Skip to content
Continuous integration

Continuous integration #4541

Sign in to view logs

Continuous integration

Continuous integration #4541

Workflow file for this run

.github/workflows/ci.yml at 657e1c6
name: Continuous integration
on:
push:
pull_request:
schedule:
# Run every day at midnight UTC
- cron: '0 0 * * *'
permissions:
contents: read
jobs:
boringssl_clone:
# This step ensures that all builders have the same version of BoringSSL
runs-on: ubuntu-22.04
steps:
- name: Clone BoringSSL repo
run: |
git clone --depth 1 --filter=blob:none --no-checkout https://github.com/google/boringssl.git "${{ runner.temp }}/boringssl"
echo Using BoringSSL commit: $(cd "${{ runner.temp }}/boringssl"; git rev-parse HEAD)
- name: Archive BoringSSL source
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
with:
name: boringssl-source
path: ${{ runner.temp }}/boringssl
retention-days: 1
include-hidden-files: true
if-no-files-found: error
clang_format_check:
# Only run on pull requests.
if: ${{ startsWith(github.ref, 'refs/pull/') }}
runs-on: ubuntu-22.04
steps:
- name: Checkout repository
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
fetch-depth: 0
persist-credentials: false
- name: Get git-clang-format
# Uses the most recent clang-format on Ubuntu.
run: |
sudo apt-get -qq update
sudo apt-get -qq install -y --no-install-recommends clang-format
- name: Run git-clang-format against source branch
run: |
git clang-format --style=file --diff origin/$GITHUB_BASE_REF '*.c' '*.h' '*.cc' '*.cpp' '*.java'
build:
needs: boringssl_clone
strategy:
fail-fast: false
matrix:
platform: [ubuntu-22.04, macos-latest, windows-latest]
# We use commandlinetools v20.
include:
- platform: ubuntu-22.04
tools_url: https://dl.google.com/android/repository/commandlinetools-linux-14742923_latest.zip
# Build the native libraries in an Ubuntu 20.04 container, which
# has glibc 2.31, so that the glibc 2.35 on the Ubuntu 22.04 runner
# doesn't become the floor for the libraries that are shipped. When built with Ubuntu
# 20.04, the libraries end up requiring glibc 2.14 (x86_64) and glibc 2.17 (aarch64).
container: ubuntu:20.04
- platform: macos-latest
tools_url: https://dl.google.com/android/repository/commandlinetools-mac-14742923_latest.zip
- platform: windows-latest
tools_url: https://dl.google.com/android/repository/commandlinetools-win-14742923_latest.zip
runs-on: ${{ matrix.platform }}
container: ${{ matrix.container }}
steps:
- name: Bootstrap build container
# The image is bare, so install what the later steps expect. Its CMake
# 3.16 and Clang 10 are both too old to build BoringSSL, so take CMake
# from Kitware and Clang from apt.llvm.org. Neither affects the glibc
# floor, which is set by the container's glibc.
if: matrix.container == 'ubuntu:20.04'
timeout-minutes: 15
run: |
set -eu
export DEBIAN_FRONTEND=noninteractive
apt-get -qq update
apt-get -qq install -y --no-install-recommends \
build-essential \
ca-certificates \
curl \
g++-aarch64-linux-gnu \
git \
ninja-build \
openjdk-11-jdk-headless \
unzip
cmake_dir="cmake-$CMAKE_VERSION-linux-x86_64"
curl -sSL "https://github.com/Kitware/CMake/releases/download/v$CMAKE_VERSION/$cmake_dir.tar.gz" \
| tar xz -C /opt
ln -sf "/opt/$cmake_dir/bin/cmake" /usr/local/bin/cmake
curl -sSL https://apt.llvm.org/llvm-snapshot.gpg.key \
-o /etc/apt/trusted.gpg.d/llvm.asc
echo "deb http://apt.llvm.org/focal/ llvm-toolchain-focal-$LLVM_VERSION main" \
> /etc/apt/sources.list.d/llvm.list
apt-get -qq update
apt-get -qq install -y --no-install-recommends "clang-$LLVM_VERSION"
ln -sf "/usr/bin/clang-$LLVM_VERSION" /usr/local/bin/clang
ln -sf "/usr/bin/clang++-$LLVM_VERSION" /usr/local/bin/clang++
env:
CMAKE_VERSION: 3.31.6
LLVM_VERSION: 19
- name: Set up JDK 17 for toolchains
uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
with:
distribution: 'temurin'
java-version: 17
- name: Set runner-specific environment variables
shell: bash
run: |
echo "ANDROID_HOME=${{ runner.temp }}/android-sdk" >> $GITHUB_ENV
echo "ANDROID_SDK_ROOT=${{ runner.temp }}/android-sdk" >> $GITHUB_ENV
echo "BORINGSSL_HOME=${{ runner.temp }}/boringssl" >> $GITHUB_ENV
echo "SDKMANAGER=${{ runner.temp }}/android-sdk/cmdline-tools/bin/sdkmanager" >> $GITHUB_ENV
echo "M2_REPO=${{ runner.temp }}/m2" >> $GITHUB_ENV
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
persist-credentials: false
- name: Setup Linux environment
if: runner.os == 'Linux'
run: |
echo "CC=clang" >> $GITHUB_ENV
echo "CXX=clang++" >> $GITHUB_ENV
# The Ubuntu 20.04 container already installed these in its bootstrap
# step above. Anything else building on Linux still needs them.
if [ "${{ matrix.container }}" != "ubuntu:20.04" ]; then
sudo add-apt-repository ppa:openjdk-r/ppa
sudo apt-get -qq update
sudo apt-get -qq install -y --no-install-recommends \
g++-aarch64-linux-gnu \
ninja-build \
openjdk-17-jre-headless
fi
- name: Setup macOS environment
if: runner.os == 'macOS'
run: |
brew update || echo update failed
brew install ninja || echo update failed
- name: Setup Windows environment
if: runner.os == 'Windows'
run: |
choco install nasm -y
choco install ninja -y
- name: Fetch BoringSSL source
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with:
name: boringssl-source
path: ${{ runner.temp }}/boringssl
- name: Checkout BoringSSL main branch
shell: bash
run: |
cd "$BORINGSSL_HOME"
git checkout --progress --force -B main
- name: Build BoringSSL x86 and ARM MacOS
if: runner.os == 'macOS'
env:
# For compatibility, but 10.15 target requires 16-byte stack alignment.
MACOSX_DEPLOYMENT_TARGET: 10.13
run: |
mkdir -p "$BORINGSSL_HOME/build.x86"
pushd "$BORINGSSL_HOME/build.x86"
cmake -DCMAKE_POSITION_INDEPENDENT_CODE=TRUE -DCMAKE_BUILD_TYPE=Release -DCMAKE_OSX_ARCHITECTURES=x86_64 -GNinja ..
ninja crypto ssl
popd
mkdir -p "$BORINGSSL_HOME/build.arm"
pushd "$BORINGSSL_HOME/build.arm"
cmake -DCMAKE_POSITION_INDEPENDENT_CODE=TRUE -DCMAKE_BUILD_TYPE=Release -DCMAKE_OSX_ARCHITECTURES=arm64 -GNinja ..
ninja crypto ssl
popd
- name: Build BoringSSL 64-bit Linux
# Please keep this in sync with other "Build BoringSSL 64-bit Linux"
if: runner.os == 'Linux'
shell: bash # Required for pushd/popd
run: |
mkdir -p "$BORINGSSL_HOME/build64"
pushd "$BORINGSSL_HOME/build64"
cmake -DCMAKE_POSITION_INDEPENDENT_CODE=TRUE -DCMAKE_BUILD_TYPE=Release -GNinja ..
ninja crypto ssl
popd
- name: Build BoringSSL AArch64 Linux
# Please keep this in sync with other "Build BoringSSL AArch64 Linux"
if: runner.os == 'Linux'
shell: bash # Required for pushd/popd
run: |
mkdir -p "$BORINGSSL_HOME/build.arm"
pushd "$BORINGSSL_HOME/build.arm"
cmake -DCMAKE_SYSTEM_NAME=Linux \
-DCMAKE_SYSTEM_PROCESSOR=aarch64 \
-DCMAKE_C_COMPILER=aarch64-linux-gnu-gcc \
-DCMAKE_CXX_COMPILER=aarch64-linux-gnu-g++ \
-DCMAKE_POSITION_INDEPENDENT_CODE=TRUE \
-DCMAKE_BUILD_TYPE=Release \
-GNinja ..
ninja crypto ssl
popd
- name: Set up MSVC paths on Windows
if: runner.os == 'Windows'
uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
with:
arch: x64
- name: Build BoringSSL 64-bit Windows
if: runner.os == 'Windows'
run: |
cd $Env:BORINGSSL_HOME
mkdir build64
pushd build64
cmake -DCMAKE_POSITION_INDEPENDENT_CODE=TRUE -DCMAKE_BUILD_TYPE=Release -DCMAKE_MSVC_RUNTIME_LIBRARY=MultiThreaded -GNinja ..
ninja crypto ssl
popd
- name: Setup Android environment
shell: bash
if: runner.os == 'Linux'
run: |
# $RUNNER_TEMP, not ${{ runner.temp }}: the runner rewrites host paths
# to container paths in the environment it injects, but not in the
# script text it expands beforehand.
cd "$RUNNER_TEMP"
curl -L "${{ matrix.tools_url }}" -o android-tools.zip
mkdir -p "$ANDROID_HOME"
unzip -q android-tools.zip -d "$ANDROID_HOME"
yes | "$SDKMANAGER" --sdk_root="$ANDROID_HOME" --licenses || true
"$SDKMANAGER" --sdk_root="$ANDROID_HOME" tools
"$SDKMANAGER" --sdk_root="$ANDROID_HOME" platform-tools
"$SDKMANAGER" --sdk_root="$ANDROID_HOME" 'build-tools;30.0.3'
"$SDKMANAGER" --sdk_root="$ANDROID_HOME" 'platforms;android-26'
"$SDKMANAGER" --sdk_root="$ANDROID_HOME" 'extras;android;m2repository'
"$SDKMANAGER" --sdk_root="$ANDROID_HOME" 'ndk;27.3.13750724'
"$SDKMANAGER" --sdk_root="$ANDROID_HOME" 'cmake;3.22.1'
- name: Build with Gradle
shell: bash
run: ./gradlew assemble -PcheckErrorQueue
- name: Test with Gradle
shell: bash
timeout-minutes: 30
run: ./gradlew check -PcheckErrorQueue
- name: Publish to local Maven repo
shell: bash
run: ./gradlew publishToMavenLocal -Dmaven.repo.local="$M2_REPO"
- name: Upload Maven respository
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
with:
name: m2repo-${{ runner.os }}
path: ${{ runner.temp }}/m2
- name: Build test JAR with dependencies
if: runner.os == 'Linux'
shell: bash
run: ./gradlew :conscrypt-openjdk:testJar -PcheckErrorQueue
- name: Upload test JAR with dependencies
if: runner.os == 'Linux'
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
with:
name: testjar
path: openjdk/build/libs/conscrypt-openjdk-*-tests.jar
if-no-files-found: error
android-test:
needs: boringssl_clone
runs-on: macos-15-intel
strategy:
fail-fast: false
matrix:
api-level: [26, 30, 34]
include:
- api-level: 26
arch: x86_64
target: google_apis
- api-level: 30
arch: x86_64
target: google_apis
- api-level: 34
arch: x86_64
target: google_apis
steps:
- name: Set up JDK 17 for toolchains
uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
with:
distribution: 'temurin'
java-version: 17
- name: Set runner-specific environment variables
shell: bash
run: |
echo "ANDROID_HOME=$ANDROID_SDK_ROOT" >> $GITHUB_ENV
echo "BORINGSSL_HOME=${{ runner.temp }}/boringssl" >> $GITHUB_ENV
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
persist-credentials: false
- name: Fetch BoringSSL source
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with:
name: boringssl-source
path: ${{ runner.temp }}/boringssl
- name: Checkout BoringSSL main branch
shell: bash
run: |
cd "$BORINGSSL_HOME"
git checkout --progress --force -B main
- name: Accept Android SDK licenses
run: |
yes | $ANDROID_SDK_ROOT/cmdline-tools/latest/bin/sdkmanager --licenses || true
- name: Run instrumentation tests on Emulator
uses: reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d # v2.38.0
with:
api-level: ${{ matrix.api-level }}
arch: ${{ matrix.arch }}
force-avd-creation: true
disable-spellchecker: true
target: ${{ matrix.target }}
script: ./gradlew :conscrypt-android:connectedAndroidTest -PcheckErrorQueue
uberjar:
needs: build
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
persist-credentials: false
- name: Setup Linux environment
run: |
echo "CC=clang" >> $GITHUB_ENV
echo "CXX=clang++" >> $GITHUB_ENV
sudo add-apt-repository ppa:openjdk-r/ppa
sudo apt-get -qq update
sudo apt-get -qq install -y --no-install-recommends \
g++-aarch64-linux-gnu \
ninja-build \
openjdk-17-jre-headless
- name: Set runner-specific environment variables
shell: bash
run: |
echo "M2_REPO=${{ runner.temp }}/m2" >> $GITHUB_ENV
echo "BORINGSSL_HOME=${{ runner.temp }}/boringssl" >> $GITHUB_ENV
- name: Fetch BoringSSL source
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with:
name: boringssl-source
path: ${{ runner.temp }}/boringssl
- name: Checkout BoringSSL main branch
shell: bash
run: |
cd "$BORINGSSL_HOME"
git checkout --progress --force -B main
- name: Build BoringSSL 64-bit Linux
# Please keep this in sync with other "Build BoringSSL 64-bit Linux"
run: |
mkdir -p "$BORINGSSL_HOME/build64"
pushd "$BORINGSSL_HOME/build64"
cmake -DCMAKE_POSITION_INDEPENDENT_CODE=TRUE -DCMAKE_BUILD_TYPE=Release -GNinja ..
ninja crypto ssl
popd
- name: Build BoringSSL AArch64 Linux
# Please keep this in sync with other "Build BoringSSL AArch64 Linux"
run: |
mkdir -p "$BORINGSSL_HOME/build.arm"
pushd "$BORINGSSL_HOME/build.arm"
cmake -DCMAKE_SYSTEM_NAME=Linux \
-DCMAKE_SYSTEM_PROCESSOR=aarch64 \
-DCMAKE_C_COMPILER=aarch64-linux-gnu-gcc \
-DCMAKE_CXX_COMPILER=aarch64-linux-gnu-g++ \
-DCMAKE_POSITION_INDEPENDENT_CODE=TRUE \
-DCMAKE_BUILD_TYPE=Release \
-GNinja ..
ninja crypto ssl
# TODO(prb) remove build dependency above and go back to this.
# - name: Make fake BoringSSL directories
# shell: bash
# run: |
# # TODO: remove this when the check is only performed when building.
# # BoringSSL is not needed during the UberJAR build, but the
# # assertion to check happens regardless of whether the project
# # needs it.
# mkdir -p "${{ runner.temp }}/boringssl/build64"
# mkdir -p "${{ runner.temp }}/boringssl/include"
- name: Download Maven repository for Linux
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with:
name: m2repo-Linux
path: ${{ runner.temp }}/m2
- name: Download Maven repository for MacOS
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with:
name: m2repo-macOS
path: ${{ runner.temp }}/m2
- name: Download Maven repository for Windows
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with:
name: m2repo-Windows
path: ${{ runner.temp }}/m2
- name: Build UberJAR with Gradle
shell: bash
run: |
./gradlew :conscrypt-openjdk-uber:build -Dorg.conscrypt.openjdk.buildUberJar=true -Dmaven.repo.local="$M2_REPO"
- name: Publish UberJAR to Maven Local
shell: bash
run: |
./gradlew :conscrypt-openjdk-uber:publishToMavenLocal -Dorg.conscrypt.openjdk.buildUberJar=true -Dmaven.repo.local="$M2_REPO"
- name: Upload Maven respository
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
with:
name: m2repo-uber
path: ${{ runner.temp }}/m2
openjdk-test:
needs: uberjar
strategy:
fail-fast: false
matrix:
platform: [ubuntu-22.04, ubuntu-22.04-arm, ubuntu-latest, macos-14, macos-latest, windows-latest]
java: [8, 11, 17, 21, 25, EA]
dist: ['temurin', 'zulu']
include:
- platform: ubuntu-22.04
separator: ':'
- platform: ubuntu-22.04-arm
separator: ':'
- platform: ubuntu-latest
separator: ':'
- platform: macos-latest
separator: ':'
- platform: macos-14
separator: ':'
- platform: windows-latest
separator: ';'
exclude: # Not available on Github runners
- platform: macos-latest
java: 8
dist: 'temurin'
- platform: macos-14
java: 8
dist: 'temurin'
runs-on: ${{ matrix.platform }}
steps:
- name: Set up Java
if: ${{ matrix.java != 'EA' }}
uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
with:
distribution: ${{ matrix.dist }}
java-version: ${{ matrix.java }}
- name: 'Set up JDK ${{ matrix.java }} from jdk.java.net'
if: ${{ matrix.java == 'EA' }}
uses: oracle-actions/setup-java@fff43251af9936a0e6a4d5d0946e14f1680e9b6b # v1.5.0
with:
website: jdk.java.net
release: ${{ matrix.java }}
- name: Download UberJAR
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with:
name: m2repo-uber
path: m2
- name: Download Test JAR with Dependencies
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with:
name: testjar
path: testjar
- name: Download JUnit runner
shell: bash
run: mvn org.apache.maven.plugins:maven-dependency-plugin:3.8.0:copy -Dartifact=org.junit.platform:junit-platform-console-standalone:1.11.2 -DoutputDirectory=. -Dmdep.stripVersion=true
- name: Run JUnit tests
timeout-minutes: 30
shell: bash
run: |
DIR="$(find m2/org/conscrypt/conscrypt-openjdk-uber -maxdepth 1 -mindepth 1 -type d -print)"
VERSION="${DIR##*/}"
TESTJAR="$(find testjar -name '*-tests.jar')"
# SIGTERM handler, e.g. for when tests hang and time out.
# Send SIGQUIT to test process to get thread dump, give it
# a few seconds to complete and then kill it.
dump_threads() {
echo "Generating stack dump."
ps -fp "$TESTPID"
kill -QUIT "$TESTPID"
sleep 3
kill -KILL "$TESTPID"
exit 1
}
java -jar junit-platform-console-standalone.jar execute -cp "$DIR/conscrypt-openjdk-uber-$VERSION.jar${{ matrix.separator }}$TESTJAR" -n='org.conscrypt.ConscryptOpenJdkSuite' --scan-classpath --reports-dir=results --fail-if-no-tests &
case $(uname -s) in
Darwin|Linux)
trap dump_threads SIGTERM SIGINT
;;
*)
# TODO: Probably won't work on Windows but thread dumps
# work there already.
;;
esac
TESTPID=$!
wait "$TESTPID"
- name: Archive test results
if: ${{ always() }}
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
with:
name: test-results-${{ matrix.platform }}-${{ matrix.java }}-${{ matrix.dist }}
path: results