -rf "$TEMP_DIR" |
| 77 | +
|
| 78 | + - name: Update BoringSSL revision in script |
| 79 | + if: steps.get-revision.outputs.needs_update == 'true' |
| 80 | + run: | |
| 81 | + # Update the BORINGSSL_REVISION in the Python script |
| 82 | + sed -i "s/BORINGSSL_REVISION = '[^']*'/BORINGSSL_REVISION = '${{ steps.get-revision.outputs.latest_revision }}'/" tool/update-boringssl.py |
| 83 | + |
| 84 | + # Verify the change |
| 85 | + echo "Updated revision in script:" |
| 86 | + grep "BORINGSSL_REVISION = " tool/update-boringssl.py |
| 87 | +
|
| 88 | + - name: Run BoringSSL update script |
| 89 | + if: steps.get-revision.outputs.needs_update == 'true' |
| 90 | + run: | |
| 91 | + # Step 1: Clean up build artifacts |
| 92 | + echo "🧹 Cleaning up build artifacts..." |
| 93 | + bash ./tool/clean.sh |
| 94 | + |
| 95 | + # Step 2: Update BoringSSL sources |
| 96 | + echo "📦 Updating BoringSSL sources..." |
| 97 | + python3 tool/update-boringssl.py |
| 98 | + |
| 99 | + # Step 3: Get Dart dependencies |
| 100 | + echo "📥 Getting Dart dependencies..." |
| 101 | + dart pub get |
| 102 | + |
| 103 | + # Step 4: Generate symbols table |
| 104 | + echo "🔢 Generating symbols table..." |
| 105 | + dart run ./tool/generate_symbols_table.dart |
| 106 | + |
| 107 | + # Step 5: Update FFI bindings |
| 108 | + echo "🔗 Updating FFI bindings..." |
| 109 | + bash ./tool/update-bindings.sh |
| 110 | +
|
| 111 | + - name: Get BoringSSL commit info |
| 112 | + if: steps.get-revision.outputs.needs_update == 'true' |
| 113 | + id: boringssl-info |
| 114 | + run: | |
| 115 | + # Clone BoringSSL again to get commit information |
| 116 | + TEMP_DIR=$(mktemp -d) |
| 117 | + git clone https://boringssl.googlesource.com/boringssl "$TEMP_DIR/boringssl" |
| 118 | + cd "$TEMP_DIR/boringssl" |
| 119 | + git checkout ${{ steps.get-revision.outputs.latest_revision }} |
| 120 | + |
| 121 | + COMMIT_DATE=$(git show -s --format=%ci ${{ steps.get-revision.outputs.latest_revision }}) |
| 122 | + COMMIT_SUBJECT=$(git show -s --format=%s ${{ steps.get-revision.outputs.latest_revision }}) |
| 123 | + COMMIT_AUTHOR=$(git show -s --format=%an ${{ steps.get-revision.outputs.latest_revision }}) |
| 124 | + SHORT_SHA=$(echo "${{ steps.get-revision.outputs.latest_revision }}" | cut -c1-8) |
| 125 | + |
| 126 | + echo "commit_date=$COMMIT_DATE" >> $GITHUB_OUTPUT |
| 127 | + echo "commit_subject=$COMMIT_SUBJECT" >> $GITHUB_OUTPUT |
| 128 | + echo "commit_author=$COMMIT_AUTHOR" >> $GITHUB_OUTPUT |
| 129 | + echo "short_sha=$SHORT_SHA" >> $GITHUB_OUTPUT |
| 130 | + |
| 131 | + # Cleanup |
| 132 | + rm -rf "$TEMP_DIR" |
| 133 | +
|
| 134 | + - name: Run tests |
| 135 | + if: steps.get-revision.outputs.needs_update == 'true' |
| 136 | + run: | |
| 137 | + echo "🧪 Running tests to verify update..." |
| 138 | + bash ./tool/test.sh |
| 139 | +
|
| 140 | + - name: Check for changes |
| 141 | + if: steps.get-revision.outputs.needs_update == 'true' |
| 142 | + id: changes |
| 143 | + run: | |
| 144 | + if git diff --quiet; then |
| 145 | + echo "has_changes=false" >> $GITHUB_OUTPUT |
| 146 | + echo "No changes detected after running update script" |
| 147 | + else |
| 148 | + echo "has_changes=true" >> $GITHUB_OUTPUT |
| 149 | + echo "Changes detected:" |
| 150 | + git diff --name-status |
| 151 | + fi |
| 152 | +
|
| 153 | + - name: Create Pull Request |
| 154 | + if: steps.get-revision.outputs.needs_update == 'true' && steps.changes.outputs.has_changes == 'true' |
| 155 | + uses: peter-evans/create-pull-request@v5 |
| 156 | + with: |
| 157 | + token: ${{ secrets.GITHUB_TOKEN }} |
| 158 | + commit-message: | |
| 159 | + Update BoringSSL to ${{ steps.boringssl-info.outputs.short_sha }} |
| 160 | + |
| 161 | + - Updated from ${{ steps.get-revision.outputs.current_revision }} to ${{ steps.get-revision.outputs.latest_revision }} |
| 162 | + - Latest commit: ${{ steps.boringssl-info.outputs.commit_subject }} |
| 163 | + - Author: ${{ steps.boringssl-info.outputs.commit_author }} |
| 164 | + - Date: ${{ steps.boringssl-info.outputs.commit_date }} |
| 165 | + title: 'chore: Update BoringSSL to ${{ steps.boringssl-info.outputs.short_sha }}' |
| 166 | + body: | |
| 167 | + ## 🔄 Automated BoringSSL Update |
| 168 | + |
| 169 | + This PR updates BoringSSL to the latest revision. |
| 170 | + |
| 171 | + ### Changes |
| 172 | + - **From**: `${{ steps.get-revision.outputs.current_revision }}` |
| 173 | + - **To**: `${{ steps.get-revision.outputs.latest_revision }}` |
| 174 | + |
| 175 | + ### Latest Commit Details |
| 176 | + - **Subject**: ${{ steps.boringssl-info.outputs.commit_subject }} |
| 177 | + - **Author**: ${{ steps.boringssl-info.outputs.commit_author }} |
| 178 | + - **Date**: ${{ steps.boringssl-info.outputs.commit_date }} |
| 179 | + - **SHA**: [${{ steps.boringssl-info.outputs.short_sha }}](https://boringssl.googlesource.com/boringssl/+/${{ steps.get-revision.outputs.latest_revision }}) |
| 180 | + |
| 181 | + ### What's Updated |
| 182 | + - Updated `tool/update-boringssl.py` with new revision |
| 183 | + - Refreshed BoringSSL source files and headers |
| 184 | + - Updated CMake configuration files |
| 185 | + - Regenerated symbols table and FFI bindings |
| 186 | + - **Tests passed** ✅ (verified during update process) |
| 187 | + |
| 188 | + ### Testing Status |
| 189 | + - [x] Build tests pass |
| 190 | + - [x] Unit tests pass |
| 191 | + - [x] Integration tests pass |
| 192 | + - [ ] Manual verification on target platforms |
| 193 | + |
| 194 | + --- |
| 195 | + |
| 196 | + 🤖 This PR was created automatically by the Update BoringSSL workflow. |
| 197 | + |
| 198 | + **Review Guidelines:** |
| 199 | + 1. Check that the build and tests pass |
| 200 | + 2. Review any breaking changes in the BoringSSL changelog |
| 201 | + 3. Test critical cryptographic operations |
| 202 | + 4. Verify Windows compatibility (especially ECDH PKCS8 operations) |
| 203 | + |
| 204 | + branch: update-boringssl-${{ steps.boringssl-info.outputs.short_sha }} |
| 205 | + branch-suffix: timestamp |
| 206 | + delete-branch: true |
| 207 | + labels: | |
| 208 | + dependencies |
| 209 | + automated-pr |
| 210 | + boringssl-update |
| 211 | +
|
| 212 | + - name: Summary |
| 213 | + run: | |
| 214 | + if [ "${{ steps.get-revision.outputs.needs_update }}" = "false" ]; then |
| 215 | + echo "✅ No update needed - already at latest BoringSSL revision" |
| 216 | + elif [ "${{ steps.changes.outputs.has_changes }}" = "false" ]; then |
| 217 | + echo "ℹ️ Update script ran but no changes were detected" |
| 218 | + else |
| 219 | + echo "🚀 Successfully created PR to update BoringSSL" |
| 220 | + echo " From: ${{ steps.get-revision.outputs.current_revision }}" |
| 221 | + echo " To: ${{ steps.get-revision.outputs.latest_revision }}" |
| 222 | + fi |
0 commit comments