wolfssl/.github/workflows/openssh.yml

name: openssh Tests

# START OF COMMON SECTION
on:
  push:
    branches: [ 'release/**' ]
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
    branches: [ '*' ]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
# END OF COMMON SECTION

jobs:
  build_wolfssl:
    name: Build wolfSSL
    if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
    # Just to keep it the same as the testing target
    runs-on: ubuntu-24.04
    # This should be a safe limit for the tests to run.
    timeout-minutes: 4
    steps:
      - name: Build wolfSSL
        uses: wolfSSL/actions-build-autotools-project@v1
        with:
          path: wolfssl
          configure: >-
            --enable-openssh --enable-dsa --with-max-rsa-bits=8192
            --enable-intelasm --enable-sp-asm CFLAGS="-DRSA_MIN_SIZE=1024"
          install: true

      - name: tar build-dir
        run: tar -zcf build-dir.tgz build-dir

      - name: Upload built lib
        uses: actions/upload-artifact@v6
        with:
          name: wolf-install-openssh
          path: build-dir.tgz
          retention-days: 5

  openssh_check:
    strategy:
      fail-fast: false
      matrix:
        include:
          # A good way to measure how much each test takes is to create a bash script
          # in the openssh root like this (make it executable):
          # time-measure.sh
          #   #!/bin/bash
          #   /usr/bin/time -a -o /tmp/LTESTS-times.txt -f '%e %C' /usr/bin/bash "$@"
          # And invoke the openssh tests like this:
          #   rm -f /tmp/LTESTS-times.txt && \
          #     make tests TEST_SHELL=$(pwd)/time-measure.sh SKIP_UNIT=yes && \
          #     grep test-exec.sh /tmp/LTESTS-times.txt
          - git_ref: 'V_9_6_P1'
            osp_ver: '9.6'
            SKIP_LTESTS: >-
              exit-status rekey multiplex cert-userkey forward-control integrity
              channel-timeout connection-timeout
          - git_ref: 'V_9_9_P2'
            osp_ver: '9.9p2'
            SKIP_LTESTS: >-
              exit-status rekey multiplex cert-userkey forward-control integrity
              channel-timeout connection-timeout
          - git_ref: 'V_10_0_P2'
            osp_ver: '10.0p2'
            SKIP_LTESTS: >-
              exit-status rekey multiplex forward-control channel-timeout
              connection-timeout
          - git_ref: 'V_10_2_P1'
            osp_ver: '10.2p1'
            SKIP_LTESTS: >-
              exit-status rekey multiplex forward-control channel-timeout
              connection-timeout
          - git_ref: 'V_10_3_P1'
            osp_ver: '10.3p1'
            SKIP_LTESTS: >-
              exit-status rekey multiplex forward-control channel-timeout
              connection-timeout
    name: ${{ matrix.osp_ver }}
    if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
    runs-on: ubuntu-24.04
    needs: build_wolfssl
    steps:
      - name: Download lib
        uses: actions/download-artifact@v7
        with:
          name: wolf-install-openssh

      - name: untar build-dir
        run: tar -xf build-dir.tgz

      - name: Checkout OSP
        uses: actions/checkout@v5
        with:
          repository: wolfssl/osp
          path: osp
          fetch-depth: 1

      - name: Build and test openssh
        uses: wolfSSL/actions-build-autotools-project@v1
        with:
          repository: openssh/openssh-portable
          ref: ${{ matrix.git_ref }}
          path: openssh
          patch-file: $GITHUB_WORKSPACE/osp/openssh-patches/openssh-${{ matrix.osp_ver }}.patch
          configure: --with-wolfssl=$GITHUB_WORKSPACE/build-dir --with-rpath=-Wl,-rpath=
          check: false

      # make tests take >20 minutes. Consider limiting?
      - name: Run tests
        working-directory: ./openssh
        run: |
          make tests SKIP_LTESTS='${{ matrix.SKIP_LTESTS }}'