1name: Continuous integration 2 3on: 4 push: 5 pull_request: 6 schedule: 7 # Run every day at midnight UTC 8 - cron: '0 0 * * *' 9 10jobs: 11 boringssl_clone: 12 # This step ensures that all builders have the same version of BoringSSL 13 runs-on: ubuntu-latest 14 15 steps: 16 - name: Clone BoringSSL repo 17 run: | 18 git clone --depth 1 --filter=blob:none --no-checkout https://github.com/google/boringssl.git "${{ runner.temp }}/boringssl" 19 echo Using BoringSSL commit: $(cd "${{ runner.temp }}/boringssl"; git rev-parse HEAD) 20 21 - name: Archive BoringSSL source 22 uses: actions/upload-artifact@v4 23 with: 24 name: boringssl-source 25 path: ${{ runner.temp }}/boringssl 26 retention-days: 1 27 include-hidden-files: true 28 if-no-files-found: error 29 30 clang_format_check: 31 # Only run on pull requests. 32 if: ${{ startsWith(github.ref, 'refs/pull/') }} 33 runs-on: ubuntu-latest 34 35 steps: 36 - name: Checkout repository 37 uses: actions/checkout@v4 38 with: 39 fetch-depth: 0 40 41 - name: Get git-clang-format 42 # Uses the most recent clang-format on Ubuntu. 43 run: | 44 sudo apt-get -qq update 45 sudo apt-get -qq install -y --no-install-recommends clang-format 46 47 - name: Run git-clang-format against source branch 48 run: | 49 git clang-format --style=file --diff origin/$GITHUB_BASE_REF '*.c' '*.h' '*.cc' '*.cpp' '*.java' 50 51 build: 52 needs: boringssl_clone 53 54 strategy: 55 fail-fast: false 56 matrix: 57 platform: [ubuntu-latest, macos-latest, windows-latest] 58 include: 59 - platform: ubuntu-latest 60 tools_url: https://dl.google.com/android/repository/commandlinetools-linux-9477386_latest.zip 61 - platform: macos-latest 62 tools_url: https://dl.google.com/android/repository/commandlinetools-mac-9477386_latest.zip 63 - platform: windows-latest 64 tools_url: https://dl.google.com/android/repository/commandlinetools-win-9477386_latest.zip 65 66 runs-on: ${{ matrix.platform }} 67 68 steps: 69 - name: Set up JDK 11 for toolchains 70 uses: actions/setup-java@v4 71 with: 72 distribution: 'zulu' 73 java-version: 11 74 75 - name: Set runner-specific environment variables 76 shell: bash 77 run: | 78 echo "ANDROID_HOME=${{ runner.temp }}/android-sdk" >> $GITHUB_ENV 79 echo "ANDROID_SDK_ROOT=${{ runner.temp }}/android-sdk" >> $GITHUB_ENV 80 echo "BORINGSSL_HOME=${{ runner.temp }}/boringssl" >> $GITHUB_ENV 81 echo "SDKMANAGER=${{ runner.temp }}/android-sdk/cmdline-tools/bin/sdkmanager" >> $GITHUB_ENV 82 echo "M2_REPO=${{ runner.temp }}/m2" >> $GITHUB_ENV 83 84 - uses: actions/checkout@v4 85 86 - name: Setup Linux environment 87 if: runner.os == 'Linux' 88 run: | 89 echo "CC=clang" >> $GITHUB_ENV 90 echo "CXX=clang++" >> $GITHUB_ENV 91 92 sudo dpkg --add-architecture i386 93 sudo add-apt-repository ppa:openjdk-r/ppa 94 sudo apt-get -qq update 95 sudo apt-get -qq install -y --no-install-recommends \ 96 gcc-multilib \ 97 g++-multilib \ 98 ninja-build \ 99 openjdk-11-jre-headless 100 101 - name: Setup macOS environment 102 if: runner.os == 'macOS' 103 run: | 104 brew update || echo update failed 105 brew install ninja || echo update failed 106 107 - name: Setup Windows environment 108 if: runner.os == 'Windows' 109 run: | 110 choco install nasm -y 111 choco install ninja -y 112 113 - name: Fetch BoringSSL source 114 uses: actions/download-artifact@v4 115 with: 116 name: boringssl-source 117 path: ${{ runner.temp }}/boringssl 118 119 - name: Checkout BoringSSL master branch 120 shell: bash 121 run: | 122 cd "$BORINGSSL_HOME" 123 git checkout --progress --force -B master 124 125 - name: Build BoringSSL x86 and ARM MacOS 126 if: runner.os == 'macOS' 127 env: 128 # For compatibility, but 10.15 target requires 16-byte stack alignment. 129 MACOSX_DEPLOYMENT_TARGET: 10.13 130 run: | 131 mkdir -p "$BORINGSSL_HOME/build.x86" 132 pushd "$BORINGSSL_HOME/build.x86" 133 cmake -DCMAKE_POSITION_INDEPENDENT_CODE=TRUE -DCMAKE_BUILD_TYPE=Release -DCMAKE_OSX_ARCHITECTURES=x86_64 -GNinja .. 134 ninja 135 popd 136 137 mkdir -p "$BORINGSSL_HOME/build.arm" 138 pushd "$BORINGSSL_HOME/build.arm" 139 cmake -DCMAKE_POSITION_INDEPENDENT_CODE=TRUE -DCMAKE_BUILD_TYPE=Release -DCMAKE_OSX_ARCHITECTURES=arm64 -GNinja .. 140 ninja 141 popd 142 143 - name: Build BoringSSL 64-bit Linux 144 if: runner.os == 'Linux' 145 run: | 146 mkdir -p "$BORINGSSL_HOME/build64" 147 pushd "$BORINGSSL_HOME/build64" 148 cmake -DCMAKE_POSITION_INDEPENDENT_CODE=TRUE -DCMAKE_BUILD_TYPE=Release -GNinja .. 149 ninja 150 popd 151 152 - name: Set up MSVC paths on Windows 153 if: runner.os == 'Windows' 154 uses: ilammy/msvc-dev-cmd@v1 155 with: 156 arch: x64 157 158 - name: Build BoringSSL 64-bit Windows 159 if: runner.os == 'Windows' 160 run: | 161 cd $Env:BORINGSSL_HOME 162 mkdir build64 163 pushd build64 164 cmake -DCMAKE_POSITION_INDEPENDENT_CODE=TRUE -DCMAKE_BUILD_TYPE=Release -DCMAKE_MSVC_RUNTIME_LIBRARY=MultiThreaded -GNinja .. 165 ninja 166 popd 167 168 - name: Setup Android environment 169 shell: bash 170 if: runner.os == 'Linux' 171 run: | 172 cd "${{ runner.temp }}" 173 curl -L "${{ matrix.tools_url }}" -o android-tools.zip 174 mkdir -p "$ANDROID_HOME" 175 unzip -q android-tools.zip -d "$ANDROID_HOME" 176 yes | "$SDKMANAGER" --sdk_root="$ANDROID_HOME" --licenses || true 177 "$SDKMANAGER" --sdk_root="$ANDROID_HOME" tools 178 "$SDKMANAGER" --sdk_root="$ANDROID_HOME" platform-tools 179 "$SDKMANAGER" --sdk_root="$ANDROID_HOME" 'build-tools;30.0.3' 180 "$SDKMANAGER" --sdk_root="$ANDROID_HOME" 'platforms;android-26' 181 "$SDKMANAGER" --sdk_root="$ANDROID_HOME" 'extras;android;m2repository' 182 "$SDKMANAGER" --sdk_root="$ANDROID_HOME" 'ndk;25.2.9519653' 183 "$SDKMANAGER" --sdk_root="$ANDROID_HOME" 'cmake;3.22.1' 184 185 - name: Build with Gradle 186 shell: bash 187 run: ./gradlew assemble -PcheckErrorQueue 188 189 - name: Test with Gradle 190 shell: bash 191 timeout-minutes: 15 192 run: ./gradlew check -PcheckErrorQueue 193 194 - name: Publish to local Maven repo 195 shell: bash 196 run: ./gradlew publishToMavenLocal -Dmaven.repo.local="$M2_REPO" 197 198 - name: Upload Maven respository 199 uses: actions/upload-artifact@v4 200 with: 201 name: m2repo-${{ runner.os }} 202 path: ${{ runner.temp }}/m2 203 204 - name: Build test JAR with dependencies 205 if: runner.os == 'Linux' 206 shell: bash 207 run: ./gradlew :conscrypt-openjdk:testJar -PcheckErrorQueue 208 209 - name: Upload test JAR with dependencies 210 if: runner.os == 'Linux' 211 uses: actions/upload-artifact@v4 212 with: 213 name: testjar 214 path: openjdk/build/libs/conscrypt-openjdk-*-tests.jar 215 if-no-files-found: error 216 217 uberjar: 218 needs: build 219 220 runs-on: ubuntu-latest 221 222 steps: 223 - uses: actions/checkout@v4 224 225 - name: Setup Linux environment 226 run: | 227 echo "CC=clang" >> $GITHUB_ENV 228 echo "CXX=clang++" >> $GITHUB_ENV 229 230 sudo dpkg --add-architecture i386 231 sudo add-apt-repository ppa:openjdk-r/ppa 232 sudo apt-get -qq update 233 sudo apt-get -qq install -y --no-install-recommends \ 234 gcc-multilib \ 235 g++-multilib \ 236 ninja-build \ 237 openjdk-11-jre-headless 238 239 - name: Set runner-specific environment variables 240 shell: bash 241 run: | 242 echo "M2_REPO=${{ runner.temp }}/m2" >> $GITHUB_ENV 243 echo "BORINGSSL_HOME=${{ runner.temp }}/boringssl" >> $GITHUB_ENV 244 245 - name: Fetch BoringSSL source 246 uses: actions/download-artifact@v4 247 with: 248 name: boringssl-source 249 path: ${{ runner.temp }}/boringssl 250 251 - name: Checkout BoringSSL master branch 252 shell: bash 253 run: | 254 cd "$BORINGSSL_HOME" 255 git checkout --progress --force -B master 256 257 - name: Build BoringSSL 64-bit Linux 258 run: | 259 mkdir -p "$BORINGSSL_HOME/build64" 260 pushd "$BORINGSSL_HOME/build64" 261 cmake -DCMAKE_POSITION_INDEPENDENT_CODE=TRUE -DCMAKE_BUILD_TYPE=Release -GNinja .. 262 ninja 263 popd 264 265 # TODO(prb) remove build dependency above and go back to this. 266 # - name: Make fake BoringSSL directories 267 # shell: bash 268 # run: | 269 # # TODO: remove this when the check is only performed when building. 270 # # BoringSSL is not needed during the UberJAR build, but the 271 # # assertion to check happens regardless of whether the project 272 # # needs it. 273 # mkdir -p "${{ runner.temp }}/boringssl/build64" 274 # mkdir -p "${{ runner.temp }}/boringssl/include" 275 276 - name: Download Maven repository for Linux 277 uses: actions/download-artifact@v4 278 with: 279 name: m2repo-Linux 280 path: ${{ runner.temp }}/m2 281 282 - name: Download Maven repository for MacOS 283 uses: actions/download-artifact@v4 284 with: 285 name: m2repo-macOS 286 path: ${{ runner.temp }}/m2 287 288 - name: Download Maven repository for Windows 289 uses: actions/download-artifact@v4 290 with: 291 name: m2repo-Windows 292 path: ${{ runner.temp }}/m2 293 294 - name: Build UberJAR with Gradle 295 shell: bash 296 run: | 297 ./gradlew :conscrypt-openjdk-uber:build -Dorg.conscrypt.openjdk.buildUberJar=true -Dmaven.repo.local="$M2_REPO" 298 299 - name: Publish UberJAR to Maven Local 300 shell: bash 301 run: | 302 ./gradlew :conscrypt-openjdk-uber:publishToMavenLocal -Dorg.conscrypt.openjdk.buildUberJar=true -Dmaven.repo.local="$M2_REPO" 303 304 - name: Upload Maven respository 305 uses: actions/upload-artifact@v4 306 with: 307 name: m2repo-uber 308 path: ${{ runner.temp }}/m2 309 310 openjdk-test: 311 needs: uberjar 312 313 strategy: 314 fail-fast: false 315 matrix: 316 platform: [ubuntu-latest, macos-13, macos-latest, windows-latest] 317 java: [8, 11, 17, 21] 318 dist: ['temurin', 'zulu'] 319 include: 320 - platform: ubuntu-latest 321 separator: ':' 322 - platform: macos-latest 323 separator: ':' 324 - platform: macos-13 325 separator: ':' 326 - platform: windows-latest 327 separator: ';' 328 exclude: # Not available on Github runners 329 - platform: macos-latest 330 java: 8 331 dist: 'temurin' 332 333 334 runs-on: ${{ matrix.platform }} 335 336 steps: 337 - name: Set up Java 338 uses: actions/setup-java@v4 339 with: 340 distribution: ${{ matrix.dist }} 341 java-version: ${{ matrix.java }} 342 343 - name: Download UberJAR 344 uses: actions/download-artifact@v4 345 with: 346 name: m2repo-uber 347 path: m2 348 349 - name: Download Test JAR with Dependencies 350 uses: actions/download-artifact@v4 351 with: 352 name: testjar 353 path: testjar 354 355 - name: Download JUnit runner 356 shell: bash 357 run: mvn org.apache.maven.plugins:maven-dependency-plugin:3.8.0:copy -Dartifact=org.junit.platform:junit-platform-console-standalone:1.11.2 -DoutputDirectory=. -Dmdep.stripVersion=true 358 359 - name: Run JUnit tests 360 timeout-minutes: 15 361 shell: bash 362 run: | 363 DIR="$(find m2/org/conscrypt/conscrypt-openjdk-uber -maxdepth 1 -mindepth 1 -type d -print)" 364 VERSION="${DIR##*/}" 365 TESTJAR="$(find testjar -name '*-tests.jar')" 366 # SIGTERM handler, e.g. for when tests hang and time out. 367 # Send SIGQUIT to test process to get thread dump, give it 368 # a few seconds to complete and then kill it. 369 dump_threads() { 370 echo "Generating stack dump." 371 ps -fp "$TESTPID" 372 kill -QUIT "$TESTPID" 373 sleep 3 374 kill -KILL "$TESTPID" 375 exit 1 376 } 377 java -jar junit-platform-console-standalone.jar execute -cp "$DIR/conscrypt-openjdk-uber-$VERSION.jar${{ matrix.separator }}$TESTJAR" -n='org.conscrypt.ConscryptOpenJdkSuite' --scan-classpath --reports-dir=results --fail-if-no-tests & 378 case $(uname -s) in 379 Darwin|Linux) 380 trap dump_threads SIGTERM SIGINT 381 ;; 382 *) 383 # TODO: Probably won't work on Windows but thread dumps 384 # work there already. 385 ;; 386 esac 387 TESTPID=$! 388 wait "$TESTPID" 389 390 - name: Archive test results 391 if: ${{ always() }} 392 uses: actions/upload-artifact@v4 393 with: 394 name: test-results-${{ matrix.platform }}-${{ matrix.java }}-${{ matrix.dist }} 395 path: results 396