wolfHSM/.github/workflows/build-and-test-refactor.yml at f4dc122b3041ae749e848e4e98bb909ab37e2321 · wolfSSL/wolfHSM · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
name: Build and Test Refactor

on:
  push:
    branches: [ 'master', 'main', 'release/**' ]
  pull_request:
    branches: [ '*' ]

permissions:
  contents: read

jobs:
  build:

    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]

    runs-on: ${{ matrix.os }}

    steps:
    - uses: actions/checkout@v4

    # List host info
    - name: Host info
      run: uname -a

    # List compiler version
    - name: List compiler version
      run: gcc --version

    # pull and build wolfssl
    - name: Checkout wolfssl
      uses: actions/checkout@v4
      with:
        repository: wolfssl/wolfssl
        path: wolfssl

    # Build and test standard build
    - name: Build and test refactor
      run: cd test-refactor/posix && make clean && make -j WOLFSSL_DIR=../../wolfssl && make run

    # Build and test standard build, with DMA and ASAN enabled
    - name: Build and test refactor DMA ASAN
      run: cd test-refactor/posix && make clean && make -j DMA=1 ASAN=1 WOLFSSL_DIR=../../wolfssl && make run

    # Build and test with LMS and XMSS both in verify-only mode
    - name: Build and test refactor DMA ASAN LMS/XMSS verify-only
      run: cd test-refactor/posix && make clean && make -j DMA=1 ASAN=1 LMS_VERIFY_ONLY=1 XMSS_VERIFY_ONLY=1 WOLFSSL_DIR=../../wolfssl && make run

    # Build and test mixed: LMS verify-only, XMSS full (exercises shared gating)
    - name: Build and test refactor DMA ASAN LMS verify-only XMSS full
      run: cd test-refactor/posix && make clean && make -j DMA=1 ASAN=1 LMS_VERIFY_ONLY=1 WOLFSSL_DIR=../../wolfssl && make run

    # Build and test with ML-DSA in verify-only mode
    - name: Build and test refactor DMA ASAN MLDSA verify-only
      run: cd test-refactor/posix && make clean && make -j DMA=1 ASAN=1 MLDSA_VERIFY_ONLY=1 WOLFSSL_DIR=../../wolfssl && make run

    # Build and test ASAN build, with wolfCrypt tests enabled.
    - name: Build and test refactor ASAN TESTWOLFCRYPT
      run: cd test-refactor/posix && make clean && make -j ASAN=1 TESTWOLFCRYPT=1 WOLFSSL_DIR=../../wolfssl && make run

    # Build and test ASAN build, with wolfCrypt tests enabled and using the DMA devId.
    - name: Build and test refactor ASAN TESTWOLFCRYPT TESTWOLFCRYPT_DMA
      run: cd test-refactor/posix && make clean && make -j ASAN=1 TESTWOLFCRYPT=1 TESTWOLFCRYPT_DMA=1 DMA=1 WOLFSSL_DIR=../../wolfssl && make run

    # Build and test debug build with ASAN and NOCRYPTO
    - name: Build and test refactor ASAN DEBUG NOCRYPTO
      run: cd test-refactor/posix && make clean && make -j DEBUG=1 ASAN=1 NOCRYPTO=1 WOLFSSL_DIR=../../wolfssl && make run

    # Build and test debug build with ASAN and DMA
    - name: Build and test refactor ASAN DEBUG DMA
      run: cd test-refactor/posix && make clean && make -j DEBUG=1 ASAN=1 DMA=1 WOLFSSL_DIR=../../wolfssl && make run

    # Build and test with SHE and ASAN
    - name: Build and test refactor ASAN SHE
      run: cd test-refactor/posix && make clean && make -j SHE=1 ASAN=1 WOLFSSL_DIR=../../wolfssl && make run

    # Build and test with per-client crypto affinity enabled (runs the crypto
    # affinity unit test, gated behind WOLFHSM_CFG_CRYPTO_AFFINITY)
    - name: Build and test refactor CRYPTO_AFFINITY ASAN
      run: cd test-refactor/posix && make clean && make -j CRYPTO_AFFINITY=1 ASAN=1 WOLFSSL_DIR=../../wolfssl && make run

    # Build and test crypto affinity alongside DMA (exercises HW-devId path)
    - name: Build and test refactor CRYPTO_AFFINITY DMA ASAN
      run: cd test-refactor/posix && make clean && make -j CRYPTO_AFFINITY=1 DMA=1 ASAN=1 WOLFSSL_DIR=../../wolfssl && make run

    # Build and test with global SHE keys (all SHE slots shared across clients)
    - name: Build and test refactor ASAN SHE_GLOBAL
      run: cd test-refactor/posix && make clean && make -j SHE_GLOBAL=1 ASAN=1 WOLFSSL_DIR=../../wolfssl && make run

    # Build and test with DEBUG=1
    - name: Build and test refactor with DEBUG
      run: cd test-refactor/posix && make clean && make -j DEBUG=1 WOLFSSL_DIR=../../wolfssl && make run

    # Build and test with DEBUG_VERBOSE=1 (includes DEBUG)
    - name: Build and test refactor with DEBUG_VERBOSE
      run: cd test-refactor/posix && make clean && make -j DEBUG_VERBOSE=1 WOLFSSL_DIR=../../wolfssl && make run

    # Build and test in multithreaded mode with everything enabled
    - name: Build and test refactor with THREADSAFE and everything
      run: cd test-refactor/posix && make clean && make -j THREADSAFE=1 DMA=1 SHE=1 ASAN=1 WOLFSSL_DIR=../../wolfssl && make run

    # Same, with global SHE keys
    - name: Build and test refactor with THREADSAFE and everything and SHE_GLOBAL
      run: cd test-refactor/posix && make clean && make -j THREADSAFE=1 DMA=1 SHE_GLOBAL=1 ASAN=1 WOLFSSL_DIR=../../wolfssl && make run

    # Build and test in multithreaded mode with everything enabled and wolfCrypt tests
    - name: Build and test refactor with THREADSAFE and TESTWOLFCRYPT and everything
      run: cd test-refactor/posix && make clean && make -j THREADSAFE=1 TESTWOLFCRYPT=1 DMA=1 SHE=1 ASAN=1 WOLFSSL_DIR=../../wolfssl && make run

    # Build and test in multithreaded mode with everything enabled and wolfCrypt tests with dma
    - name: Build and test refactor with THREADSAFE and TESTWOLFCRYPT with DMA
      run: cd test-refactor/posix && make clean && make -j THREADSAFE=1 TESTWOLFCRYPT=1 TESTWOLFCRYPT_DMA=1 DMA=1 SHE=1 ASAN=1 WOLFSSL_DIR=../../wolfssl && make run

    # Build and test with AUTH=1
    - name: Build and test refactor with AUTH
      run: cd test-refactor/posix && make clean && make -j AUTH=1 WOLFSSL_DIR=../../wolfssl && make run

    # Build and test with AUTH=1 and ASAN
    - name: Build and test refactor with AUTH ASAN
      run: cd test-refactor/posix && make clean && make -j AUTH=1 ASAN=1 WOLFSSL_DIR=../../wolfssl && make run

    # Build and test with AUTH=1 and THREADSAFE
    - name: Build and test refactor with AUTH THREADSAFE ASAN
      run: cd test-refactor/posix && make clean && make -j AUTH=1 THREADSAFE=1 ASAN=1 WOLFSSL_DIR=../../wolfssl && make run

    # Build and test with AUTH=1 and NOCRYPTO=1 (auth on, crypto off)
    - name: Build and test refactor with AUTH NOCRYPTO
      run: cd test-refactor/posix && make clean && make -j AUTH=1 NOCRYPTO=1 WOLFSSL_DIR=../../wolfssl && make run

    # Build and test the suites that leave undeletable NVM objects behind.
    # Kept last: they occupy NVM slots for the remainder of the run.
    - name: Build and test refactor with persistent NVM artifacts
      run: cd test-refactor/posix && make clean && make -j ASAN=1 WOLFSSL_DIR=../../wolfssl CFLAGS_EXTRA=-DWOLFHSM_CFG_TEST_ALLOW_PERSISTENT_NVM_ARTIFACTS && make run