http3-linux.yml

# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
#
# SPDX-License-Identifier: curl

name: 'Linux HTTP/3'

'on':
  push:
    branches:
      - master
      - 'curl-*'
      - '*/ci'
    paths-ignore:
      - '**/*.md'
      - '.circleci/**'
      - 'appveyor.*'
      - 'Dockerfile'
      - 'projects/**'
  pull_request:
    branches:
      - master
      - 'curl-*'
    paths-ignore:
      - '**/*.md'
      - '.circleci/**'
      - 'appveyor.*'
      - 'Dockerfile'
      - 'projects/**'

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: true

permissions: {}
cache-mode: write

env:
  MAKEFLAGS: -j 5
  CURL_CI: github
  CURL_TEST_MIN: 2000
  DO_NOT_TRACK: '1'
  # renovate: datasource=github-tags depName=awslabs/aws-lc
  AWSLC_VERSION: 5.11.0
  # renovate: datasource=github-tags depName=google/boringssl
  BORINGSSL_VERSION: 0.20260929.0
  # renovate: datasource=github-tags depName=gnutls/nettle versioning=semver-coerced extractVersion=^nettle_?(?<version>.+)_release_.+$
  NETTLE_VERSION: '4.0'
  # renovate: datasource=github-tags depName=gnutls/gnutls
  GNUTLS_VERSION: 3.8.13
  # renovate: datasource=github-tags depName=libressl/portable
  LIBRESSL_VERSION: 4.3.3
  # renovate: datasource=github-releases depName=openssl/openssl extractVersion=^openssl-(?<version>.+)$
  OPENSSL_VERSION: 4.0.3
  # renovate: datasource=github-releases depName=openssl/openssl extractVersion=^openssl-(?<version>3\.5\..+)$
  OPENSSL_PREV_VERSION: 3.5.9
  # renovate: datasource=github-tags depName=cloudflare/quiche
  QUICHE_VERSION: 0.30.0
  # renovate: datasource=github-tags depName=wolfSSL/wolfssl extractVersion=^v?(?<version>.+)-stable$
  WOLFSSL_VERSION: 5.9.4
  # renovate: datasource=github-tags depName=ngtcp2/nghttp3
  NGHTTP3_VERSION: 1.18.0
  # renovate: datasource=github-tags depName=ngtcp2/ngtcp2
  NGTCP2_VERSION: 1.25.0
  # renovate: datasource=github-tags depName=nghttp2/nghttp2
  NGHTTP2_VERSION: 1.70.0
  # manually bumped (repo not offering tagged releases)
  H2O_VERSION: 11b0cfa2771e3ccad4a852e72473e4e278ab1de7 # 2026-05-28
  H2O_SHA256: 5ae1bd7b09970d7d49c41fa68193e24da04c2a7ac5581fbe2affc79200b0721f

jobs:
  build-cache:
    name: 'Build caches ${{ matrix.image }}'
    runs-on: ${{ matrix.image }}
    strategy:
      matrix:
        image: [ubuntu-26.04, ubuntu-26.04-arm]
    steps:
      - name: 'cache awslc'
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-awslc
        env:
          cache-name: cache1-awslc
        with:
          path: ~/pkg/awslc
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.AWSLC_VERSION }}-${{ runner.arch }}

      - name: 'cache boringssl'
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-boringssl
        env:
          cache-name: cache1-boringssl
        with:
          path: ~/pkg/boringssl
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.BORINGSSL_VERSION }}-${{ runner.arch }}

      - name: 'cache nettle'
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-nettle
        env:
          cache-name: cache1-nettle
        with:
          path: ~/pkg/nettle
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NETTLE_VERSION }}-${{ runner.arch }}

      - name: 'cache gnutls'
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-gnutls
        env:
          cache-name: cache1-gnutls
        with:
          path: ~/pkg/gnutls
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.GNUTLS_VERSION }}-${{ env.NETTLE_VERSION }}-${{ runner.arch }}

      - name: 'cache libressl'
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-libressl
        env:
          cache-name: cache1-libressl
        with:
          path: ~/pkg/libressl
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.LIBRESSL_VERSION }}-${{ runner.arch }}

      - name: 'cache openssl'
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache2-openssl-http3-no-deprecated
        env:
          cache-name: cache2-openssl-http3-no-deprecated
        with:
          path: ~/pkg/openssl
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.OPENSSL_VERSION }}-${{ runner.arch }}

      - name: 'cache openssl-prev'
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache2-openssl-prev-http3
        env:
          cache-name: cache2-openssl-prev-http3
        with:
          path: ~/pkg/openssl-prev
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.OPENSSL_PREV_VERSION }}-${{ runner.arch }}

      - name: 'cache wolfssl'
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-wolfssl
        env:
          cache-name: cache1-wolfssl
        with:
          path: ~/pkg/wolfssl
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.WOLFSSL_VERSION }}-${{ runner.arch }}

      - name: 'cache nghttp3'
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-nghttp3
        env:
          cache-name: cache1-nghttp3
        with:
          path: ~/pkg/nghttp3
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGHTTP3_VERSION }}-${{ runner.arch }}

      - name: 'cache ngtcp2'
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-ngtcp2
        env:
          cache-name: cache1-ngtcp2
        with:
          path: ~/pkg/ngtcp2
          key: "${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGTCP2_VERSION }}-${{ env.OPENSSL_VERSION }}-\
            ${{ env.LIBRESSL_VERSION }}-${{ env.AWSLC_VERSION }}-${{ env.NETTLE_VERSION }}-${{ env.GNUTLS_VERSION }}-${{ env.WOLFSSL_VERSION }}-${{ runner.arch }}"

      - name: 'cache ngtcp2 boringssl'
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-ngtcp2-boringssl
        env:
          cache-name: cache1-ngtcp2-boringssl
        with:
          path: ~/pkg/ngtcp2-boringssl
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGTCP2_VERSION }}-${{ env.BORINGSSL_VERSION }}-${{ runner.arch }}

      - name: 'cache ngtcp2 openssl-prev'
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-ngtcp2-openssl-prev
        env:
          cache-name: cache1-ngtcp2-openssl-prev
        with:
          path: ~/pkg/ngtcp2-openssl-prev
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGTCP2_VERSION }}-${{ env.OPENSSL_PREV_VERSION }}-${{ runner.arch }}

      - name: 'cache nghttp2'
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-nghttp2
        env:
          cache-name: cache1-nghttp2
        with:
          path: ~/pkg/nghttp2
          key: "${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGHTTP2_VERSION }}-${{ env.OPENSSL_VERSION }}-\
            ${{ env.NGTCP2_VERSION }}-${{ env.NGHTTP3_VERSION }}-${{ runner.arch }}"

      - name: 'cache h2o'
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-h2o
        env:
          cache-name: cache1-h2o
        with:
          path: ~/pkg/h2o
          key: "${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.H2O_VERSION }}-${{ env.OPENSSL_PREV_VERSION }}-${{ runner.arch }}"

      - id: settings
        if: >-
          ${{ !steps.cache1-awslc.outputs.cache-hit ||
              !steps.cache1-boringssl.outputs.cache-hit ||
              !steps.cache1-nettle.outputs.cache-hit ||
              !steps.cache1-gnutls.outputs.cache-hit ||
              !steps.cache1-libressl.outputs.cache-hit ||
              !steps.cache2-openssl-http3-no-deprecated.outputs.cache-hit ||
              !steps.cache2-openssl-prev-http3.outputs.cache-hit ||
              !steps.cache1-wolfssl.outputs.cache-hit ||
              !steps.cache1-nghttp3.outputs.cache-hit ||
              !steps.cache1-ngtcp2-boringssl.outputs.cache-hit ||
              !steps.cache1-ngtcp2-openssl-prev.outputs.cache-hit ||
              !steps.cache1-ngtcp2.outputs.cache-hit ||
              !steps.cache1-nghttp2.outputs.cache-hit ||
              !steps.cache1-h2o.outputs.cache-hit }}

        run: echo 'needs-build=true' >> "$GITHUB_OUTPUT"

      - name: 'install build prereqs'
        if: ${{ steps.settings.outputs.needs-build }}
        timeout-minutes: 2
        uses: $/.github/actions/pkg-install
        with:
          apt: >-
            libtool autoconf automake pkgconf
            libbrotli-dev libzstd-dev zlib1g-dev
            libev-dev
            libuv1-dev
            libc-ares-dev
            libp11-kit-dev autopoint bison gperf gtk-doc-tools libtasn1-bin

      - name: 'build awslc'
        if: ${{ !steps.cache1-awslc.outputs.cache-hit }}
        run: |
          cd ~
          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
            --location --proto-redir =https "https://github.com/awslabs/aws-lc/archive/refs/tags/v${AWSLC_VERSION}.tar.gz" --output pkg.bin
          sha256sum pkg.bin && tar -xzf pkg.bin && rm -f pkg.bin
          cd "aws-lc-${AWSLC_VERSION}"
          cmake -B . -G Ninja -DBUILD_SHARED_LIBS=ON -DBUILD_TESTING=OFF -DBUILD_TOOL=OFF -DCMAKE_INSTALL_PREFIX=/home/runner/pkg/awslc
          cmake --build .
          cmake --install .

      - name: 'build boringssl'
        if: ${{ !steps.cache1-boringssl.outputs.cache-hit }}
        run: |
          cd ~
          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
            --location --proto-redir =https "https://github.com/google/boringssl/releases/download/${BORINGSSL_VERSION}/boringssl-${BORINGSSL_VERSION}.tar.gz" --output pkg.bin
          sha256sum pkg.bin && tar -xzf pkg.bin && rm -f pkg.bin
          cd "boringssl-${BORINGSSL_VERSION}"
          cmake -B . -G Ninja -DBUILD_SHARED_LIBS=ON -DBUILD_TESTING=OFF -DCMAKE_INSTALL_PREFIX=/home/runner/pkg/boringssl
          cmake --build .
          cmake --install .

      - name: 'build nettle'
        if: ${{ !steps.cache1-nettle.outputs.cache-hit }}
        run: |
          cd ~
          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
            "https://ftp.gnu.org/gnu/nettle/nettle-${NETTLE_VERSION}.tar.gz" --output pkg.bin
          sha256sum pkg.bin && tar -xzf pkg.bin && rm -f pkg.bin
          cd "nettle-${NETTLE_VERSION}"
          autoreconf -fi
          ./configure --disable-dependency-tracking --prefix=/home/runner/pkg/nettle \
            --disable-static --disable-openssl --disable-documentation
          make install

      - name: 'build gnutls'
        if: ${{ !steps.cache1-gnutls.outputs.cache-hit }}
        run: |
          cd ~
          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
            "https://www.gnupg.org/ftp/gcrypt/gnutls/v${GNUTLS_VERSION%.*}/gnutls-${GNUTLS_VERSION}.tar.xz" --output pkg.bin
          sha256sum pkg.bin && tar -xJf pkg.bin && rm -f pkg.bin
          cd "gnutls-${GNUTLS_VERSION}"
          autoreconf -fi
          # required: libp11-kit-dev libev-dev autopoint bison gperf gtk-doc-tools libtasn1-bin
          ./configure --disable-dependency-tracking --prefix=/home/runner/pkg/gnutls \
            PKG_CONFIG_PATH=/home/runner/pkg/nettle/lib/pkgconfig \
            LDFLAGS=-Wl,-rpath,/home/runner/pkg/nettle/lib \
            --with-included-libtasn1 --with-included-unistring \
            --disable-doc --disable-tests --disable-tools
          make install

      - name: 'build libressl'
        if: ${{ !steps.cache1-libressl.outputs.cache-hit }}
        run: |
          cd ~
          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
            "https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-${LIBRESSL_VERSION}.tar.gz" --output pkg.bin
          sha256sum pkg.bin && tar -xzf pkg.bin && rm -f pkg.bin
          cd "libressl-${LIBRESSL_VERSION}"
          cmake -B . -G Ninja -DLIBRESSL_APPS=OFF -DLIBRESSL_TESTS=OFF -DCMAKE_INSTALL_PREFIX=/home/runner/pkg/libressl
          cmake --build .
          cmake --install .

      - name: 'build openssl'
        if: ${{ !steps.cache2-openssl-http3-no-deprecated.outputs.cache-hit }}
        run: |
          cd ~
          git clone --quiet --depth 1 --branch "openssl-${OPENSSL_VERSION}" https://github.com/openssl/openssl
          cd openssl
          # Prefer clang to avoid test 2500-2503 failing valgrind with gcc-15/16 arm64 non-debug OpenSSL 3/4 builds
          CC=clang ./config --prefix=/home/runner/pkg/openssl --libdir=lib no-makedepend no-apps no-docs no-tests no-deprecated
          make
          make -j1 install_sw

      - name: 'build openssl-prev'
        if: ${{ !steps.cache2-openssl-prev-http3.outputs.cache-hit }}
        run: |
          cd ~
          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
            --location --proto-redir =https "https://github.com/openssl/openssl/releases/download/openssl-${OPENSSL_PREV_VERSION}/openssl-${OPENSSL_PREV_VERSION}.tar.gz" --output pkg.bin
          sha256sum pkg.bin && tar -xzf pkg.bin && rm -f pkg.bin
          cd "openssl-${OPENSSL_PREV_VERSION}"
          # Prefer clang to avoid test 2500-2503 failing valgrind with gcc-15/16 arm64 non-debug OpenSSL 3/4 builds
          CC=clang ./config --prefix=/home/runner/pkg/openssl-prev --libdir=lib no-makedepend no-apps no-docs no-tests
          make
          make -j1 install_sw

      - name: 'build wolfssl'
        if: ${{ !steps.cache1-wolfssl.outputs.cache-hit }}
        run: |
          cd ~
          git clone --quiet --depth 1 --branch "v${WOLFSSL_VERSION}-stable" https://github.com/wolfSSL/wolfssl
          cd wolfssl
          ./autogen.sh
          ./configure --disable-dependency-tracking --prefix=/home/runner/pkg/wolfssl --enable-all --enable-quic \
            --disable-benchmark --disable-crypttests --disable-examples
          make
          make install

      - name: 'build nghttp3'
        if: ${{ !steps.cache1-nghttp3.outputs.cache-hit }}
        run: |
          cd ~
          git clone --quiet --depth 1 --branch "v${NGHTTP3_VERSION}" https://github.com/ngtcp2/nghttp3
          cd nghttp3
          git submodule update --init --depth 1
          autoreconf -fi
          ./configure --disable-dependency-tracking --prefix=/home/runner/pkg/nghttp3 --enable-lib-only
          make
          make install

      - name: 'build ngtcp2'
        if: ${{ !steps.cache1-ngtcp2.outputs.cache-hit }}
        # building twice to get crypto libs for ossl, libressl and awslc installed
        run: |
          cd ~
          git clone --quiet --depth 1 --branch "v${NGTCP2_VERSION}" https://github.com/ngtcp2/ngtcp2
          cd ngtcp2
          autoreconf -fi
          ./configure --disable-dependency-tracking --prefix=/home/runner/pkg/ngtcp2 --enable-lib-only \
            PKG_CONFIG_PATH=/home/runner/pkg/libressl/lib/pkgconfig \
            --with-openssl
          make install
          make clean
          export PKG_CONFIG_PATH=/home/runner/pkg/openssl/lib/pkgconfig
          PKG_CONFIG_PATH+=:/home/runner/pkg/nettle/lib/pkgconfig
          PKG_CONFIG_PATH+=:/home/runner/pkg/gnutls/lib/pkgconfig
          PKG_CONFIG_PATH+=:/home/runner/pkg/wolfssl/lib/pkgconfig
          ./configure --disable-dependency-tracking --prefix=/home/runner/pkg/ngtcp2 --enable-lib-only \
            --with-openssl --with-gnutls --with-wolfssl --with-boringssl \
            BORINGSSL_LIBS='-L/home/runner/pkg/awslc/lib -lssl -lcrypto' \
            BORINGSSL_CFLAGS='-I/home/runner/pkg/awslc/include'
          make install

      - name: 'build ngtcp2 openssl-prev'
        if: ${{ !steps.cache1-ngtcp2-openssl-prev.outputs.cache-hit }}
        run: |
          cd ~
          git clone --quiet --depth 1 --branch "v${NGTCP2_VERSION}" https://github.com/ngtcp2/ngtcp2 ngtcp2-openssl-prev
          cd ngtcp2-openssl-prev
          autoreconf -fi
          ./configure --disable-dependency-tracking --prefix=/home/runner/pkg/ngtcp2-openssl-prev --enable-lib-only \
            PKG_CONFIG_PATH=/home/runner/pkg/openssl-prev/lib/pkgconfig \
            --with-openssl
          make install

      - name: 'build ngtcp2 boringssl'
        if: ${{ !steps.cache1-ngtcp2-boringssl.outputs.cache-hit }}
        run: |
          cd ~
          git clone --quiet --depth 1 --branch "v${NGTCP2_VERSION}" https://github.com/ngtcp2/ngtcp2 ngtcp2-boringssl
          cd ngtcp2-boringssl
          autoreconf -fi
          ./configure --disable-dependency-tracking --prefix=/home/runner/pkg/ngtcp2-boringssl --enable-lib-only \
            --with-openssl=no --with-boringssl \
            BORINGSSL_LIBS='-L/home/runner/pkg/boringssl/lib -lssl -lcrypto' \
            BORINGSSL_CFLAGS='-I/home/runner/pkg/boringssl/include'
          make install

      - name: 'build nghttp2'
        if: ${{ !steps.cache1-nghttp2.outputs.cache-hit }}
        run: |
          cd ~
          git clone --quiet --depth 1 --branch "v${NGHTTP2_VERSION}" https://github.com/nghttp2/nghttp2
          cd nghttp2
          git submodule update --init --depth 1
          autoreconf -fi
          # required (for nghttpx application): libc-ares-dev libev-dev zlib1g-dev
          # optional (for nghttpx application): libbrotli-dev
          export PKG_CONFIG_PATH=/home/runner/pkg/openssl/lib/pkgconfig
          PKG_CONFIG_PATH+=:/home/runner/pkg/nghttp3/lib/pkgconfig
          PKG_CONFIG_PATH+=:/home/runner/pkg/ngtcp2/lib/pkgconfig
          ./configure --disable-dependency-tracking --prefix=/home/runner/pkg/nghttp2 --enable-app --enable-http3 \
            LDFLAGS=-Wl,-rpath,/home/runner/pkg/openssl/lib \
            --with-libbrotlienc --with-libbrotlidec
          make install

      - name: 'build h2o'
        if: ${{ !steps.cache1-h2o.outputs.cache-hit }}
        run: |
          cd ~
          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
            --location --proto-redir =https "https://github.com/h2o/h2o/archive/${H2O_VERSION}.tar.gz" --output pkg.bin
          sha256sum pkg.bin | tee /dev/stderr | grep -qwF -- "${H2O_SHA256}" && tar -xzf pkg.bin && rm -f pkg.bin
          cd "h2o-${H2O_VERSION}"
          cmake -B . -G Ninja -DWITHOUT_LIBS=ON -DOPENSSL_ROOT_DIR=/home/runner/pkg/openssl-prev -DCMAKE_INSTALL_PREFIX=/home/runner/pkg/h2o
          cmake --build .
          cmake --install .

  linux:
    name: ${{ matrix.build.generate && 'CM' || 'AM' }} ${{ matrix.build.name }}
    needs: build-cache
    runs-on: ${{ matrix.build.image || 'ubuntu-26.04' }}
    timeout-minutes: 10
    env:
      CURL_TRACE_PKG_CONFIG: '1'
      MATRIX_BUILD: ${{ matrix.build.generate && 'cmake' || 'autotools' }}
    strategy:
      fail-fast: false
      matrix:
        build:
          - name: 'awslc'
            install_steps: skipall
            LDFLAGS: -Wl,-rpath,/home/runner/pkg/awslc/lib
            PKG_CONFIG_PATH: /home/runner/pkg/awslc/lib/pkgconfig:/home/runner/pkg/nghttp3/lib/pkgconfig:/home/runner/pkg/ngtcp2/lib/pkgconfig:/home/runner/pkg/nghttp2/lib/pkgconfig
            # Intentionally using bare '--with-ngtcp2' + 'PKG_CONFIG_PATH' to test this way of configuration, in addition to '--with-ngtcp2=<path>' in other jobs.
            configure: >-
              --with-openssl=/home/runner/pkg/awslc --with-ngtcp2 --enable-ssls-export

          - name: 'awslc'
            PKG_CONFIG_PATH: /home/runner/pkg/awslc/lib/pkgconfig:/home/runner/pkg/nghttp3/lib/pkgconfig:/home/runner/pkg/ngtcp2/lib/pkgconfig:/home/runner/pkg/nghttp2/lib/pkgconfig
            generate: >-
              -DOPENSSL_ROOT_DIR=/home/runner/pkg/awslc -DUSE_NGTCP2=ON -DBUILD_SHARED_LIBS=OFF
              -DCMAKE_UNITY_BUILD=ON -DCURL_DROP_UNUSED=ON -DCURL_DISABLE_HTTPSIG=OFF

          - name: 'boringssl'
            image: ubuntu-26.04-arm
            install_steps: skipall
            LDFLAGS: -Wl,-rpath,/home/runner/pkg/boringssl/lib
            PKG_CONFIG_PATH: /home/runner/pkg/boringssl/lib/pkgconfig:/home/runner/pkg/nghttp3/lib/pkgconfig:/home/runner/pkg/nghttp2/lib/pkgconfig
            configure: >-
              --with-openssl=/home/runner/pkg/boringssl --with-ngtcp2=/home/runner/pkg/ngtcp2-boringssl --enable-ssls-export

          - name: 'boringssl'
            image: ubuntu-26.04-arm
            PKG_CONFIG_PATH: "\
              /home/runner/pkg/boringssl/lib/pkgconfig:\
              /home/runner/pkg/nghttp3/lib/pkgconfig:\
              /home/runner/pkg/ngtcp2-boringssl/lib/pkgconfig:\
              /home/runner/pkg/nghttp2/lib/pkgconfig"
            generate: >-
              -DOPENSSL_ROOT_DIR=/home/runner/pkg/boringssl -DUSE_NGTCP2=ON -DBUILD_SHARED_LIBS=OFF
              -DCMAKE_UNITY_BUILD=ON -DCURL_DISABLE_HTTPSIG=OFF

          - name: 'gnutls'
            install_packages: libp11-kit-dev libssh-dev
            install_steps: skipall
            LDFLAGS: -Wl,-rpath,/home/runner/pkg/gnutls/lib -Wl,-rpath,/home/runner/pkg/nettle/lib -Wl,-rpath,/home/runner/pkg/ngtcp2/lib
            PKG_CONFIG_PATH: /home/runner/pkg/nettle/lib/pkgconfig:/home/runner/pkg/gnutls/lib/pkgconfig:/home/runner/pkg/nghttp3/lib/pkgconfig:/home/runner/pkg/nghttp2/lib/pkgconfig
            configure: >-
              --with-gnutls=/home/runner/pkg/gnutls --with-ngtcp2=/home/runner/pkg/ngtcp2 --with-libssh --enable-ssls-export --enable-httpsig --disable-ntlm

          - name: 'gnutls'
            tflags: '--min=1900'
            install_packages: libp11-kit-dev libssh-dev
            LDFLAGS: -Wl,-rpath,/home/runner/pkg/gnutls/lib
            PKG_CONFIG_PATH: "\
              /home/runner/pkg/nettle/lib/pkgconfig:\
              /home/runner/pkg/gnutls/lib/pkgconfig:\
              /home/runner/pkg/nghttp3/lib/pkgconfig:\
              /home/runner/pkg/ngtcp2/lib/pkgconfig:\
              /home/runner/pkg/nghttp2/lib/pkgconfig"
            generate: >-
              -DCURL_USE_GNUTLS=ON -DUSE_NGTCP2=ON -DCURL_USE_LIBSSH=ON
              -DCMAKE_UNITY_BUILD=ON -DCURL_DISABLE_HTTPSIG=OFF -DCURL_ENABLE_NTLM=OFF

          - name: 'libressl'
            install_steps: skipall
            LDFLAGS: -Wl,-rpath,/home/runner/pkg/libressl/lib
            PKG_CONFIG_PATH: /home/runner/pkg/libressl/lib/pkgconfig:/home/runner/pkg/nghttp3/lib/pkgconfig:/home/runner/pkg/nghttp2/lib/pkgconfig
            # Intentionally using '--with-ngtcp2=<path>' to test this way of configuration, in addition to bare '--with-ngtcp2' + 'PKG_CONFIG_PATH' in other jobs.
            configure: >-
              --with-openssl=/home/runner/pkg/libressl --with-ngtcp2=/home/runner/pkg/ngtcp2 --enable-ssls-export
              --enable-unity

          - name: 'libressl'
            PKG_CONFIG_PATH: /home/runner/pkg/libressl/lib/pkgconfig:/home/runner/pkg/nghttp3/lib/pkgconfig:/home/runner/pkg/ngtcp2/lib/pkgconfig:/home/runner/pkg/nghttp2/lib/pkgconfig
            generate: >-
              -DOPENSSL_ROOT_DIR=/home/runner/pkg/libressl -DUSE_NGTCP2=ON -DCURL_DISABLE_HTTPSIG=OFF

          - name: 'openssl'
            tflags: '--min=1850'
            LDFLAGS: -Wl,-rpath,/home/runner/pkg/openssl/lib
            PKG_CONFIG_PATH: /home/runner/pkg/openssl/lib/pkgconfig:/home/runner/pkg/nghttp3/lib/pkgconfig:/home/runner/pkg/nghttp2/lib/pkgconfig
            configure: >-
              --with-openssl=/home/runner/pkg/openssl --with-ngtcp2=/home/runner/pkg/ngtcp2 --enable-ech --enable-ssls-export --enable-proxy-http3 --enable-httpsig

          - name: 'openssl'
            install_steps: skipall
            PKG_CONFIG_PATH: /home/runner/pkg/openssl/lib/pkgconfig:/home/runner/pkg/nghttp3/lib/pkgconfig:/home/runner/pkg/ngtcp2/lib/pkgconfig:/home/runner/pkg/nghttp2/lib/pkgconfig
            generate: >-
              -DOPENSSL_ROOT_DIR=/home/runner/pkg/openssl -DUSE_NGTCP2=ON
              -DCURL_DISABLE_LDAP=ON
              -DUSE_ECH=ON -DUSE_PROXY_HTTP3=ON
              -DCMAKE_UNITY_BUILD=ON

          - name: 'openssl-prev'
            image: ubuntu-26.04-arm
            install_steps: skipall
            LDFLAGS: -Wl,-rpath,/home/runner/pkg/openssl-prev/lib
            PKG_CONFIG_PATH: "\
              /home/runner/pkg/openssl-prev/lib/pkgconfig:\
              /home/runner/pkg/nghttp3/lib/pkgconfig:\
              /home/runner/pkg/nghttp2/lib/pkgconfig"
            configure: >-
              --with-openssl=/home/runner/pkg/openssl-prev --with-ngtcp2=/home/runner/pkg/ngtcp2-openssl-prev --enable-ssls-export

          - name: 'openssl-prev'
            image: ubuntu-26.04-arm
            tflags: '--min=2000'
            PKG_CONFIG_PATH: "\
              /home/runner/pkg/openssl-prev/lib/pkgconfig:\
              /home/runner/pkg/nghttp3/lib/pkgconfig:\
              /home/runner/pkg/nghttp2/lib/pkgconfig:\
              /home/runner/pkg/ngtcp2-openssl-prev/lib/pkgconfig"
            generate: >-
              -DOPENSSL_ROOT_DIR=/home/runner/pkg/openssl-prev -DUSE_NGTCP2=ON
              -DCURL_DISABLE_LDAP=ON -DCURL_DISABLE_HTTPSIG=OFF

          - name: 'quiche'
            install_packages: clang
            install_steps: skipall
            CC: clang
            CFLAGS: -fPIC
            LDFLAGS: -Wl,-rpath,/home/runner/quiche/target/release -lstdc++
            PKG_CONFIG_PATH: /home/runner/pkg/nghttp2/lib/pkgconfig
            configure: >-
              --with-openssl=/home/runner/quiche/boringssl
              --with-quiche=/home/runner/quiche/target/release
              --with-ca-fallback
              --enable-unity

          - name: 'quiche'
            install_packages: clang
            CC: clang
            PKG_CONFIG_PATH: /home/runner/pkg/nghttp2/lib/pkgconfig:/home/runner/quiche/target/release
            generate: >-
              -DOPENSSL_ROOT_DIR=/home/runner/quiche/boringssl -DOPENSSL_USE_STATIC_LIBS=ON
              -DUSE_QUICHE=ON
              -DCURL_CA_FALLBACK=ON -DCURL_DISABLE_HTTPSIG=OFF

          - name: 'wolfssl'
            install_packages: libssh2-1-dev
            install_steps: skipall
            LDFLAGS: -Wl,-rpath,/home/runner/pkg/wolfssl/lib
            PKG_CONFIG_PATH: /home/runner/pkg/wolfssl/lib/pkgconfig:/home/runner/pkg/nghttp3/lib/pkgconfig:/home/runner/pkg/nghttp2/lib/pkgconfig
            configure: >-
              --with-wolfssl=/home/runner/pkg/wolfssl --with-ngtcp2=/home/runner/pkg/ngtcp2 --enable-ech --with-libssh2 --enable-ssls-export
              --enable-unity

          - name: 'wolfssl'
            install_packages: libssh2-1-dev
            tflags: '--min=1900'
            PKG_CONFIG_PATH: /home/runner/pkg/wolfssl/lib/pkgconfig:/home/runner/pkg/nghttp3/lib/pkgconfig:/home/runner/pkg/ngtcp2/lib/pkgconfig:/home/runner/pkg/nghttp2/lib/pkgconfig
            generate: >-
              -DCURL_USE_WOLFSSL=ON -DUSE_NGTCP2=ON
              -DUSE_ECH=ON -DCURL_DISABLE_HTTPSIG=OFF

    steps:
      - name: 'install prereqs'
        timeout-minutes: 2
        uses: $/.github/actions/pkg-install
        with:
          apt: >-
            libtool autoconf automake pkgconf
            libpsl-dev libbrotli-dev libzstd-dev zlib1g-dev libidn2-0-dev libldap-dev libuv1-dev valgrind
            ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') && 'stunnel4 ' || '' }}
            ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') &&
              'apache2 apache2-dev libnghttp2-dev vsftpd dante-server libev-dev' || '' }}
            ${{ matrix.build.install_packages }}

      - name: 'cache awslc'
        if: ${{ contains(matrix.build.name, 'awslc') }}
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-awslc
        env:
          cache-name: cache1-awslc
        with:
          path: ~/pkg/awslc
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.AWSLC_VERSION }}-${{ runner.arch }}
          fail-on-cache-miss: true

      - name: 'cache boringssl'
        if: ${{ contains(matrix.build.name, 'boringssl') }}
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-boringssl
        env:
          cache-name: cache1-boringssl
        with:
          path: ~/pkg/boringssl
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.BORINGSSL_VERSION }}-${{ runner.arch }}
          fail-on-cache-miss: true

      - name: 'cache nettle'
        if: ${{ contains(matrix.build.name, 'gnutls') }}
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-nettle
        env:
          cache-name: cache1-nettle
        with:
          path: ~/pkg/nettle
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NETTLE_VERSION }}-${{ runner.arch }}
          fail-on-cache-miss: true

      - name: 'cache gnutls'
        if: ${{ contains(matrix.build.name, 'gnutls') }}
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-gnutls
        env:
          cache-name: cache1-gnutls
        with:
          path: ~/pkg/gnutls
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.GNUTLS_VERSION }}-${{ env.NETTLE_VERSION }}-${{ runner.arch }}
          fail-on-cache-miss: true

      - name: 'cache libressl'
        if: ${{ contains(matrix.build.name, 'libressl') }}
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-libressl
        env:
          cache-name: cache1-libressl
        with:
          path: ~/pkg/libressl
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.LIBRESSL_VERSION }}-${{ runner.arch }}
          fail-on-cache-miss: true

      - name: 'cache openssl'
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache2-openssl-http3-no-deprecated
        env:
          cache-name: cache2-openssl-http3-no-deprecated
        with:
          path: ~/pkg/openssl
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.OPENSSL_VERSION }}-${{ runner.arch }}
          fail-on-cache-miss: true

      - name: 'cache openssl-prev'
        if: ${{ contains(matrix.build.name, 'openssl-prev') }}
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache2-openssl-prev-http3
        env:
          cache-name: cache2-openssl-prev-http3
        with:
          path: ~/pkg/openssl-prev
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.OPENSSL_PREV_VERSION }}-${{ runner.arch }}
          fail-on-cache-miss: true

      - name: 'cache wolfssl'
        if: ${{ contains(matrix.build.name, 'wolfssl') }}
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-wolfssl
        env:
          cache-name: cache1-wolfssl
        with:
          path: ~/pkg/wolfssl
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.WOLFSSL_VERSION }}-${{ runner.arch }}
          fail-on-cache-miss: true

      - name: 'cache nghttp3'
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-nghttp3
        env:
          cache-name: cache1-nghttp3
        with:
          path: ~/pkg/nghttp3
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGHTTP3_VERSION }}-${{ runner.arch }}
          fail-on-cache-miss: true

      - name: 'cache ngtcp2'
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-ngtcp2
        env:
          cache-name: cache1-ngtcp2
        with:
          path: ~/pkg/ngtcp2
          key: "${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGTCP2_VERSION }}-${{ env.OPENSSL_VERSION }}-\
            ${{ env.LIBRESSL_VERSION }}-${{ env.AWSLC_VERSION }}-${{ env.NETTLE_VERSION }}-${{ env.GNUTLS_VERSION }}-${{ env.WOLFSSL_VERSION }}-${{ runner.arch }}"
          fail-on-cache-miss: true

      - name: 'cache ngtcp2 boringssl'
        if: ${{ contains(matrix.build.name, 'boringssl') }}
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-ngtcp2-boringssl
        env:
          cache-name: cache1-ngtcp2-boringssl
        with:
          path: ~/pkg/ngtcp2-boringssl
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGTCP2_VERSION }}-${{ env.BORINGSSL_VERSION }}-${{ runner.arch }}
          fail-on-cache-miss: true

      - name: 'cache ngtcp2 openssl-prev'
        if: ${{ contains(matrix.build.name, 'openssl-prev') }}
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-ngtcp2-openssl-prev
        env:
          cache-name: cache1-ngtcp2-openssl-prev
        with:
          path: ~/pkg/ngtcp2-openssl-prev
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGTCP2_VERSION }}-${{ env.OPENSSL_PREV_VERSION }}-${{ runner.arch }}
          fail-on-cache-miss: true

      - name: 'cache nghttp2'
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-nghttp2
        env:
          cache-name: cache1-nghttp2
        with:
          path: ~/pkg/nghttp2
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGHTTP2_VERSION }}-${{ env.OPENSSL_VERSION }}-${{ env.NGTCP2_VERSION }}-${{ env.NGHTTP3_VERSION }}-${{ runner.arch }}
          fail-on-cache-miss: true

      - name: 'cache h2o'
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-h2o
        env:
          cache-name: cache1-h2o
        with:
          path: ~/pkg/h2o
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.H2O_VERSION }}-${{ env.OPENSSL_PREV_VERSION }}-${{ runner.arch }}
          fail-on-cache-miss: true

      - name: 'cache quiche'
        if: ${{ contains(matrix.build.name, 'quiche') }}
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-quiche
        env:
          cache-name: cache1-quiche
        with:
          path: ~/quiche
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.QUICHE_VERSION }}-${{ runner.arch }}

      - name: 'build quiche and boringssl'
        if: ${{ contains(matrix.build.name, 'quiche') && !steps.cache1-quiche.outputs.cache-hit }}
        run: |
          cd ~
          git clone --quiet --depth 1 --branch "${QUICHE_VERSION}" --recursive https://github.com/cloudflare/quiche
          cd quiche
          if [ "$(uname -m)" = 'aarch64' ]; then
            export CARGO_PROFILE_RELEASE_OPT_LEVEL=0  # to avoid test 2500-2503 failing valgrind with arm64 non-debug quiche 0.30.0 builds
          fi
          cargo build --package quiche --release --features ffi,pkg-config-meta,qlog -vv
          ln -s libquiche.so target/release/libquiche.so.0
          cd ..
          mkdir -p quiche/boringssl/lib
          find quiche/target/release \( -name libcrypto.a -o -name libssl.a \) -exec ln -vnf -- '{}' quiche/boringssl/lib \;
          find quiche/target/release/build/boring-sys-*/out/boringssl -maxdepth 1 \( -name include \) -exec ln -vsf -- '../../{}' quiche/boringssl \;
          # Reduce cached blob size
          rm -rf quiche/target/release/build/boring-sys-*/out/build/CMakeFiles
          rm -rf quiche/target/release/deps
          du -t 4MB quiche

          # include dir: /home/runner/quiche/boringssl/include
          # lib dir:     /home/runner/quiche/boringssl/lib

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: 'autoreconf'
        if: ${{ matrix.build.configure }}
        run: autoreconf -fi

      - name: 'configure'
        env:
          CC: '${{ matrix.build.CC }}'
          CFLAGS: '${{ matrix.build.CFLAGS }}'
          LDFLAGS: '${{ matrix.build.LDFLAGS }}'
          MATRIX_NAME: '${{ matrix.build.name }}'
          MATRIX_CONFIGURE: '${{ matrix.build.configure }}'
          MATRIX_GENERATE: '${{ matrix.build.generate }}'
          MATRIX_PKG_CONFIG_PATH: '${{ matrix.build.PKG_CONFIG_PATH }}'
        run: |
          [ -n "${MATRIX_PKG_CONFIG_PATH}" ] && export PKG_CONFIG_PATH="${MATRIX_PKG_CONFIG_PATH}"
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            [[ "${MATRIX_NAME}" = *'quiche'* ]] && sudo apt-get -o Dpkg::Use-Pty=0 purge libssl-dev
            [[ "${MATRIX_NAME}" = *'boringssl'* ]] && options=" -DBORINGSSL_VERSION=${BORINGSSL_VERSION}"
            cmake -B bld -G Ninja \
              -DCMAKE_C_COMPILER_TARGET="$(uname -m)-unknown-linux-gnu" -DBUILD_STATIC_LIBS=ON \
              -DCURL_WERROR=ON -DENABLE_DEBUG=ON \
              -DCURL_USE_LIBUV=ON -DCURL_ENABLE_NTLM=ON \
              -DTEST_NGHTTPX=/home/runner/pkg/nghttp2/bin/nghttpx \
              -DH2O=/home/runner/pkg/h2o/bin/h2o \
              -DHTTPD_NGHTTPX=/home/runner/pkg/nghttp2/bin/nghttpx \
              ${MATRIX_GENERATE} ${options}
          else
            [[ "${MATRIX_NAME}" = *'boringssl'* ]] && export CPPFLAGS="-DCURL_BORINGSSL_VERSION=\\\"${BORINGSSL_VERSION}\\\""
            mkdir bld && cd bld && ../configure --enable-warnings --enable-werror --enable-debug --disable-static \
              --disable-dependency-tracking --enable-option-checking=fatal \
              --with-libuv --enable-ntlm \
              --with-test-h2o=/home/runner/pkg/h2o/bin/h2o \
              --with-test-nghttpx=/home/runner/pkg/nghttp2/bin/nghttpx \
              ${MATRIX_CONFIGURE}
          fi

      - name: 'configure log'
        if: ${{ !cancelled() }}
        run: cat bld/config.log bld/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true

      - name: 'curl_config.h'
        run: |
          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
          grep -F '#define' bld/lib/curl_config.h | sort || true

      - name: 'libcurl.pc, curl-config'
        run: |
          for f in libcurl.pc curl-config; do
            echo "::group::${f}"; grep -v '^#' bld/"${f}" || true; echo '::endgroup::'
          done

      - name: 'test configs'
        run: grep -H -v '^#' bld/tests/config bld/tests/http/config.ini || true

      - name: 'build'
        run: |
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            cmake --build bld --verbose
          else
            make -C bld V=1
          fi

      - name: 'curl -V'
        run: |
          find . -type f \( -name curl -o -name '*.so.*' -o -name '*.a' \) -print0 | sort -z | xargs -0 file --
          find . -type f \( -name curl -o -name '*.so.*' -o -name '*.a' \) -print0 | sort -z | xargs -0 stat -c '%10s bytes: %n' --
          bld/src/curl --disable -V

      - name: 'build tests'
        if: ${{ !contains(matrix.build.install_steps, 'skipall') }}
        run: |
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            cmake --build bld --verbose --target testdeps
          else
            make -C bld V=1 -C tests
          fi

      - name: 'run tests'
        if: ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') }}
        env:
          TFLAGS: '${{ matrix.build.tflags }}'
        run: |
          TFLAGS+=' -n'
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            cmake --build bld --verbose --target test-ci
          else
            make -C bld V=1 test-ci
          fi

      - name: 'run tests (valgrind)'
        if: ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') }}
        run: |
          export TFLAGS='-j6 --min=4 HTTP/3'
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            cmake --build bld --verbose --target test-ci
          else
            make -C bld V=1 test-ci
          fi

      - name: 'install pytest prereqs'
        if: ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') }}
        uses: $/.github/actions/pkg-install
        with:
          pip: -r tests/http/requirements.txt

      - name: 'run pytest (event based)'
        if: ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') }}
        env:
          CURL_TEST_EVENT: 1
          PYTEST_ADDOPTS: '--color=yes'
          PYTEST_XDIST_AUTO_NUM_WORKERS: 4
        run: |
          source ~/venv/bin/activate
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            cmake --build bld --verbose --target curl-pytest-ci
          else
            make -C bld V=1 pytest-ci
          fi