Repository navigation

Fix: Fenrir F-10621 #14174

Workflow file for this run

	name: Quantum Resistant Tests

	# START OF COMMON SECTION
	on:
	push:
	branches: [ 'release/**' ]
	pull_request:
	types: [opened, synchronize, reopened, ready_for_review]
	branches: [ '*' ]
	# Weekday-morning cron (10:00 UTC) seeds the master-scoped ccache that PR runs restore, by
	# re-running --build-only (compile only, no tests) on the default branch.
	# PR runs are read-only.
	schedule:
	- cron: '4 10 * * 1-5'

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	permissions:
	contents: read
	# END OF COMMON SECTION

	jobs:
	# All former runner-per-config matrix entries build on one runner via
	# .github/scripts/parallel-make-check.py (see os-check.yml for the full
	# pattern): each config in its own out-of-tree ("VPATH") build directory
	# off one checkout/autogen, checks on a pool of one-per-CPU worker
	# threads, longest first. bubblewrap gives every test script its own
	# network namespace so concurrent checks cannot collide on TCP/UDP ports
	# (do not set AM_BWRAPPED here - that would disable it).
	make_check:
	name: make check
	strategy:
	fail-fast: false
	matrix:
	# Three, not two: a shard's wall time is one config's, not its
	# share of the work. all-pq-small-smallstack-noasm alone ran 35.7
	# min of a 35.7 min shard and all-pq-small-noasm 33.8 of 33.8, each
	# holding one of four CPUs while 17 neighbours held the rest. A
	# third shard separates those two from slhdsa-pqc-only (22.3) and
	# leaves the one on the critical path more of the machine.
	shard: [1, 2, 3]
	if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' \|\| github.event.pull_request.draft == false) }}
	runs-on: ubuntu-24.04
	# Generous for a cold ccache; warm reruns finish in a fraction. The
	# margin is deliberately wide: before the -cross bundle, "Install
	# dependencies" was seen to spend 30 min pulling the cross-compilers from a
	# slow archive mirror, which used up the whole budget before a single
	# config built.
	timeout-minutes: 45
	steps:
	- uses: actions/checkout@v5
	name: Checkout wolfSSL

	- name: Install dependencies
	uses: ./.github/actions/install-apt-deps
	with:
	packages: autoconf automake libtool build-essential bubblewrap crossbuild-essential-arm64 crossbuild-essential-armhf
	ghcr-debs-tag: ubuntu-24.04-cross
	# Kept for the apt path this no longer normally takes: the default
	# budget caps each attempt at 250s and hard-fails a download that
	# merely runs slow, and the cross-toolchains are ~118 MB. 1200 gives
	# an attempt 500s and still reports inside the 45-minute job.
	budget-seconds: '1200'

	# ccache via the cross-platform composite; the script passes the
	# compiler to configure as CC="ccache gcc" (or a per-config "cc").
	- name: Set up ccache
	uses: ./.github/actions/ccache-setup
	with:
	workflow-id: pq-all
	config-hash: shard-${{ matrix.shard }}
	# A shard restores a seed cache that already sits at the cap, so
	# every object this run compiles evicts one that is still needed:
	# at 350M a shard reported 223 cleanups and a 43% hit rate, and
	# configs took 3-5x their warm time. Size it to hold the seeded
	# objects and this run's alongside them.
	max-size: 700M
	# PRs read the cache the weekday seed writes; they never
	# save, so PR runs add nothing to the Actions cache.
	read-only: ${{ github.event_name == 'pull_request' }}

	# Ubuntu 24.04 can restrict unprivileged user namespaces via AppArmor,
	# which would stop the test scripts from re-execing under
	# bwrap --unshare-net (their port-isolation mechanism).
	- name: Allow unprivileged user namespaces (for bwrap)
	run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 \|\| true

	# The config list lives in .github/configs/pq-all.json; add new
	# configs there as new entries (a "comment" key is allowed for notes).
	# It is kept out of this file on purpose: GitHub caps a single `run:`
	# step at 21000 characters, and an inlined heredoc is what silently
	# pushed os-check.yml past that cap - the whole file then failed to
	# load and every run reported zero jobs.
	# "minutes" is the expected duration driving longest-first scheduling:
	# take it from the Minutes column of a previous run's step summary, or
	# omit it for a new config (defaults to 1) and refresh later. The list
	# is kept sorted by minutes for readability, but the schedule sorts by
	# the values, not list order.
	# Take it from an ordinary PR run, not an unusually warm one. The
	# seed is built from master, so a PR that edits a widely included
	# header misses everything downstream of it - editing wolfssl/ssl.h
	# alone drops a config to a 31% hit rate - and most PR runs land
	# around 42%, against 99.8% for the rare PR that touches no compiled
	# file. Those two regimes differ 2x per config (all-pq-small-noasm:
	# 33.8 min against 16.0), so calibrating off the warm one makes every
	# normal run warn that the estimate is stale.
	- name: Build and make check this shard's configs (parallel, out-of-tree)
	run: \|
	.github/scripts/parallel-make-check.py \
	${{ github.event_name == 'schedule' && '--build-only' \|\| '' }} \
	--shard "${{ matrix.shard }}/${{ strategy.job-total }}" \
	--private-dir=certs \
	.github/configs/pq-all.json

	- name: ccache stats
	if: always()
	run: ccache -s \|\| true

	- name: Upload logs on failure
	if: failure()
	uses: actions/upload-artifact@v6
	with:
	retention-days: 7
	name: pq-all-logs-${{ matrix.shard }}
	path: \|
	build-*/make-check.log
	build-*/test-suite.log
	build-*/config.log
	if-no-files-found: ignore

Navigation Menu

Repository navigation

Fix: Fenrir F-10621 #14174

Workflow file

Fix: Fenrir F-10621 #14174

Uh oh!

Workflow file for this run