os-check.yml

name: OS Check Test

on:
  push:
    branches: [ 'master', 'main', 'release/**' ]
  pull_request:
    branches: [ '*' ]
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  create_matrix:
    runs-on: ubuntu-latest
    outputs:
        versions: ${{ steps.json.outputs.versions }}
    steps:
      - name: Create wolfSSL version matrix
        id: json
        run: |
          current=`curl -s https://api.github.com/repos/wolfssl/wolfssl/releases | grep tag_name | cut -d : -f 2,3 | tr -d \" | tr -d , | tr -d ' ' | head -1`
          last=`curl -s https://api.github.com/repos/wolfssl/wolfssl/releases | grep tag_name | cut -d : -f 2,3 | tr -d \" | tr -d , | tr -d ' ' | head -2 | tail -1`
          VERSIONS=$(echo "[ \"master\", \"$current\", \"$last\" ]")
          echo "wolfSSL versions found: $VERSIONS"
          echo "versions=$VERSIONS" >> $GITHUB_OUTPUT

  build_wolfssl:
    needs: create_matrix
    strategy:
      fail-fast: false
      matrix:
        os: [ ubuntu-latest, macos-latest ]
        wolfssl: ${{ fromJson(needs.create_matrix.outputs['versions']) }}
    name: Build wolfssl
    runs-on: ${{ matrix.os }}
    timeout-minutes: 4
    steps:
      - name: Checking cache for wolfssl
        uses: actions/cache@v5
        id: cache-wolfssl
        with:
          path: build-dir/
          key: wolfssh-os-check-wolfssl-${{ matrix.wolfssl }}-${{ matrix.os }}
          lookup-only: true

      - name: debug
        run: echo wolfssl version ${{ matrix.wolfssl }}

      - name: Checkout, build, and install wolfssl
        if: steps.cache-wolfssl.outputs.cache-hit != 'true'
        uses: wolfSSL/actions-build-autotools-project@v1
        with:
          repository: wolfssl/wolfssl
          ref: ${{ matrix.wolfssl }}
          path: wolfssl
          configure: --enable-all
          check: false
          install: true

  build_wolfssh:
    needs:
      - build_wolfssl
      - create_matrix
    strategy:
      fail-fast: false
      matrix:
        os: [ ubuntu-latest, macos-latest ]
        wolfssl: ${{ fromJson(needs.create_matrix.outputs['versions']) }}
        config: [
          '',
          '--enable-all',
          '--enable-all CFLAGS=-DWOLFSSH_LOCAL_PREAD_PWRITE',
          '--enable-all --enable-ossh-certs',
          '--enable-all --disable-server',
          '--enable-all --disable-client',
          '--enable-sftp',
          '--enable-sftp --disable-sftp-zeroize',
          '--enable-scp',
          '--enable-keyboard-interactive',
          '--enable-shell',
        ]
    name: Build wolfssh
    runs-on: ${{ matrix.os }}
    timeout-minutes: 4
    steps:
      - name: Checking cache for wolfssl
        uses: actions/cache@v5
        with:
          path: build-dir/
          key: wolfssh-os-check-wolfssl-${{ matrix.wolfssl }}-${{ matrix.os }}
          fail-on-cache-miss: true

      - name: Checkout, build, and test wolfssh
        uses: wolfSSL/actions-build-autotools-project@v1
        with:
          repository: wolfssl/wolfssh
          path: wolfssh
          configure: ${{ matrix.config }} LDFLAGS="-L${{ github.workspace }}/build-dir/lib" CPPFLAGS="-I${{ github.workspace }}/build-dir/include"
          check: true

  build_wolfssh_no_filesystem:
    needs:
      - build_wolfssl
      - create_matrix
    strategy:
      fail-fast: false
      matrix:
        wolfssl: ${{ fromJson(needs.create_matrix.outputs['versions']) }}
    name: Build and test wolfssh with NO_FILESYSTEM
    runs-on: ubuntu-latest
    timeout-minutes: 6
    steps:
      - name: Checking cache for wolfssl
        uses: actions/cache@v5
        with:
          path: build-dir/
          key: wolfssh-os-check-wolfssl-${{ matrix.wolfssl }}-ubuntu-latest
          fail-on-cache-miss: true

      - uses: actions/checkout@v6
        with:
          path: wolfssh/

      - name: autogen
        working-directory: ./wolfssh/
        run: ./autogen.sh

      - name: configure
        working-directory: ./wolfssh/
        run: |
          ./configure --enable-scp LDFLAGS="-L${{ github.workspace }}/build-dir/lib" CPPFLAGS="-I${{ github.workspace }}/build-dir/include -DNO_FILESYSTEM"

      # The examples do not build without a filesystem, so build the
      # library and the unit test directly instead of running make all
      - name: make unit test
        working-directory: ./wolfssh/
        run: make tests/unit.test

      - name: run unit test
        working-directory: ./wolfssh/
        run: |
          set -o pipefail
          LD_LIBRARY_PATH=${{ github.workspace }}/build-dir/lib ./tests/unit.test | tee unit-test.log
          grep "ScpSendCallback_ExactFitBuffer: SUCCESS" unit-test.log

  build_wolfssh_no_rsa_ecc:
    strategy:
      fail-fast: false
      matrix:
        os: [ ubuntu-latest, macos-latest ]
    name: Build and test wolfssh without RSA or ECC
    runs-on: ${{ matrix.os }}
    timeout-minutes: 16
    steps:
      # Not the cached --enable-all wolfSSL: this job needs one with no RSA
      # and no ECC. Ed25519 is then the only signing algorithm wolfSSH has,
      # and wolfssh/internal.h wants WOLFSSL_ED25519_STREAMING_VERIFY with
      # it, so --enable-ed25519-stream is required, not optional. The ssh
      # client app needs Base64_Encode_NoNl(), which nothing else in this
      # short list pulls in, hence --enable-base64encode.
      - name: Checkout, build, and install wolfssl
        uses: wolfSSL/actions-build-autotools-project@v1
        with:
          repository: wolfssl/wolfssl
          ref: master
          path: wolfssl
          configure: >-
            --enable-ssh --enable-ed25519 --enable-ed25519-stream
            --enable-curve25519 --enable-aesctr --enable-base64encode
            --disable-rsa --disable-ecc --disable-dsa --disable-mldsa
          check: false
          install: true

      - name: Checkout, build, and test wolfssh
        uses: wolfSSL/actions-build-autotools-project@v1
        with:
          repository: wolfssl/wolfssh
          path: wolfssh
          configure: --enable-keyboard-interactive --enable-sftp --enable-scp --enable-sshclient LDFLAGS="-L${{ github.workspace }}/build-dir/lib" CPPFLAGS="-I${{ github.workspace }}/build-dir/include"
          check: true