From 75f2c742a0aac492806faed8f9dad3f11749962b Mon Sep 17 00:00:00 2001 From: Aidan Garske Date: Wed, 7 Oct 2026 14:07:01 -0700 Subject: [PATCH 1/8] Add shared wolfCOSE CI image publisher --- .github/docker/wolfcose-ci/Dockerfile | 61 ++++++++++++++++ .../wolfcose-ci/Dockerfile.dockerignore | 10 +++ .github/docker/wolfcose-ci/README.md | 35 +++++++++ .github/docker/wolfcose-ci/smoke-test.sh | 35 +++++++++ .github/workflows/publish-ci-image.yml | 73 +++++++++++++++++++ 5 files changed, 214 insertions(+) create mode 100644 .github/docker/wolfcose-ci/Dockerfile create mode 100644 .github/docker/wolfcose-ci/Dockerfile.dockerignore create mode 100644 .github/docker/wolfcose-ci/README.md create mode 100644 .github/docker/wolfcose-ci/smoke-test.sh create mode 100644 .github/workflows/publish-ci-image.yml diff --git a/.github/docker/wolfcose-ci/Dockerfile b/.github/docker/wolfcose-ci/Dockerfile new file mode 100644 index 0000000..2792d69 --- /dev/null +++ b/.github/docker/wolfcose-ci/Dockerfile @@ -0,0 +1,61 @@ +# Shared dependencies for wolfCOSE Linux CI. Rebuild through publish-ci-image.yml. +FROM ubuntu:24.04 + +LABEL org.opencontainers.image.source="https://github.com/wolfSSL/wolfCOSE" \ + org.opencontainers.image.description="wolfCOSE Linux CI toolchains and test dependencies" \ + org.opencontainers.image.licenses="GPL-3.0-or-later" + +SHELL ["/bin/bash", "-o", "pipefail", "-c"] + +ENV DEBIAN_FRONTEND=noninteractive \ + RUSTUP_HOME=/opt/rustup \ + CARGO_HOME=/opt/cargo \ + PATH=/opt/python-cwt/bin:/opt/ci-tools/bin:/usr/local/go/bin:/opt/cargo/bin:$PATH + +# Package installation belongs here, rather than in individual CI jobs. +RUN apt-get update \ + && apt-get install -y --no-install-recommends \ + build-essential gcc-11 gcc-12 gcc-13 \ + clang clang-14 clang-15 clang-17 clang-tools clang-tidy \ + libclang-rt-18-dev cppcheck=2.13.0-2ubuntu3 \ + autoconf automake libtool libtool-bin pkg-config m4 \ + libssl-dev libffi-dev \ + lcov bc valgrind \ + git curl ca-certificates jq \ + python3 python3-dev python3-pip python3-venv \ + zip unzip xz-utils zstd file procps \ + && rm -rf /var/lib/apt/lists/* + +# Preserve the existing Go 1.24.x and stable Rust policies, resolved at image +# build time rather than downloaded in every interop job. +RUN curl --fail --silent --show-error --location \ + 'https://go.dev/dl/?mode=json&include=all' -o /tmp/go-releases.json \ + && read -r go_archive go_sha < <(jq -r \ + '[.[] | select(.stable and (.version | test("^go1\\.24\\.[0-9]+$")))] \ + | first | .files[] \ + | select(.os == "linux" and .arch == "amd64" and .kind == "archive") \ + | [.filename, .sha256] | @tsv' /tmp/go-releases.json) \ + && test -n "$go_archive" && test -n "$go_sha" \ + && curl --fail --silent --show-error --location \ + "https://go.dev/dl/$go_archive" -o /tmp/go.tar.gz \ + && echo "$go_sha /tmp/go.tar.gz" | sha256sum --check - \ + && tar -xzf /tmp/go.tar.gz -C /usr/local \ + && rm /tmp/go.tar.gz /tmp/go-releases.json + +RUN curl --fail --silent --show-error --location \ + https://sh.rustup.rs -o /tmp/rustup-init.sh \ + && sh /tmp/rustup-init.sh -y --profile minimal \ + --default-toolchain stable --no-modify-path \ + && rm /tmp/rustup-init.sh + +# Keep the pinned interop environment independent of analysis-tool dependencies. +COPY tests/interop/python_cwt/requirements.txt /tmp/python-cwt-requirements.txt +RUN python3 -m venv /opt/python-cwt \ + && /opt/python-cwt/bin/python -m pip install --no-cache-dir \ + --requirement /tmp/python-cwt-requirements.txt \ + && python3 -m venv /opt/ci-tools \ + && /opt/ci-tools/bin/python -m pip install --no-cache-dir semgrep codespell \ + && rm /tmp/python-cwt-requirements.txt + +COPY .github/docker/wolfcose-ci/smoke-test.sh /usr/local/bin/wolfcose-ci-smoke +RUN chmod +x /usr/local/bin/wolfcose-ci-smoke && wolfcose-ci-smoke diff --git a/.github/docker/wolfcose-ci/Dockerfile.dockerignore b/.github/docker/wolfcose-ci/Dockerfile.dockerignore new file mode 100644 index 0000000..f7fdea8 --- /dev/null +++ b/.github/docker/wolfcose-ci/Dockerfile.dockerignore @@ -0,0 +1,10 @@ +# Only send the image assets and pinned Python peer requirements to Docker. +** +!.github/ +!.github/docker/ +!.github/docker/wolfcose-ci/ +!.github/docker/wolfcose-ci/** +!tests/ +!tests/interop/ +!tests/interop/python_cwt/ +!tests/interop/python_cwt/requirements.txt diff --git a/.github/docker/wolfcose-ci/README.md b/.github/docker/wolfcose-ci/README.md new file mode 100644 index 0000000..556a132 --- /dev/null +++ b/.github/docker/wolfcose-ci/README.md @@ -0,0 +1,35 @@ +# wolfCOSE CI image + +Linux workflows use `ghcr.io/wolfssl/wolfcose-ci:latest`. Native macOS builds +retain their Homebrew dependencies. The image contains the C compiler matrix, +analysis and coverage tools, Go 1.24.x, stable Rust, and Python 3.12 peers. +Python interop requirements come from the existing pinned requirements file; +Semgrep and Codespell use a separate environment. + +From the repository root: + +```sh +docker build --platform linux/amd64 \ + -f .github/docker/wolfcose-ci/Dockerfile -t wolfcose-ci . +docker run --rm --platform linux/amd64 wolfcose-ci wolfcose-ci-smoke +``` + +The Dockerfile-specific ignore file restricts the build context to image assets +and Python interop requirements. Add shared dependencies here instead of +installing them in workflow jobs. Go patch releases, stable Rust, Semgrep, and +Codespell are resolved when the image is rebuilt. + +`publish-ci-image.yml` validates image changes in PRs without publishing. In +`wolfSSL/wolfCOSE`, relevant pushes to `main` and manual dispatches publish +`latest` and `sha-` tags. Publication is serialized and uses the +repository's `GITHUB_TOKEN`. The GHCR package must be public so fork PRs can +pull anonymously. + +During first-time bootstrap, the upstream `ci/ghcr-ci-image` branch also +publishes. Remove that trigger after the image is public and before merging. +Consumers should never fall back to building the image or installing packages. + +Linux wolfSSL caches use the `wolfcose-ci-v1` prefix to separate them from +previous host builds. Bump this prefix if an image change makes cached builds +incompatible. To roll back, point consumers at a previously published +`sha-` tag. diff --git a/.github/docker/wolfcose-ci/smoke-test.sh b/.github/docker/wolfcose-ci/smoke-test.sh new file mode 100644 index 0000000..882e668 --- /dev/null +++ b/.github/docker/wolfcose-ci/smoke-test.sh @@ -0,0 +1,35 @@ +#!/bin/bash +# Exercise the installed toolchains before an image is published. +set -euo pipefail + +smoke_dir=$(mktemp -d) +trap 'rm -rf "$smoke_dir"' EXIT +cat > "$smoke_dir/main.c" <<'EOF' +int main(void) +{ + return 0; +} +EOF + +for compiler in gcc gcc-11 gcc-12 gcc-13 clang clang-14 clang-15 clang-17; do + "$compiler" --version | head -n 1 + "$compiler" -std=c99 -Wall -Wextra -Werror "$smoke_dir/main.c" \ + -o "$smoke_dir/compiler-test" + "$smoke_dir/compiler-test" +done + +test "$(cppcheck --version)" = 'Cppcheck 2.13.0' +cppcheck --addon=misra --error-exitcode=1 "$smoke_dir/main.c" +for tool in autoconf automake libtool pkg-config clang-tidy scan-build \ + lcov bc valgrind git curl jq zip unzip; do + command -v "$tool" +done +pkg-config --exists openssl +go version +rustc --version +cargo --version +python -c 'import sys; assert sys.version_info[:2] == (3, 12); import cbor2, cwt, cryptography, pyhpke' +python -m pip check +/opt/ci-tools/bin/python -m pip check +semgrep --version +codespell --version diff --git a/.github/workflows/publish-ci-image.yml b/.github/workflows/publish-ci-image.yml new file mode 100644 index 0000000..480e578 --- /dev/null +++ b/.github/workflows/publish-ci-image.yml @@ -0,0 +1,73 @@ +name: Publish CI image + +on: + push: + # The CI branch bootstraps GHCR before this workflow reaches main. + branches: [main, ci/ghcr-ci-image] + paths: + - '.github/docker/wolfcose-ci/**' + - '.github/workflows/publish-ci-image.yml' + - 'tests/interop/python_cwt/requirements.txt' + pull_request: + paths: + - '.github/docker/wolfcose-ci/**' + - '.github/workflows/publish-ci-image.yml' + - 'tests/interop/python_cwt/requirements.txt' + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: ${{ github.event_name == 'pull_request' && format('ci-image-pr-{0}', github.event.pull_request.number) || 'publish-ci-image' }} + cancel-in-progress: false + +jobs: + validate: + name: Build CI image + if: github.event_name == 'pull_request' + runs-on: ubuntu-latest + timeout-minutes: 45 + steps: + - uses: actions/checkout@v4 + - uses: docker/setup-buildx-action@v3 + - name: Build and smoke-test image + uses: docker/build-push-action@v6 + with: + context: . + file: .github/docker/wolfcose-ci/Dockerfile + platforms: linux/amd64 + pull: true + push: false + cache-from: type=registry,ref=ghcr.io/wolfssl/wolfcose-ci:latest + + publish: + name: Publish CI image + if: github.repository == 'wolfSSL/wolfCOSE' && github.event_name != 'pull_request' + runs-on: ubuntu-latest + timeout-minutes: 45 + permissions: + contents: read + packages: write + steps: + - uses: actions/checkout@v4 + - uses: docker/setup-buildx-action@v3 + - uses: docker/login-action@v3 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + - name: Build, smoke-test, and push image + uses: docker/build-push-action@v6 + with: + context: . + file: .github/docker/wolfcose-ci/Dockerfile + platforms: linux/amd64 + pull: true + push: true + tags: | + ghcr.io/wolfssl/wolfcose-ci:latest + ghcr.io/wolfssl/wolfcose-ci:sha-${{ github.sha }} + labels: org.opencontainers.image.revision=${{ github.sha }} + cache-from: type=registry,ref=ghcr.io/wolfssl/wolfcose-ci:latest + cache-to: type=inline From fb446d8d31c307fc0789e1125e050621fff1f124 Mon Sep 17 00:00:00 2001 From: Aidan Garske Date: Wed, 7 Oct 2026 14:18:17 -0700 Subject: [PATCH 2/8] Run Linux CI in the shared wolfCOSE container --- .github/workflows/_resolve-wolfssl.yml | 6 +++ .github/workflows/build-test.yml | 47 ++++++++++------------- .github/workflows/c99-compliance.yml | 15 ++++---- .github/workflows/cmdline-test.yml | 13 ++++--- .github/workflows/codeql.yml | 13 ++++--- .github/workflows/codespell.yml | 18 +++++---- .github/workflows/comprehensive-tests.yml | 15 ++++---- .github/workflows/cose-hpke.yml | 13 ++++--- .github/workflows/coverage.yml | 15 ++++---- .github/workflows/coverity.yml | 13 ++++--- .github/workflows/empty-brace-scan.yml | 8 +++- .github/workflows/examples.yml | 15 ++++---- .github/workflows/house-style.yml | 8 +++- .github/workflows/interop.yml | 40 +++++++------------ .github/workflows/lean-build.yml | 33 +++++++--------- .github/workflows/minimal-build.yml | 15 ++++---- .github/workflows/misra-2012.yml | 14 ++++--- .github/workflows/misra-2023.yml | 24 ++++++------ .github/workflows/multi-compiler.yml | 15 ++++---- .github/workflows/nightly.yml | 6 +++ .github/workflows/release-prep.yml | 20 ++++++---- .github/workflows/sanitizer.yml | 15 ++++---- .github/workflows/scenarios.yml | 15 ++++---- .github/workflows/semgrep.yml | 15 ++++---- .github/workflows/stack-bounds.yml | 24 ++++++------ .github/workflows/static-analysis.yml | 33 +++++++--------- .github/workflows/wiki-sync.yml | 6 +++ .github/workflows/wolfssl-versions.yml | 17 ++++---- 28 files changed, 259 insertions(+), 232 deletions(-) diff --git a/.github/workflows/_resolve-wolfssl.yml b/.github/workflows/_resolve-wolfssl.yml index 36a9d56..6b86d72 100644 --- a/.github/workflows/_resolve-wolfssl.yml +++ b/.github/workflows/_resolve-wolfssl.yml @@ -19,10 +19,16 @@ on: permissions: contents: read +defaults: + run: + shell: bash -e {0} + jobs: resolve: name: Resolve wolfSSL version matrix runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest outputs: matrix: ${{ steps.set-matrix.outputs.matrix }} refs: ${{ steps.set-matrix.outputs.refs }} diff --git a/.github/workflows/build-test.yml b/.github/workflows/build-test.yml index 46e308c..2e7f5fd 100644 --- a/.github/workflows/build-test.yml +++ b/.github/workflows/build-test.yml @@ -2,7 +2,7 @@ name: Build and Test on: push: - branches: [ 'main', 'release/**' ] + branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] pull_request: branches: [ '*' ] workflow_dispatch: @@ -11,6 +11,10 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +defaults: + run: + shell: bash -e {0} + jobs: discover: uses: ./.github/workflows/_resolve-wolfssl.yml @@ -19,21 +23,21 @@ jobs: name: ${{ matrix.os }} (wolfSSL ${{ matrix.wolfssl-ref }}) needs: discover runs-on: ${{ matrix.os }} + container: ${{ matrix.container }} strategy: fail-fast: false matrix: - os: [ubuntu-latest, ubuntu-22.04, macos-latest] + os: [ubuntu-latest, macos-latest] wolfssl-ref: ${{ fromJson(needs.discover.outputs.refs) }} + include: + - os: ubuntu-latest + container: ghcr.io/wolfssl/wolfcose-ci:latest + - os: macos-latest + container: '' steps: - uses: actions/checkout@v4 - - name: Install dependencies (Linux) - if: runner.os == 'Linux' - run: | - sudo apt-get update - sudo apt-get install -y autoconf automake libtool - - name: Install dependencies (macOS) if: runner.os == 'macOS' run: brew install autoconf automake libtool @@ -44,7 +48,7 @@ jobs: uses: actions/cache@v4 with: path: ~/wolfssl-install - key: wolfssl-${{ matrix.os }}-${{ matrix.wolfssl-ref }}-v5-lms + key: ${{ runner.os == 'Linux' && 'wolfcose-ci-v1-' || '' }}wolfssl-${{ matrix.os }}-${{ matrix.wolfssl-ref }}-v5-lms - name: Build wolfSSL (${{ matrix.wolfssl-ref }}) if: matrix.wolfssl-ref == 'master' || steps.cache-wolfssl.outputs.cache-hit != 'true' @@ -208,6 +212,8 @@ jobs: name: LMS lean profiles (wolfSSL ${{ matrix.wolfssl-ref }}) needs: discover runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest strategy: fail-fast: false matrix: @@ -216,18 +222,13 @@ jobs: steps: - uses: actions/checkout@v4 - - name: Install dependencies - run: | - sudo apt-get update - sudo apt-get install -y autoconf automake libtool - - name: Cache wolfSSL (${{ matrix.wolfssl-ref }}) if: matrix.wolfssl-ref != 'master' id: cache-wolfssl uses: actions/cache@v4 with: path: ~/wolfssl-install - key: wolfssl-ubuntu-latest-${{ matrix.wolfssl-ref }}-v5-lms + key: wolfcose-ci-v1-wolfssl-ubuntu-latest-${{ matrix.wolfssl-ref }}-v5-lms - name: Build wolfSSL (${{ matrix.wolfssl-ref }}) if: matrix.wolfssl-ref == 'master' || steps.cache-wolfssl.outputs.cache-hit != 'true' @@ -282,15 +283,12 @@ jobs: lms-verify-only: name: LMS verify-only wolfSSL profile runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest steps: - uses: actions/checkout@v4 - - name: Install dependencies - run: | - sudo apt-get update - sudo apt-get install -y autoconf automake libtool - # Build wolfSSL with LMS support that cannot sign, mirroring a verifier # deployment. --enable-lms=verify-only records WOLFSSL_LMS_VERIFY_ONLY in # options.h, which wolfCOSE reads to compile out its own signing paths. @@ -342,6 +340,8 @@ jobs: name: Code Coverage (wolfSSL ${{ matrix.wolfssl-version }}) needs: discover runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest strategy: fail-fast: false matrix: ${{ fromJson(needs.discover.outputs.matrix) }} @@ -349,18 +349,13 @@ jobs: steps: - uses: actions/checkout@v4 - - name: Install dependencies - run: | - sudo apt-get update - sudo apt-get install -y autoconf automake libtool lcov - - name: Cache wolfSSL (${{ matrix.wolfssl-version }}) if: matrix.wolfssl-version != 'master' id: cache-wolfssl uses: actions/cache@v4 with: path: ~/wolfssl-install - key: wolfssl-coverage-${{ matrix.wolfssl-version }}-v5-lms + key: wolfcose-ci-v1-wolfssl-coverage-${{ matrix.wolfssl-version }}-v5-lms - name: Build wolfSSL (${{ matrix.wolfssl-version }}) if: matrix.wolfssl-version == 'master' || steps.cache-wolfssl.outputs.cache-hit != 'true' diff --git a/.github/workflows/c99-compliance.yml b/.github/workflows/c99-compliance.yml index 9afa262..9135e73 100644 --- a/.github/workflows/c99-compliance.yml +++ b/.github/workflows/c99-compliance.yml @@ -2,7 +2,7 @@ name: C99 Compliance on: push: - branches: [ 'main', 'release/**' ] + branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] pull_request: branches: [ '*' ] workflow_dispatch: @@ -11,10 +11,16 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +defaults: + run: + shell: bash -e {0} + jobs: c99-check: name: ISO C99 conformance (${{ matrix.cc }}) runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest strategy: fail-fast: false matrix: @@ -23,11 +29,6 @@ jobs: steps: - uses: actions/checkout@v4 - - name: Install dependencies - run: | - sudo apt-get update - sudo apt-get install -y autoconf automake libtool - - name: Resolve wolfSSL master commit id: wolfssl-rev run: echo "sha=$(git ls-remote https://github.com/wolfSSL/wolfssl.git HEAD | cut -f1)" >> "$GITHUB_OUTPUT" @@ -36,7 +37,7 @@ jobs: uses: actions/cache@v4 with: path: ~/wolfssl-install - key: wolfssl-ubuntu-latest-v3-full-${{ steps.wolfssl-rev.outputs.sha }} + key: wolfcose-ci-v1-wolfssl-ubuntu-latest-v3-full-${{ steps.wolfssl-rev.outputs.sha }} - name: Build wolfSSL if: steps.cache-wolfssl.outputs.cache-hit != 'true' diff --git a/.github/workflows/cmdline-test.yml b/.github/workflows/cmdline-test.yml index 64f39aa..d08e1b6 100644 --- a/.github/workflows/cmdline-test.yml +++ b/.github/workflows/cmdline-test.yml @@ -11,6 +11,10 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +defaults: + run: + shell: bash -e {0} + jobs: discover: uses: ./.github/workflows/_resolve-wolfssl.yml @@ -19,6 +23,8 @@ jobs: name: Command-line tool (wolfSSL ${{ matrix.wolfssl-version }}) needs: discover runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest strategy: fail-fast: false matrix: ${{ fromJson(needs.discover.outputs.matrix) }} @@ -26,18 +32,13 @@ jobs: steps: - uses: actions/checkout@v4 - - name: Install dependencies - run: | - sudo apt-get update - sudo apt-get install -y autoconf automake libtool - - name: Cache wolfSSL (${{ matrix.wolfssl-version }}) if: matrix.wolfssl-version != 'master' id: cache-wolfssl uses: actions/cache@v4 with: path: ~/wolfssl-install - key: wolfssl-clitest-${{ matrix.wolfssl-version }}-v3 + key: wolfcose-ci-v1-wolfssl-clitest-${{ matrix.wolfssl-version }}-v3 - name: Build wolfSSL (${{ matrix.wolfssl-version }}) if: matrix.wolfssl-version == 'master' || steps.cache-wolfssl.outputs.cache-hit != 'true' diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 0c8ebf3..3026e98 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -2,7 +2,7 @@ name: CodeQL on: push: - branches: [ 'main', 'release/**' ] + branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] pull_request: branches: [ '*' ] schedule: @@ -17,19 +17,20 @@ permissions: # Required so CodeQL can upload findings to the Security tab. security-events: write +defaults: + run: + shell: bash -e {0} + jobs: analyze: name: CodeQL (C, security) runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest timeout-minutes: 30 steps: - uses: actions/checkout@v4 - - name: Install dependencies - run: | - sudo apt-get update - sudo apt-get install -y autoconf automake libtool - # Full-feature wolfSSL so every wolfCOSE code path is compiled and # therefore visible to CodeQL. - name: Build wolfSSL diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml index 1855d6c..6601f2d 100644 --- a/.github/workflows/codespell.yml +++ b/.github/workflows/codespell.yml @@ -2,7 +2,7 @@ name: Codespell on: push: - branches: [ 'main', 'release/**' ] + branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] pull_request: branches: [ '*' ] workflow_dispatch: @@ -11,18 +11,22 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +defaults: + run: + shell: bash -e {0} + jobs: codespell: name: Check for spelling errors runs-on: ubuntu-22.04 + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest timeout-minutes: 5 steps: - uses: actions/checkout@v4 - name: Run codespell - uses: codespell-project/actions-codespell@v2.1 - with: - check_filenames: true - check_hidden: true - ignore_words_list: adin,aNULL,cLen,dout,haveA,inOut,inout,parm,parms,ser,siz,te,Te,bstr,tstr,uint - skip: '.git' + run: | + codespell --check-filenames --check-hidden \ + --ignore-words-list='adin,aNULL,cLen,dout,haveA,inOut,inout,parm,parms,ser,siz,te,Te,bstr,tstr,uint' \ + --skip='.git' . diff --git a/.github/workflows/comprehensive-tests.yml b/.github/workflows/comprehensive-tests.yml index 42b28af..89b007b 100644 --- a/.github/workflows/comprehensive-tests.yml +++ b/.github/workflows/comprehensive-tests.yml @@ -2,7 +2,7 @@ name: Comprehensive Tests on: push: - branches: [ 'main', 'release/**' ] + branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] pull_request: branches: [ '*' ] workflow_dispatch: @@ -11,6 +11,10 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +defaults: + run: + shell: bash -e {0} + jobs: discover: uses: ./.github/workflows/_resolve-wolfssl.yml @@ -19,6 +23,8 @@ jobs: name: Algorithm Matrix Tests (wolfSSL ${{ matrix.wolfssl-version }}) needs: discover runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest strategy: fail-fast: false matrix: ${{ fromJson(needs.discover.outputs.matrix) }} @@ -26,18 +32,13 @@ jobs: steps: - uses: actions/checkout@v4 - - name: Install dependencies - run: | - sudo apt-get update - sudo apt-get install -y autoconf automake libtool - - name: Cache wolfSSL (${{ matrix.wolfssl-version }}) if: matrix.wolfssl-version != 'master' id: cache-wolfssl uses: actions/cache@v4 with: path: ~/wolfssl-install - key: wolfssl-comprehensive-${{ matrix.wolfssl-version }}-v1 + key: wolfcose-ci-v1-wolfssl-comprehensive-${{ matrix.wolfssl-version }}-v1 - name: Build wolfSSL (${{ matrix.wolfssl-version }}) if: matrix.wolfssl-version == 'master' || steps.cache-wolfssl.outputs.cache-hit != 'true' diff --git a/.github/workflows/cose-hpke.yml b/.github/workflows/cose-hpke.yml index 922324d..bde5ed4 100644 --- a/.github/workflows/cose-hpke.yml +++ b/.github/workflows/cose-hpke.yml @@ -2,7 +2,7 @@ name: Experimental COSE-HPKE on: push: - branches: [ 'main', 'release/**' ] + branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] pull_request: branches: [ '**' ] workflow_dispatch: @@ -14,6 +14,10 @@ concurrency: permissions: contents: read +defaults: + run: + shell: bash -e {0} + jobs: discover: uses: ./.github/workflows/_resolve-wolfssl.yml @@ -22,6 +26,8 @@ jobs: name: HPKE P0 (${{ matrix.wolfssl-ref }}) needs: discover runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest strategy: fail-fast: false matrix: @@ -30,11 +36,6 @@ jobs: steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 - - name: Install dependencies - run: | - sudo apt-get update - sudo apt-get install -y autoconf automake libtool - - name: Build HPKE-enabled wolfSSL run: | git clone --depth 1 --branch "${{ matrix.wolfssl-ref }}" \ diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index 414ed05..47b9c2c 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -2,7 +2,7 @@ name: Code Coverage on: push: - branches: [ 'main', 'release/**' ] + branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] pull_request: branches: [ '*' ] workflow_dispatch: @@ -11,18 +11,19 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +defaults: + run: + shell: bash -e {0} + jobs: coverage: name: Line Coverage runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest steps: - uses: actions/checkout@v4 - - name: Install dependencies - run: | - sudo apt-get update - sudo apt-get install -y autoconf automake libtool lcov - - name: Resolve wolfSSL master commit id: wolfssl-rev run: echo "sha=$(git ls-remote https://github.com/wolfSSL/wolfssl.git HEAD | cut -f1)" >> "$GITHUB_OUTPUT" @@ -35,7 +36,7 @@ jobs: # ubuntu-latest key but configure wolfSSL without aeskeywrap, and a # cache hit on such a build silently skips the KEY_WRAP tests. The # -lms suffix distinguishes the LMS-enabled coverage build. - key: wolfssl-coverage-fullcfg-lms-v1-${{ steps.wolfssl-rev.outputs.sha }} + key: wolfcose-ci-v1-wolfssl-coverage-fullcfg-lms-v1-${{ steps.wolfssl-rev.outputs.sha }} - name: Build wolfSSL if: steps.cache-wolfssl.outputs.cache-hit != 'true' diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index 7eecd5a..41b3b56 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -9,10 +9,16 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +defaults: + run: + shell: bash -e {0} + jobs: coverity: name: Coverity Scan runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest # Only run from the original repo, not forks if: github.repository == 'wolfSSL/wolfCOSE' @@ -20,11 +26,6 @@ jobs: steps: - uses: actions/checkout@v4 - - name: Install dependencies - run: | - sudo apt-get update - sudo apt-get install -y autoconf automake libtool - - name: Resolve wolfSSL master commit id: wolfssl-rev run: echo "sha=$(git ls-remote https://github.com/wolfSSL/wolfssl.git HEAD | cut -f1)" >> "$GITHUB_OUTPUT" @@ -33,7 +34,7 @@ jobs: uses: actions/cache@v4 with: path: ~/wolfssl-install - key: wolfssl-coverity-v4-lms-${{ steps.wolfssl-rev.outputs.sha }} + key: wolfcose-ci-v1-wolfssl-coverity-v4-lms-${{ steps.wolfssl-rev.outputs.sha }} - name: Build wolfSSL (latest stable + master, PQC-gated) if: steps.cache-wolfssl.outputs.cache-hit != 'true' diff --git a/.github/workflows/empty-brace-scan.yml b/.github/workflows/empty-brace-scan.yml index 9ce5d2b..39b83a7 100644 --- a/.github/workflows/empty-brace-scan.yml +++ b/.github/workflows/empty-brace-scan.yml @@ -2,7 +2,7 @@ name: Empty Brace Scope Scan on: push: - branches: [ 'main', 'release/**' ] + branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] pull_request: branches: [ '*' ] workflow_dispatch: @@ -11,10 +11,16 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +defaults: + run: + shell: bash -e {0} + jobs: empty-brace-scan: name: Empty Brace Scope Scan runs-on: ubuntu-22.04 + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest timeout-minutes: 5 steps: - uses: actions/checkout@v4 diff --git a/.github/workflows/examples.yml b/.github/workflows/examples.yml index 4b85a06..da41cca 100644 --- a/.github/workflows/examples.yml +++ b/.github/workflows/examples.yml @@ -2,7 +2,7 @@ name: Examples on: push: - branches: [ 'main', 'release/**' ] + branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] pull_request: branches: [ '*' ] workflow_dispatch: @@ -11,6 +11,10 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +defaults: + run: + shell: bash -e {0} + jobs: discover: uses: ./.github/workflows/_resolve-wolfssl.yml @@ -19,6 +23,8 @@ jobs: name: Examples (wolfSSL ${{ matrix.wolfssl-version }}) needs: discover runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest strategy: fail-fast: false matrix: ${{ fromJson(needs.discover.outputs.matrix) }} @@ -26,18 +32,13 @@ jobs: steps: - uses: actions/checkout@v4 - - name: Install dependencies - run: | - sudo apt-get update - sudo apt-get install -y autoconf automake libtool - - name: Cache wolfSSL (${{ matrix.wolfssl-version }}) if: matrix.wolfssl-version != 'master' id: cache-wolfssl uses: actions/cache@v4 with: path: ~/wolfssl-install - key: wolfssl-examples-${{ matrix.wolfssl-version }}-v1 + key: wolfcose-ci-v1-wolfssl-examples-${{ matrix.wolfssl-version }}-v1 - name: Build wolfSSL (${{ matrix.wolfssl-version }}) if: matrix.wolfssl-version == 'master' || steps.cache-wolfssl.outputs.cache-hit != 'true' diff --git a/.github/workflows/house-style.yml b/.github/workflows/house-style.yml index 5d77bf7..f182944 100644 --- a/.github/workflows/house-style.yml +++ b/.github/workflows/house-style.yml @@ -2,7 +2,7 @@ name: House Style on: push: - branches: [ 'main', 'release/**' ] + branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] pull_request: branches: [ '*' ] workflow_dispatch: @@ -14,10 +14,16 @@ concurrency: permissions: contents: read +defaults: + run: + shell: bash -e {0} + jobs: house-style: name: wolfCOSE house-style conventions runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest timeout-minutes: 5 steps: - uses: actions/checkout@v4 diff --git a/.github/workflows/interop.yml b/.github/workflows/interop.yml index 2790da9..2841990 100644 --- a/.github/workflows/interop.yml +++ b/.github/workflows/interop.yml @@ -2,7 +2,7 @@ name: Interop on: push: - branches: [ 'main', 'release/**' ] + branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] pull_request: branches: [ '**' ] workflow_dispatch: @@ -18,6 +18,10 @@ env: TCOSE_SHA: ff4c5f7c6fbbe27bb582214ff1878bf58ebc6c43 QCBOR_SHA: 930708bb86481e88879eb1d87fd4d664f1d69503 +defaults: + run: + shell: bash -e {0} + jobs: discover: uses: ./.github/workflows/_resolve-wolfssl.yml @@ -26,6 +30,8 @@ jobs: name: COSE and PSA/EAT interoperability (OpenSSL, wolfSSL ${{ matrix.wolfssl-version }}) needs: discover runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest # All external peers share this job and its wolfSSL build. Keeping them # together avoids repeating the matrix setup for short interop commands. strategy: @@ -35,31 +41,13 @@ jobs: steps: - uses: actions/checkout@v4 - - name: Set up Go for go-cose interop - uses: actions/setup-go@v5 - with: - go-version: '1.24.x' - cache-dependency-path: tests/interop/go_cose/go.sum - - - name: Set up Python for python-cwt interop - uses: actions/setup-python@v5 + - name: Cache Go interop dependencies + uses: actions/cache@v4 with: - python-version: '3.12' - cache: pip - cache-dependency-path: tests/interop/python_cwt/requirements.txt - - - name: Set up Rust for coset interop - uses: dtolnay/rust-toolchain@stable - - - name: Install dependencies - run: | - sudo apt-get update - sudo apt-get install -y autoconf automake libtool libssl-dev - - - name: Install python-cwt peer - run: | - python -m pip install --disable-pip-version-check \ - --requirement tests/interop/python_cwt/requirements.txt + path: | + ~/go/pkg/mod + ~/.cache/go-build + key: wolfcose-ci-v1-go1.24-${{ hashFiles('tests/interop/go_cose/go.sum') }} - name: Cache wolfSSL (${{ matrix.wolfssl-version }}) if: matrix.wolfssl-version != 'master' @@ -67,7 +55,7 @@ jobs: uses: actions/cache@v4 with: path: ~/wolfssl-install - key: wolfssl-interop-${{ matrix.wolfssl-version }}-v1 + key: wolfcose-ci-v1-wolfssl-interop-${{ matrix.wolfssl-version }}-v1 - name: Build wolfSSL (${{ matrix.wolfssl-version }}) if: matrix.wolfssl-version == 'master' || steps.cache-wolfssl.outputs.cache-hit != 'true' diff --git a/.github/workflows/lean-build.yml b/.github/workflows/lean-build.yml index c1f4a00..614c26b 100644 --- a/.github/workflows/lean-build.yml +++ b/.github/workflows/lean-build.yml @@ -2,7 +2,7 @@ name: Lean Build on: push: - branches: [ 'main', 'release/**' ] + branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] pull_request: branches: [ '*' ] workflow_dispatch: @@ -11,19 +11,20 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +defaults: + run: + shell: bash -e {0} + jobs: lean-verify: name: Lean verify-only (WOLFCOSE_LEAN_VERIFY) runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest steps: - uses: actions/checkout@v4 - - name: Install dependencies - run: | - sudo apt-get update - sudo apt-get install -y autoconf automake libtool - - name: Resolve wolfSSL master commit id: wolfssl-rev run: echo "sha=$(git ls-remote https://github.com/wolfSSL/wolfssl.git HEAD | cut -f1)" >> "$GITHUB_OUTPUT" @@ -33,7 +34,7 @@ jobs: uses: actions/cache@v4 with: path: ~/wolfssl-lean - key: wolfssl-lean-tfm-verifyonly-v3-${{ steps.wolfssl-rev.outputs.sha }} + key: wolfcose-ci-v1-wolfssl-lean-tfm-verifyonly-v3-${{ steps.wolfssl-rev.outputs.sha }} # Verify-only full-#tfm backend: NO_ECC_SIGN compiles ECDSA signing out. # This catches a verification path that accidentally pulls in a signing @@ -105,15 +106,12 @@ jobs: lean-compile-matrix: name: Lean configs compile clean (strict) runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest steps: - uses: actions/checkout@v4 - - name: Install dependencies - run: | - sudo apt-get update - sudo apt-get install -y autoconf automake libtool - - name: Resolve wolfSSL master commit id: wolfssl-rev run: echo "sha=$(git ls-remote https://github.com/wolfSSL/wolfssl.git HEAD | cut -f1)" >> "$GITHUB_OUTPUT" @@ -123,7 +121,7 @@ jobs: uses: actions/cache@v4 with: path: ~/wolfssl-install - key: wolfssl-ubuntu-latest-v3-${{ steps.wolfssl-rev.outputs.sha }} + key: wolfcose-ci-v1-wolfssl-ubuntu-latest-v3-${{ steps.wolfssl-rev.outputs.sha }} - name: Build wolfSSL (full features) if: steps.cache-wolfssl.outputs.cache-hit != 'true' @@ -196,15 +194,12 @@ jobs: mldsa: name: Post-quantum ML-DSA lean sign+verify and verify-only runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest steps: - uses: actions/checkout@v4 - - name: Install dependencies - run: | - sudo apt-get update - sudo apt-get install -y autoconf automake libtool - - name: Resolve wolfSSL master commit id: wolfssl-rev run: echo "sha=$(git ls-remote https://github.com/wolfSSL/wolfssl.git HEAD | cut -f1)" >> "$GITHUB_OUTPUT" @@ -214,7 +209,7 @@ jobs: uses: actions/cache@v4 with: path: ~/wolfssl-mldsa - key: wolfssl-mldsa-v1-${{ steps.wolfssl-rev.outputs.sha }} + key: wolfcose-ci-v1-wolfssl-mldsa-v1-${{ steps.wolfssl-rev.outputs.sha }} # ML-DSA (FIPS 204) backend. Dilithium pulls in SHAKE/SHA-3; RNG stays for # key generation and signing in the sign+verify demo. diff --git a/.github/workflows/minimal-build.yml b/.github/workflows/minimal-build.yml index dd4977c..f51a677 100644 --- a/.github/workflows/minimal-build.yml +++ b/.github/workflows/minimal-build.yml @@ -2,7 +2,7 @@ name: Minimal Build on: push: - branches: [ 'main', 'release/**' ] + branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] pull_request: branches: [ '*' ] workflow_dispatch: @@ -11,10 +11,16 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +defaults: + run: + shell: bash -e {0} + jobs: minimal: name: ${{ matrix.name }} runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest strategy: fail-fast: false matrix: @@ -73,11 +79,6 @@ jobs: steps: - uses: actions/checkout@v4 - - name: Install dependencies - run: | - sudo apt-get update - sudo apt-get install -y autoconf automake libtool - - name: Resolve wolfSSL master commit id: wolfssl-rev run: echo "sha=$(git ls-remote https://github.com/wolfSSL/wolfssl.git HEAD | cut -f1)" >> "$GITHUB_OUTPUT" @@ -87,7 +88,7 @@ jobs: uses: actions/cache@v4 with: path: ~/wolfssl-minimal - key: ${{ matrix.cache_key }}-${{ steps.wolfssl-rev.outputs.sha }} + key: wolfcose-ci-v1-${{ matrix.cache_key }}-${{ steps.wolfssl-rev.outputs.sha }} - name: Build wolfSSL (${{ matrix.name }}) if: steps.cache-wolfssl.outputs.cache-hit != 'true' diff --git a/.github/workflows/misra-2012.yml b/.github/workflows/misra-2012.yml index 398b60c..db6e3d0 100644 --- a/.github/workflows/misra-2012.yml +++ b/.github/workflows/misra-2012.yml @@ -5,7 +5,7 @@ name: MISRA C 2012 on: push: - branches: [ 'main', 'release/**' ] + branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] pull_request: branches: [ '*' ] workflow_dispatch: @@ -14,10 +14,16 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +defaults: + run: + shell: bash -e {0} + jobs: misra-cppcheck: name: MISRA C 2012 (cppcheck) runs-on: ubuntu-24.04 + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest env: WOLFSSL_REF: ac01707f552c611fbd135cc723b2682b3e7f80f2 @@ -28,10 +34,8 @@ jobs: steps: - uses: actions/checkout@v4 - - name: Install cppcheck + - name: Check cppcheck version run: | - sudo apt-get update - sudo apt-get install -y cppcheck autoconf automake libtool CPPCHECK_VERSION=$(cppcheck --version) if [ "$CPPCHECK_VERSION" != "Cppcheck 2.13.0" ]; then echo "::error::expected Cppcheck 2.13.0, got $CPPCHECK_VERSION" @@ -43,7 +47,7 @@ jobs: uses: actions/cache@v4 with: path: ~/wolfssl-install - key: wolfssl-ubuntu-24.04-v6-lms-hpke-${{ env.WOLFSSL_REF }} + key: wolfcose-ci-v1-wolfssl-ubuntu-24.04-v6-lms-hpke-${{ env.WOLFSSL_REF }} - name: Build wolfSSL if: steps.cache-wolfssl.outputs.cache-hit != 'true' diff --git a/.github/workflows/misra-2023.yml b/.github/workflows/misra-2023.yml index 2df20b8..3724f2a 100644 --- a/.github/workflows/misra-2023.yml +++ b/.github/workflows/misra-2023.yml @@ -6,7 +6,7 @@ name: MISRA C 2023 Compliance on: push: - branches: [ 'main', 'release/**' ] + branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] pull_request: branches: [ '*' ] workflow_dispatch: @@ -15,6 +15,10 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +defaults: + run: + shell: bash -e {0} + jobs: # --------------------------------------------------------------------------- # Job 1: Strict compiler warnings for MISRA C 2023 essential type & @@ -23,15 +27,12 @@ jobs: misra-compiler-warnings: name: MISRA C 2023 Compiler Warnings runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest steps: - uses: actions/checkout@v4 - - name: Install dependencies - run: | - sudo apt-get update - sudo apt-get install -y autoconf automake libtool - - name: Resolve wolfSSL master commit id: wolfssl-rev run: echo "sha=$(git ls-remote https://github.com/wolfSSL/wolfssl.git HEAD | cut -f1)" >> "$GITHUB_OUTPUT" @@ -40,7 +41,7 @@ jobs: uses: actions/cache@v4 with: path: ~/wolfssl-install - key: wolfssl-ubuntu-latest-v4-lms-${{ steps.wolfssl-rev.outputs.sha }} + key: wolfcose-ci-v1-wolfssl-ubuntu-latest-v4-lms-${{ steps.wolfssl-rev.outputs.sha }} - name: Build wolfSSL if: steps.cache-wolfssl.outputs.cache-hit != 'true' @@ -162,15 +163,12 @@ jobs: misra-clang-tidy: name: MISRA C 2023 (clang-tidy) runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest steps: - uses: actions/checkout@v4 - - name: Install dependencies - run: | - sudo apt-get update - sudo apt-get install -y clang-tidy autoconf automake libtool - - name: Resolve wolfSSL master commit id: wolfssl-rev run: echo "sha=$(git ls-remote https://github.com/wolfSSL/wolfssl.git HEAD | cut -f1)" >> "$GITHUB_OUTPUT" @@ -179,7 +177,7 @@ jobs: uses: actions/cache@v4 with: path: ~/wolfssl-install - key: wolfssl-ubuntu-latest-v4-lms-${{ steps.wolfssl-rev.outputs.sha }} + key: wolfcose-ci-v1-wolfssl-ubuntu-latest-v4-lms-${{ steps.wolfssl-rev.outputs.sha }} - name: Build wolfSSL if: steps.cache-wolfssl.outputs.cache-hit != 'true' diff --git a/.github/workflows/multi-compiler.yml b/.github/workflows/multi-compiler.yml index 6bcfa43..7881eb7 100644 --- a/.github/workflows/multi-compiler.yml +++ b/.github/workflows/multi-compiler.yml @@ -2,7 +2,7 @@ name: Multi-Compiler on: push: - branches: [ 'main', 'release/**' ] + branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] pull_request: branches: [ '*' ] workflow_dispatch: @@ -11,6 +11,10 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +defaults: + run: + shell: bash -e {0} + jobs: discover: uses: ./.github/workflows/_resolve-wolfssl.yml @@ -19,6 +23,8 @@ jobs: name: ${{ matrix.cc }} (wolfSSL ${{ matrix.wolfssl-ref }}) needs: discover runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest strategy: fail-fast: false matrix: @@ -28,18 +34,13 @@ jobs: steps: - uses: actions/checkout@v4 - - name: Install compiler - run: | - sudo apt-get update - sudo apt-get install -y autoconf automake libtool ${{ matrix.cc }} - - name: Cache wolfSSL (${{ matrix.wolfssl-ref }}) if: matrix.wolfssl-ref != 'master' id: cache-wolfssl uses: actions/cache@v4 with: path: ~/wolfssl-install - key: wolfssl-multicompiler-${{ matrix.wolfssl-ref }}-v1 + key: wolfcose-ci-v1-wolfssl-multicompiler-${{ matrix.wolfssl-ref }}-v1 - name: Build wolfSSL (${{ matrix.wolfssl-ref }}) if: matrix.wolfssl-ref == 'master' || steps.cache-wolfssl.outputs.cache-hit != 'true' diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index c0e8dbb..893721d 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -10,10 +10,16 @@ permissions: actions: write issues: write +defaults: + run: + shell: bash -e {0} + jobs: trigger: name: Trigger All CI Workflows runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest if: github.repository == 'wolfSSL/wolfCOSE' steps: diff --git a/.github/workflows/release-prep.yml b/.github/workflows/release-prep.yml index 8dadf91..b0994be 100644 --- a/.github/workflows/release-prep.yml +++ b/.github/workflows/release-prep.yml @@ -20,6 +20,10 @@ permissions: checks: read pull-requests: read +defaults: + run: + shell: bash -e {0} + jobs: metadata: name: Release metadata @@ -27,6 +31,8 @@ jobs: github.event_name == 'workflow_dispatch' || github.event.label.name == 'ci:release' runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest outputs: version: ${{ steps.release.outputs.version }} commit: ${{ steps.release.outputs.commit }} @@ -68,6 +74,8 @@ jobs: name: Release-specific qualification needs: metadata runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest timeout-minutes: 120 steps: - uses: actions/checkout@v4 @@ -75,12 +83,6 @@ jobs: fetch-depth: 0 ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} - - name: Install dependencies - run: | - sudo apt-get update - sudo apt-get install -y autoconf automake g++ lcov libtool \ - unzip valgrind zip - - name: Resolve wolfSSL master commit id: wolfssl run: | @@ -91,7 +93,7 @@ jobs: uses: actions/cache@v4 with: path: ~/wolfssl-release - key: wolfssl-release-full-v1-${{ steps.wolfssl.outputs.commit }} + key: wolfcose-ci-v1-wolfssl-release-full-v1-${{ steps.wolfssl.outputs.commit }} - name: Build full wolfSSL backend if: steps.cache-wolfssl.outputs.cache-hit != 'true' @@ -232,6 +234,8 @@ jobs: name: Required CI for candidate SHA needs: metadata runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest timeout-minutes: 125 steps: - name: Wait for required workflows @@ -338,6 +342,8 @@ jobs: github.event.label.name == 'ci:release') needs: [metadata, qualify, required-ci] runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest steps: - name: Enforce all release gates env: diff --git a/.github/workflows/sanitizer.yml b/.github/workflows/sanitizer.yml index 52cb363..740a354 100644 --- a/.github/workflows/sanitizer.yml +++ b/.github/workflows/sanitizer.yml @@ -2,7 +2,7 @@ name: Sanitizers on: push: - branches: [ 'main', 'release/**' ] + branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] pull_request: branches: [ '*' ] workflow_dispatch: @@ -11,6 +11,10 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +defaults: + run: + shell: bash -e {0} + jobs: discover: uses: ./.github/workflows/_resolve-wolfssl.yml @@ -19,6 +23,8 @@ jobs: name: AddressSanitizer (wolfSSL ${{ matrix.wolfssl-version }}) needs: discover runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest strategy: fail-fast: false matrix: ${{ fromJson(needs.discover.outputs.matrix) }} @@ -26,18 +32,13 @@ jobs: steps: - uses: actions/checkout@v4 - - name: Install dependencies - run: | - sudo apt-get update - sudo apt-get install -y autoconf automake libtool - - name: Cache wolfSSL (ASan, ${{ matrix.wolfssl-version }}) if: matrix.wolfssl-version != 'master' id: cache-wolfssl uses: actions/cache@v4 with: path: ~/wolfssl-asan - key: wolfssl-asan-${{ matrix.wolfssl-version }}-v1 + key: wolfcose-ci-v1-wolfssl-asan-${{ matrix.wolfssl-version }}-v1 - name: Build wolfSSL (ASan, ${{ matrix.wolfssl-version }}) if: matrix.wolfssl-version == 'master' || steps.cache-wolfssl.outputs.cache-hit != 'true' diff --git a/.github/workflows/scenarios.yml b/.github/workflows/scenarios.yml index 111b2bf..ec03d1d 100644 --- a/.github/workflows/scenarios.yml +++ b/.github/workflows/scenarios.yml @@ -2,7 +2,7 @@ name: Real-World Scenarios on: push: - branches: [ 'main', 'release/**' ] + branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] pull_request: branches: [ '*' ] workflow_dispatch: @@ -11,6 +11,10 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +defaults: + run: + shell: bash -e {0} + jobs: discover: uses: ./.github/workflows/_resolve-wolfssl.yml @@ -19,6 +23,8 @@ jobs: name: Scenarios (wolfSSL ${{ matrix.wolfssl-version }}) needs: discover runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest strategy: fail-fast: false matrix: ${{ fromJson(needs.discover.outputs.matrix) }} @@ -26,18 +32,13 @@ jobs: steps: - uses: actions/checkout@v4 - - name: Install dependencies - run: | - sudo apt-get update - sudo apt-get install -y autoconf automake libtool - - name: Cache wolfSSL (${{ matrix.wolfssl-version }}) if: matrix.wolfssl-version != 'master' id: cache-wolfssl uses: actions/cache@v4 with: path: ~/wolfssl-install - key: wolfssl-scenarios-${{ matrix.wolfssl-version }}-v1 + key: wolfcose-ci-v1-wolfssl-scenarios-${{ matrix.wolfssl-version }}-v1 - name: Build wolfSSL (${{ matrix.wolfssl-version }}) if: matrix.wolfssl-version == 'master' || steps.cache-wolfssl.outputs.cache-hit != 'true' diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index 6f08f83..6ad9d2e 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -2,7 +2,7 @@ name: Semgrep on: push: - branches: [ 'main', 'release/**' ] + branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] pull_request: branches: [ '*' ] @@ -13,21 +13,20 @@ concurrency: permissions: contents: read +defaults: + run: + shell: bash -e {0} + jobs: semgrep: name: Semgrep (wolfCOSE security rules) runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest timeout-minutes: 10 steps: - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 - with: - python-version: '3.x' - - - name: Install Semgrep - run: pip install --quiet semgrep - # --error makes the job fail on any finding. The rules self-scope via # their `paths:` blocks, so scanning the whole tree is fine. - name: Run wolfCOSE security rules diff --git a/.github/workflows/stack-bounds.yml b/.github/workflows/stack-bounds.yml index e6c5d47..f82bc6e 100644 --- a/.github/workflows/stack-bounds.yml +++ b/.github/workflows/stack-bounds.yml @@ -2,7 +2,7 @@ name: Stack Bounds on: push: - branches: [ 'main', 'release/**' ] + branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] pull_request: branches: [ '*' ] workflow_dispatch: @@ -11,26 +11,27 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +defaults: + run: + shell: bash -e {0} + jobs: frame-budget: name: Frame budget (full, worst case) runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest env: FRAME_BUDGET: 6144 steps: - uses: actions/checkout@v4 - - name: Install dependencies - run: | - sudo apt-get update - sudo apt-get install -y autoconf automake libtool - - name: Cache wolfSSL (full) id: cache-wolfssl uses: actions/cache@v4 with: path: ~/wolfssl-full - key: wolfssl-full-stack-v1 + key: wolfcose-ci-v1-wolfssl-full-stack-v1 - name: Build wolfSSL (full) if: steps.cache-wolfssl.outputs.cache-hit != 'true' @@ -71,20 +72,17 @@ jobs: small-footprint: name: SMALL_FOOTPRINT (ECC-only) runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest steps: - uses: actions/checkout@v4 - - name: Install dependencies - run: | - sudo apt-get update - sudo apt-get install -y autoconf automake libtool - - name: Cache wolfSSL (ECC-only) id: cache-wolfssl uses: actions/cache@v4 with: path: ~/wolfssl-ecc - key: wolfssl-ecc-smallfp-v2 + key: wolfcose-ci-v1-wolfssl-ecc-smallfp-v2 - name: Build wolfSSL (ECC-only, stripped) if: steps.cache-wolfssl.outputs.cache-hit != 'true' diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml index c17b4e3..3a4a448 100644 --- a/.github/workflows/static-analysis.yml +++ b/.github/workflows/static-analysis.yml @@ -2,15 +2,21 @@ name: Static Analysis on: push: - branches: [ 'main', 'release/**' ] + branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] pull_request: branches: [ '*' ] workflow_dispatch: +defaults: + run: + shell: bash -e {0} + jobs: cppcheck: name: cppcheck runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest steps: - uses: actions/checkout@v4 @@ -18,11 +24,6 @@ jobs: - name: Enforce zero dynamic allocation run: make zero-alloc-check - - name: Install cppcheck - run: | - sudo apt-get update - sudo apt-get install -y cppcheck autoconf automake libtool - - name: Resolve wolfSSL master commit id: wolfssl-rev run: echo "sha=$(git ls-remote https://github.com/wolfSSL/wolfssl.git HEAD | cut -f1)" >> "$GITHUB_OUTPUT" @@ -31,7 +32,7 @@ jobs: uses: actions/cache@v4 with: path: ~/wolfssl-install - key: wolfssl-ubuntu-latest-v4-lms-${{ steps.wolfssl-rev.outputs.sha }} + key: wolfcose-ci-v1-wolfssl-ubuntu-latest-v4-lms-${{ steps.wolfssl-rev.outputs.sha }} - name: Build wolfSSL if: steps.cache-wolfssl.outputs.cache-hit != 'true' @@ -94,15 +95,12 @@ jobs: clang-analyzer: name: Clang Static Analyzer runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest steps: - uses: actions/checkout@v4 - - name: Install dependencies - run: | - sudo apt-get update - sudo apt-get install -y clang-tools autoconf automake libtool - - name: Resolve wolfSSL master commit id: wolfssl-rev run: echo "sha=$(git ls-remote https://github.com/wolfSSL/wolfssl.git HEAD | cut -f1)" >> "$GITHUB_OUTPUT" @@ -111,7 +109,7 @@ jobs: uses: actions/cache@v4 with: path: ~/wolfssl-install - key: wolfssl-ubuntu-latest-v4-lms-${{ steps.wolfssl-rev.outputs.sha }} + key: wolfcose-ci-v1-wolfssl-ubuntu-latest-v4-lms-${{ steps.wolfssl-rev.outputs.sha }} - name: Build wolfSSL if: steps.cache-wolfssl.outputs.cache-hit != 'true' @@ -149,15 +147,12 @@ jobs: gcc-analyzer: name: GCC -fanalyzer runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest steps: - uses: actions/checkout@v4 - - name: Install dependencies - run: | - sudo apt-get update - sudo apt-get install -y autoconf automake libtool - - name: Resolve wolfSSL master commit id: wolfssl-rev run: echo "sha=$(git ls-remote https://github.com/wolfSSL/wolfssl.git HEAD | cut -f1)" >> "$GITHUB_OUTPUT" @@ -166,7 +161,7 @@ jobs: uses: actions/cache@v4 with: path: ~/wolfssl-install - key: wolfssl-ubuntu-latest-v4-lms-${{ steps.wolfssl-rev.outputs.sha }} + key: wolfcose-ci-v1-wolfssl-ubuntu-latest-v4-lms-${{ steps.wolfssl-rev.outputs.sha }} - name: Build wolfSSL if: steps.cache-wolfssl.outputs.cache-hit != 'true' diff --git a/.github/workflows/wiki-sync.yml b/.github/workflows/wiki-sync.yml index 9938adb..9351986 100644 --- a/.github/workflows/wiki-sync.yml +++ b/.github/workflows/wiki-sync.yml @@ -15,9 +15,15 @@ concurrency: group: wiki-sync cancel-in-progress: true +defaults: + run: + shell: bash -e {0} + jobs: sync: runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest steps: - uses: actions/checkout@v4 - name: Publish docs/ to wiki diff --git a/.github/workflows/wolfssl-versions.yml b/.github/workflows/wolfssl-versions.yml index c3a8314..46cf66d 100644 --- a/.github/workflows/wolfssl-versions.yml +++ b/.github/workflows/wolfssl-versions.yml @@ -2,7 +2,7 @@ name: wolfSSL Version Matrix on: push: - branches: [ 'main', 'release/**' ] + branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] pull_request: branches: [ '*' ] workflow_dispatch: @@ -14,6 +14,10 @@ concurrency: permissions: contents: read +defaults: + run: + shell: bash -e {0} + jobs: # Resolve the latest -stable wolfSSL tag at run time so we don't have to # bump this workflow every release. The base floor (v5.8.0), AES Key Wrap @@ -27,6 +31,8 @@ jobs: discover-versions: name: Resolve wolfSSL version matrix runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest outputs: matrix: ${{ steps.set-matrix.outputs.matrix }} latest-stable: ${{ steps.set-matrix.outputs.latest-stable }} @@ -77,6 +83,8 @@ jobs: name: wolfSSL ${{ matrix.wolfssl-version }} ${{ matrix.pqc && '(+ML-DSA/PQC)' || '(classic)' }} needs: discover-versions runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest timeout-minutes: 25 strategy: fail-fast: false @@ -85,11 +93,6 @@ jobs: steps: - uses: actions/checkout@v4 - - name: Install dependencies - run: | - sudo apt-get update - sudo apt-get install -y autoconf automake libtool - # Cache stable versions only — master must always rebuild to catch regressions - name: Cache wolfSSL (${{ matrix.wolfssl-version }}) if: matrix.wolfssl-version != 'master' @@ -97,7 +100,7 @@ jobs: uses: actions/cache@v4 with: path: ~/wolfssl-install - key: ${{ matrix.cache-key }} + key: wolfcose-ci-v1-${{ matrix.cache-key }} - name: Build wolfSSL (${{ matrix.wolfssl-version }}) if: matrix.wolfssl-version == 'master' || steps.cache-wolfssl.outputs.cache-hit != 'true' From 4a17c3dab8b346909bf00820c1732a8a7452f383 Mon Sep 17 00:00:00 2001 From: Aidan Garske Date: Wed, 7 Oct 2026 14:21:02 -0700 Subject: [PATCH 3/8] Include command line checks in upstream CI validation --- .github/workflows/cmdline-test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cmdline-test.yml b/.github/workflows/cmdline-test.yml index d08e1b6..bbcffe8 100644 --- a/.github/workflows/cmdline-test.yml +++ b/.github/workflows/cmdline-test.yml @@ -2,7 +2,7 @@ name: Command-Line Tool Test on: push: - branches: [ 'master', 'main', 'release/**' ] + branches: [ 'master', 'main', 'release/**', 'ci/ghcr-ci-image' ] pull_request: branches: [ '*' ] workflow_dispatch: From 0f731dc2c5b156e9320bad6f63525f9f997404cd Mon Sep 17 00:00:00 2001 From: Aidan Garske Date: Wed, 7 Oct 2026 14:26:17 -0700 Subject: [PATCH 4/8] Include GitHub CLI and verify wiki action compatibility --- .github/docker/wolfcose-ci/Dockerfile | 2 +- .github/docker/wolfcose-ci/README.md | 5 +++++ .github/docker/wolfcose-ci/smoke-test.sh | 2 +- .github/workflows/publish-ci-image.yml | 20 ++++++++++++++++++++ 4 files changed, 27 insertions(+), 2 deletions(-) diff --git a/.github/docker/wolfcose-ci/Dockerfile b/.github/docker/wolfcose-ci/Dockerfile index 2792d69..95abfed 100644 --- a/.github/docker/wolfcose-ci/Dockerfile +++ b/.github/docker/wolfcose-ci/Dockerfile @@ -21,7 +21,7 @@ RUN apt-get update \ autoconf automake libtool libtool-bin pkg-config m4 \ libssl-dev libffi-dev \ lcov bc valgrind \ - git curl ca-certificates jq \ + git gh curl ca-certificates jq \ python3 python3-dev python3-pip python3-venv \ zip unzip xz-utils zstd file procps \ && rm -rf /var/lib/apt/lists/* diff --git a/.github/docker/wolfcose-ci/README.md b/.github/docker/wolfcose-ci/README.md index 556a132..7faa7cb 100644 --- a/.github/docker/wolfcose-ci/README.md +++ b/.github/docker/wolfcose-ci/README.md @@ -3,6 +3,7 @@ Linux workflows use `ghcr.io/wolfssl/wolfcose-ci:latest`. Native macOS builds retain their Homebrew dependencies. The image contains the C compiler matrix, analysis and coverage tools, Go 1.24.x, stable Rust, and Python 3.12 peers. +The GitHub CLI supports the existing wiki publishing action. Python interop requirements come from the existing pinned requirements file; Semgrep and Codespell use a separate environment. @@ -25,6 +26,10 @@ Codespell are resolved when the image is rebuilt. repository's `GITHUB_TOKEN`. The GHCR package must be public so fork PRs can pull anonymously. +After publishing, a container job repeats the smoke checks in the GitHub runner +environment and exercises the wiki action in dry-run mode without publishing +documentation. + During first-time bootstrap, the upstream `ci/ghcr-ci-image` branch also publishes. Remove that trigger after the image is public and before merging. Consumers should never fall back to building the image or installing packages. diff --git a/.github/docker/wolfcose-ci/smoke-test.sh b/.github/docker/wolfcose-ci/smoke-test.sh index 882e668..45ec4cd 100644 --- a/.github/docker/wolfcose-ci/smoke-test.sh +++ b/.github/docker/wolfcose-ci/smoke-test.sh @@ -21,7 +21,7 @@ done test "$(cppcheck --version)" = 'Cppcheck 2.13.0' cppcheck --addon=misra --error-exitcode=1 "$smoke_dir/main.c" for tool in autoconf automake libtool pkg-config clang-tidy scan-build \ - lcov bc valgrind git curl jq zip unzip; do + lcov bc valgrind git gh curl jq zip unzip; do command -v "$tool" done pkg-config --exists openssl diff --git a/.github/workflows/publish-ci-image.yml b/.github/workflows/publish-ci-image.yml index 480e578..cf61136 100644 --- a/.github/workflows/publish-ci-image.yml +++ b/.github/workflows/publish-ci-image.yml @@ -71,3 +71,23 @@ jobs: labels: org.opencontainers.image.revision=${{ github.sha }} cache-from: type=registry,ref=ghcr.io/wolfssl/wolfcose-ci:latest cache-to: type=inline + + smoke: + name: Test published CI image + needs: publish + runs-on: ubuntu-latest + container: + image: ghcr.io/wolfssl/wolfcose-ci:latest + timeout-minutes: 10 + defaults: + run: + shell: bash -e {0} + steps: + - uses: actions/checkout@v4 + - name: Exercise installed tools + run: wolfcose-ci-smoke + - name: Check wiki publishing dependencies + uses: Andrew-Chen-Wang/github-wiki-action@50650fccf3a10f741995523cf9708c53cec8912a # v4 + with: + path: docs/ + dry-run: true From 4908dd6331d4764320705b443e89c64bd66d15e1 Mon Sep 17 00:00:00 2001 From: Aidan Garske Date: Wed, 7 Oct 2026 14:31:53 -0700 Subject: [PATCH 5/8] Trust mounted workspaces in container CI jobs --- .github/workflows/build-test.yml | 16 ++++++++++++++++ .github/workflows/c99-compliance.yml | 4 ++++ .github/workflows/cmdline-test.yml | 4 ++++ .github/workflows/codeql.yml | 4 ++++ .github/workflows/codespell.yml | 4 ++++ .github/workflows/comprehensive-tests.yml | 4 ++++ .github/workflows/cose-hpke.yml | 4 ++++ .github/workflows/coverage.yml | 4 ++++ .github/workflows/coverity.yml | 4 ++++ .github/workflows/empty-brace-scan.yml | 4 ++++ .github/workflows/examples.yml | 4 ++++ .github/workflows/house-style.yml | 5 +++++ .github/workflows/interop.yml | 4 ++++ .github/workflows/lean-build.yml | 12 ++++++++++++ .github/workflows/minimal-build.yml | 4 ++++ .github/workflows/misra-2012.yml | 4 ++++ .github/workflows/misra-2023.yml | 8 ++++++++ .github/workflows/multi-compiler.yml | 4 ++++ .github/workflows/publish-ci-image.yml | 2 ++ .github/workflows/release-prep.yml | 8 ++++++++ .github/workflows/sanitizer.yml | 4 ++++ .github/workflows/scenarios.yml | 4 ++++ .github/workflows/semgrep.yml | 4 ++++ .github/workflows/stack-bounds.yml | 8 ++++++++ .github/workflows/static-analysis.yml | 12 ++++++++++++ .github/workflows/wiki-sync.yml | 5 +++++ .github/workflows/wolfssl-versions.yml | 4 ++++ 27 files changed, 148 insertions(+) diff --git a/.github/workflows/build-test.yml b/.github/workflows/build-test.yml index 2e7f5fd..9723919 100644 --- a/.github/workflows/build-test.yml +++ b/.github/workflows/build-test.yml @@ -38,6 +38,10 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Install dependencies (macOS) if: runner.os == 'macOS' run: brew install autoconf automake libtool @@ -222,6 +226,10 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Cache wolfSSL (${{ matrix.wolfssl-ref }}) if: matrix.wolfssl-ref != 'master' id: cache-wolfssl @@ -289,6 +297,10 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + # Build wolfSSL with LMS support that cannot sign, mirroring a verifier # deployment. --enable-lms=verify-only records WOLFSSL_LMS_VERIFY_ONLY in # options.h, which wolfCOSE reads to compile out its own signing paths. @@ -349,6 +361,10 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Cache wolfSSL (${{ matrix.wolfssl-version }}) if: matrix.wolfssl-version != 'master' id: cache-wolfssl diff --git a/.github/workflows/c99-compliance.yml b/.github/workflows/c99-compliance.yml index 9135e73..1bfc4d4 100644 --- a/.github/workflows/c99-compliance.yml +++ b/.github/workflows/c99-compliance.yml @@ -29,6 +29,10 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Resolve wolfSSL master commit id: wolfssl-rev run: echo "sha=$(git ls-remote https://github.com/wolfSSL/wolfssl.git HEAD | cut -f1)" >> "$GITHUB_OUTPUT" diff --git a/.github/workflows/cmdline-test.yml b/.github/workflows/cmdline-test.yml index bbcffe8..e2939da 100644 --- a/.github/workflows/cmdline-test.yml +++ b/.github/workflows/cmdline-test.yml @@ -32,6 +32,10 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Cache wolfSSL (${{ matrix.wolfssl-version }}) if: matrix.wolfssl-version != 'master' id: cache-wolfssl diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 3026e98..0ad9223 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -31,6 +31,10 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + # Full-feature wolfSSL so every wolfCOSE code path is compiled and # therefore visible to CodeQL. - name: Build wolfSSL diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml index 6601f2d..54f2599 100644 --- a/.github/workflows/codespell.yml +++ b/.github/workflows/codespell.yml @@ -25,6 +25,10 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Run codespell run: | codespell --check-filenames --check-hidden \ diff --git a/.github/workflows/comprehensive-tests.yml b/.github/workflows/comprehensive-tests.yml index 89b007b..3dba2c5 100644 --- a/.github/workflows/comprehensive-tests.yml +++ b/.github/workflows/comprehensive-tests.yml @@ -32,6 +32,10 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Cache wolfSSL (${{ matrix.wolfssl-version }}) if: matrix.wolfssl-version != 'master' id: cache-wolfssl diff --git a/.github/workflows/cose-hpke.yml b/.github/workflows/cose-hpke.yml index bde5ed4..2fe6eff 100644 --- a/.github/workflows/cose-hpke.yml +++ b/.github/workflows/cose-hpke.yml @@ -36,6 +36,10 @@ jobs: steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Build HPKE-enabled wolfSSL run: | git clone --depth 1 --branch "${{ matrix.wolfssl-ref }}" \ diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index 47b9c2c..670033f 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -24,6 +24,10 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Resolve wolfSSL master commit id: wolfssl-rev run: echo "sha=$(git ls-remote https://github.com/wolfSSL/wolfssl.git HEAD | cut -f1)" >> "$GITHUB_OUTPUT" diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index 41b3b56..fd861bf 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -26,6 +26,10 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Resolve wolfSSL master commit id: wolfssl-rev run: echo "sha=$(git ls-remote https://github.com/wolfSSL/wolfssl.git HEAD | cut -f1)" >> "$GITHUB_OUTPUT" diff --git a/.github/workflows/empty-brace-scan.yml b/.github/workflows/empty-brace-scan.yml index 39b83a7..ec09c5f 100644 --- a/.github/workflows/empty-brace-scan.yml +++ b/.github/workflows/empty-brace-scan.yml @@ -25,6 +25,10 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Check for bare C scope blocks run: | # Bare scope blocks are disallowed. If one is truly required, document diff --git a/.github/workflows/examples.yml b/.github/workflows/examples.yml index da41cca..d815a7f 100644 --- a/.github/workflows/examples.yml +++ b/.github/workflows/examples.yml @@ -32,6 +32,10 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Cache wolfSSL (${{ matrix.wolfssl-version }}) if: matrix.wolfssl-version != 'master' id: cache-wolfssl diff --git a/.github/workflows/house-style.yml b/.github/workflows/house-style.yml index f182944..0bc334e 100644 --- a/.github/workflows/house-style.yml +++ b/.github/workflows/house-style.yml @@ -27,5 +27,10 @@ jobs: timeout-minutes: 5 steps: - uses: actions/checkout@v4 + + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Check conventions (no goto, C-style comments, banner style, no tabs/trailing space) run: sh scripts/check_house_style.sh diff --git a/.github/workflows/interop.yml b/.github/workflows/interop.yml index 2841990..b9b281a 100644 --- a/.github/workflows/interop.yml +++ b/.github/workflows/interop.yml @@ -41,6 +41,10 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Cache Go interop dependencies uses: actions/cache@v4 with: diff --git a/.github/workflows/lean-build.yml b/.github/workflows/lean-build.yml index 614c26b..b65e2b4 100644 --- a/.github/workflows/lean-build.yml +++ b/.github/workflows/lean-build.yml @@ -25,6 +25,10 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Resolve wolfSSL master commit id: wolfssl-rev run: echo "sha=$(git ls-remote https://github.com/wolfSSL/wolfssl.git HEAD | cut -f1)" >> "$GITHUB_OUTPUT" @@ -112,6 +116,10 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Resolve wolfSSL master commit id: wolfssl-rev run: echo "sha=$(git ls-remote https://github.com/wolfSSL/wolfssl.git HEAD | cut -f1)" >> "$GITHUB_OUTPUT" @@ -200,6 +208,10 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Resolve wolfSSL master commit id: wolfssl-rev run: echo "sha=$(git ls-remote https://github.com/wolfSSL/wolfssl.git HEAD | cut -f1)" >> "$GITHUB_OUTPUT" diff --git a/.github/workflows/minimal-build.yml b/.github/workflows/minimal-build.yml index f51a677..18358da 100644 --- a/.github/workflows/minimal-build.yml +++ b/.github/workflows/minimal-build.yml @@ -79,6 +79,10 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Resolve wolfSSL master commit id: wolfssl-rev run: echo "sha=$(git ls-remote https://github.com/wolfSSL/wolfssl.git HEAD | cut -f1)" >> "$GITHUB_OUTPUT" diff --git a/.github/workflows/misra-2012.yml b/.github/workflows/misra-2012.yml index db6e3d0..2fbabf6 100644 --- a/.github/workflows/misra-2012.yml +++ b/.github/workflows/misra-2012.yml @@ -34,6 +34,10 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Check cppcheck version run: | CPPCHECK_VERSION=$(cppcheck --version) diff --git a/.github/workflows/misra-2023.yml b/.github/workflows/misra-2023.yml index 3724f2a..b45b2c3 100644 --- a/.github/workflows/misra-2023.yml +++ b/.github/workflows/misra-2023.yml @@ -33,6 +33,10 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Resolve wolfSSL master commit id: wolfssl-rev run: echo "sha=$(git ls-remote https://github.com/wolfSSL/wolfssl.git HEAD | cut -f1)" >> "$GITHUB_OUTPUT" @@ -169,6 +173,10 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Resolve wolfSSL master commit id: wolfssl-rev run: echo "sha=$(git ls-remote https://github.com/wolfSSL/wolfssl.git HEAD | cut -f1)" >> "$GITHUB_OUTPUT" diff --git a/.github/workflows/multi-compiler.yml b/.github/workflows/multi-compiler.yml index 7881eb7..e2cf7be 100644 --- a/.github/workflows/multi-compiler.yml +++ b/.github/workflows/multi-compiler.yml @@ -34,6 +34,10 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Cache wolfSSL (${{ matrix.wolfssl-ref }}) if: matrix.wolfssl-ref != 'master' id: cache-wolfssl diff --git a/.github/workflows/publish-ci-image.yml b/.github/workflows/publish-ci-image.yml index cf61136..ef5c40f 100644 --- a/.github/workflows/publish-ci-image.yml +++ b/.github/workflows/publish-ci-image.yml @@ -86,6 +86,8 @@ jobs: - uses: actions/checkout@v4 - name: Exercise installed tools run: wolfcose-ci-smoke + - name: Trust workspace + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" - name: Check wiki publishing dependencies uses: Andrew-Chen-Wang/github-wiki-action@50650fccf3a10f741995523cf9708c53cec8912a # v4 with: diff --git a/.github/workflows/release-prep.yml b/.github/workflows/release-prep.yml index b0994be..1fa7a3d 100644 --- a/.github/workflows/release-prep.yml +++ b/.github/workflows/release-prep.yml @@ -43,6 +43,10 @@ jobs: fetch-depth: 0 ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Resolve release version and commit id: release env: @@ -83,6 +87,10 @@ jobs: fetch-depth: 0 ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Resolve wolfSSL master commit id: wolfssl run: | diff --git a/.github/workflows/sanitizer.yml b/.github/workflows/sanitizer.yml index 740a354..98f2cf5 100644 --- a/.github/workflows/sanitizer.yml +++ b/.github/workflows/sanitizer.yml @@ -32,6 +32,10 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Cache wolfSSL (ASan, ${{ matrix.wolfssl-version }}) if: matrix.wolfssl-version != 'master' id: cache-wolfssl diff --git a/.github/workflows/scenarios.yml b/.github/workflows/scenarios.yml index ec03d1d..ececcd1 100644 --- a/.github/workflows/scenarios.yml +++ b/.github/workflows/scenarios.yml @@ -32,6 +32,10 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Cache wolfSSL (${{ matrix.wolfssl-version }}) if: matrix.wolfssl-version != 'master' id: cache-wolfssl diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index 6ad9d2e..7cf2307 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -27,6 +27,10 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + # --error makes the job fail on any finding. The rules self-scope via # their `paths:` blocks, so scanning the whole tree is fine. - name: Run wolfCOSE security rules diff --git a/.github/workflows/stack-bounds.yml b/.github/workflows/stack-bounds.yml index f82bc6e..744e4d8 100644 --- a/.github/workflows/stack-bounds.yml +++ b/.github/workflows/stack-bounds.yml @@ -26,6 +26,10 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Cache wolfSSL (full) id: cache-wolfssl uses: actions/cache@v4 @@ -77,6 +81,10 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Cache wolfSSL (ECC-only) id: cache-wolfssl uses: actions/cache@v4 diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml index 3a4a448..00e52a2 100644 --- a/.github/workflows/static-analysis.yml +++ b/.github/workflows/static-analysis.yml @@ -21,6 +21,10 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Enforce zero dynamic allocation run: make zero-alloc-check @@ -101,6 +105,10 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Resolve wolfSSL master commit id: wolfssl-rev run: echo "sha=$(git ls-remote https://github.com/wolfSSL/wolfssl.git HEAD | cut -f1)" >> "$GITHUB_OUTPUT" @@ -153,6 +161,10 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Resolve wolfSSL master commit id: wolfssl-rev run: echo "sha=$(git ls-remote https://github.com/wolfSSL/wolfssl.git HEAD | cut -f1)" >> "$GITHUB_OUTPUT" diff --git a/.github/workflows/wiki-sync.yml b/.github/workflows/wiki-sync.yml index 9351986..3003c2a 100644 --- a/.github/workflows/wiki-sync.yml +++ b/.github/workflows/wiki-sync.yml @@ -26,6 +26,11 @@ jobs: image: ghcr.io/wolfssl/wolfcose-ci:latest steps: - uses: actions/checkout@v4 + + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Publish docs/ to wiki uses: Andrew-Chen-Wang/github-wiki-action@50650fccf3a10f741995523cf9708c53cec8912a # v4 with: diff --git a/.github/workflows/wolfssl-versions.yml b/.github/workflows/wolfssl-versions.yml index 46cf66d..046942f 100644 --- a/.github/workflows/wolfssl-versions.yml +++ b/.github/workflows/wolfssl-versions.yml @@ -93,6 +93,10 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Trust workspace + if: runner.os == 'Linux' + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + # Cache stable versions only — master must always rebuild to catch regressions - name: Cache wolfSSL (${{ matrix.wolfssl-version }}) if: matrix.wolfssl-version != 'master' From 89f8ee3d14844000d0b6bc0ffdc8599b98d75d34 Mon Sep 17 00:00:00 2001 From: Aidan Garske Date: Wed, 7 Oct 2026 14:49:48 -0700 Subject: [PATCH 6/8] Finalize GHCR workflow triggers and release paths --- .github/docker/wolfcose-ci/README.md | 6 ++-- .github/workflows/build-test.yml | 2 +- .github/workflows/c99-compliance.yml | 2 +- .github/workflows/cmdline-test.yml | 2 +- .github/workflows/codeql.yml | 2 +- .github/workflows/codespell.yml | 2 +- .github/workflows/comprehensive-tests.yml | 2 +- .github/workflows/cose-hpke.yml | 2 +- .github/workflows/coverage.yml | 2 +- .github/workflows/empty-brace-scan.yml | 2 +- .github/workflows/examples.yml | 2 +- .github/workflows/house-style.yml | 2 +- .github/workflows/interop.yml | 2 +- .github/workflows/lean-build.yml | 2 +- .github/workflows/minimal-build.yml | 2 +- .github/workflows/misra-2012.yml | 2 +- .github/workflows/misra-2023.yml | 2 +- .github/workflows/multi-compiler.yml | 2 +- .github/workflows/publish-ci-image.yml | 3 +- .github/workflows/release-prep.yml | 41 ++++++++++++----------- .github/workflows/sanitizer.yml | 2 +- .github/workflows/scenarios.yml | 2 +- .github/workflows/semgrep.yml | 2 +- .github/workflows/stack-bounds.yml | 2 +- .github/workflows/static-analysis.yml | 2 +- .github/workflows/wolfssl-versions.yml | 2 +- 26 files changed, 50 insertions(+), 46 deletions(-) diff --git a/.github/docker/wolfcose-ci/README.md b/.github/docker/wolfcose-ci/README.md index 7faa7cb..82083c9 100644 --- a/.github/docker/wolfcose-ci/README.md +++ b/.github/docker/wolfcose-ci/README.md @@ -30,10 +30,12 @@ After publishing, a container job repeats the smoke checks in the GitHub runner environment and exercises the wiki action in dry-run mode without publishing documentation. -During first-time bootstrap, the upstream `ci/ghcr-ci-image` branch also -publishes. Remove that trigger after the image is public and before merging. Consumers should never fall back to building the image or installing packages. +Container jobs trust the mounted GitHub workspace after checkout so Git can +read a repository owned by the host runner. Their explicit Bash command keeps +the previous host shell's error behavior. + Linux wolfSSL caches use the `wolfcose-ci-v1` prefix to separate them from previous host builds. Bump this prefix if an image change makes cached builds incompatible. To roll back, point consumers at a previously published diff --git a/.github/workflows/build-test.yml b/.github/workflows/build-test.yml index 9723919..1a15ee8 100644 --- a/.github/workflows/build-test.yml +++ b/.github/workflows/build-test.yml @@ -2,7 +2,7 @@ name: Build and Test on: push: - branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] + branches: [ 'main', 'release/**' ] pull_request: branches: [ '*' ] workflow_dispatch: diff --git a/.github/workflows/c99-compliance.yml b/.github/workflows/c99-compliance.yml index 1bfc4d4..f035e3e 100644 --- a/.github/workflows/c99-compliance.yml +++ b/.github/workflows/c99-compliance.yml @@ -2,7 +2,7 @@ name: C99 Compliance on: push: - branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] + branches: [ 'main', 'release/**' ] pull_request: branches: [ '*' ] workflow_dispatch: diff --git a/.github/workflows/cmdline-test.yml b/.github/workflows/cmdline-test.yml index e2939da..7d8510f 100644 --- a/.github/workflows/cmdline-test.yml +++ b/.github/workflows/cmdline-test.yml @@ -2,7 +2,7 @@ name: Command-Line Tool Test on: push: - branches: [ 'master', 'main', 'release/**', 'ci/ghcr-ci-image' ] + branches: [ 'master', 'main', 'release/**' ] pull_request: branches: [ '*' ] workflow_dispatch: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 0ad9223..9c775ec 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -2,7 +2,7 @@ name: CodeQL on: push: - branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] + branches: [ 'main', 'release/**' ] pull_request: branches: [ '*' ] schedule: diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml index 54f2599..01e287b 100644 --- a/.github/workflows/codespell.yml +++ b/.github/workflows/codespell.yml @@ -2,7 +2,7 @@ name: Codespell on: push: - branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] + branches: [ 'main', 'release/**' ] pull_request: branches: [ '*' ] workflow_dispatch: diff --git a/.github/workflows/comprehensive-tests.yml b/.github/workflows/comprehensive-tests.yml index 3dba2c5..fb73d13 100644 --- a/.github/workflows/comprehensive-tests.yml +++ b/.github/workflows/comprehensive-tests.yml @@ -2,7 +2,7 @@ name: Comprehensive Tests on: push: - branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] + branches: [ 'main', 'release/**' ] pull_request: branches: [ '*' ] workflow_dispatch: diff --git a/.github/workflows/cose-hpke.yml b/.github/workflows/cose-hpke.yml index 2fe6eff..4c8f239 100644 --- a/.github/workflows/cose-hpke.yml +++ b/.github/workflows/cose-hpke.yml @@ -2,7 +2,7 @@ name: Experimental COSE-HPKE on: push: - branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] + branches: [ 'main', 'release/**' ] pull_request: branches: [ '**' ] workflow_dispatch: diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index 670033f..30031dc 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -2,7 +2,7 @@ name: Code Coverage on: push: - branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] + branches: [ 'main', 'release/**' ] pull_request: branches: [ '*' ] workflow_dispatch: diff --git a/.github/workflows/empty-brace-scan.yml b/.github/workflows/empty-brace-scan.yml index ec09c5f..20eff08 100644 --- a/.github/workflows/empty-brace-scan.yml +++ b/.github/workflows/empty-brace-scan.yml @@ -2,7 +2,7 @@ name: Empty Brace Scope Scan on: push: - branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] + branches: [ 'main', 'release/**' ] pull_request: branches: [ '*' ] workflow_dispatch: diff --git a/.github/workflows/examples.yml b/.github/workflows/examples.yml index d815a7f..8a4f483 100644 --- a/.github/workflows/examples.yml +++ b/.github/workflows/examples.yml @@ -2,7 +2,7 @@ name: Examples on: push: - branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] + branches: [ 'main', 'release/**' ] pull_request: branches: [ '*' ] workflow_dispatch: diff --git a/.github/workflows/house-style.yml b/.github/workflows/house-style.yml index 0bc334e..fb00f8c 100644 --- a/.github/workflows/house-style.yml +++ b/.github/workflows/house-style.yml @@ -2,7 +2,7 @@ name: House Style on: push: - branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] + branches: [ 'main', 'release/**' ] pull_request: branches: [ '*' ] workflow_dispatch: diff --git a/.github/workflows/interop.yml b/.github/workflows/interop.yml index b9b281a..0660a3a 100644 --- a/.github/workflows/interop.yml +++ b/.github/workflows/interop.yml @@ -2,7 +2,7 @@ name: Interop on: push: - branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] + branches: [ 'main', 'release/**' ] pull_request: branches: [ '**' ] workflow_dispatch: diff --git a/.github/workflows/lean-build.yml b/.github/workflows/lean-build.yml index b65e2b4..a871835 100644 --- a/.github/workflows/lean-build.yml +++ b/.github/workflows/lean-build.yml @@ -2,7 +2,7 @@ name: Lean Build on: push: - branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] + branches: [ 'main', 'release/**' ] pull_request: branches: [ '*' ] workflow_dispatch: diff --git a/.github/workflows/minimal-build.yml b/.github/workflows/minimal-build.yml index 18358da..b6133dc 100644 --- a/.github/workflows/minimal-build.yml +++ b/.github/workflows/minimal-build.yml @@ -2,7 +2,7 @@ name: Minimal Build on: push: - branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] + branches: [ 'main', 'release/**' ] pull_request: branches: [ '*' ] workflow_dispatch: diff --git a/.github/workflows/misra-2012.yml b/.github/workflows/misra-2012.yml index 2fbabf6..6855eeb 100644 --- a/.github/workflows/misra-2012.yml +++ b/.github/workflows/misra-2012.yml @@ -5,7 +5,7 @@ name: MISRA C 2012 on: push: - branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] + branches: [ 'main', 'release/**' ] pull_request: branches: [ '*' ] workflow_dispatch: diff --git a/.github/workflows/misra-2023.yml b/.github/workflows/misra-2023.yml index b45b2c3..d845a19 100644 --- a/.github/workflows/misra-2023.yml +++ b/.github/workflows/misra-2023.yml @@ -6,7 +6,7 @@ name: MISRA C 2023 Compliance on: push: - branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] + branches: [ 'main', 'release/**' ] pull_request: branches: [ '*' ] workflow_dispatch: diff --git a/.github/workflows/multi-compiler.yml b/.github/workflows/multi-compiler.yml index e2cf7be..244e3a0 100644 --- a/.github/workflows/multi-compiler.yml +++ b/.github/workflows/multi-compiler.yml @@ -2,7 +2,7 @@ name: Multi-Compiler on: push: - branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] + branches: [ 'main', 'release/**' ] pull_request: branches: [ '*' ] workflow_dispatch: diff --git a/.github/workflows/publish-ci-image.yml b/.github/workflows/publish-ci-image.yml index ef5c40f..ba1fbf8 100644 --- a/.github/workflows/publish-ci-image.yml +++ b/.github/workflows/publish-ci-image.yml @@ -2,8 +2,7 @@ name: Publish CI image on: push: - # The CI branch bootstraps GHCR before this workflow reaches main. - branches: [main, ci/ghcr-ci-image] + branches: [main] paths: - '.github/docker/wolfcose-ci/**' - '.github/workflows/publish-ci-image.yml' diff --git a/.github/workflows/release-prep.yml b/.github/workflows/release-prep.yml index 1fa7a3d..639baad 100644 --- a/.github/workflows/release-prep.yml +++ b/.github/workflows/release-prep.yml @@ -91,6 +91,9 @@ jobs: if: runner.os == 'Linux' run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Set wolfSSL install path + run: echo "WOLFSSL_RELEASE_DIR=$HOME/wolfssl-release" >> "$GITHUB_ENV" + - name: Resolve wolfSSL master commit id: wolfssl run: | @@ -132,9 +135,9 @@ jobs: - name: Run baseline release commands env: - WOLFSSL_CFLAGS: -isystem /home/runner/wolfssl-release/include - WOLFSSL_LIBS: -L/home/runner/wolfssl-release/lib -lwolfssl - LD_LIBRARY_PATH: /home/runner/wolfssl-release/lib + WOLFSSL_CFLAGS: -isystem ${{ env.WOLFSSL_RELEASE_DIR }}/include + WOLFSSL_LIBS: -L${{ env.WOLFSSL_RELEASE_DIR }}/lib -lwolfssl + LD_LIBRARY_PATH: ${{ env.WOLFSSL_RELEASE_DIR }}/lib run: | make clean make @@ -147,38 +150,38 @@ jobs: - name: Run advanced feature scenarios env: - WOLFSSL_CFLAGS: -isystem /home/runner/wolfssl-release/include - WOLFSSL_LIBS: -L/home/runner/wolfssl-release/lib -lwolfssl - LD_LIBRARY_PATH: /home/runner/wolfssl-release/lib + WOLFSSL_CFLAGS: -isystem ${{ env.WOLFSSL_RELEASE_DIR }}/include + WOLFSSL_LIBS: -L${{ env.WOLFSSL_RELEASE_DIR }}/lib -lwolfssl + LD_LIBRARY_PATH: ${{ env.WOLFSSL_RELEASE_DIR }}/lib run: make release-scenarios - name: Compile as C++ env: - WOLFSSL_CFLAGS: -isystem /home/runner/wolfssl-release/include - WOLFSSL_LIBS: -L/home/runner/wolfssl-release/lib -lwolfssl - LD_LIBRARY_PATH: /home/runner/wolfssl-release/lib + WOLFSSL_CFLAGS: -isystem ${{ env.WOLFSSL_RELEASE_DIR }}/include + WOLFSSL_LIBS: -L${{ env.WOLFSSL_RELEASE_DIR }}/lib -lwolfssl + LD_LIBRARY_PATH: ${{ env.WOLFSSL_RELEASE_DIR }}/lib run: make cxx-check - name: Run release scenarios under Valgrind env: - WOLFSSL_CFLAGS: -isystem /home/runner/wolfssl-release/include - WOLFSSL_LIBS: -L/home/runner/wolfssl-release/lib -lwolfssl - LD_LIBRARY_PATH: /home/runner/wolfssl-release/lib + WOLFSSL_CFLAGS: -isystem ${{ env.WOLFSSL_RELEASE_DIR }}/include + WOLFSSL_LIBS: -L${{ env.WOLFSSL_RELEASE_DIR }}/lib -lwolfssl + LD_LIBRARY_PATH: ${{ env.WOLFSSL_RELEASE_DIR }}/lib run: make valgrind-check - name: Merge release coverage profiles env: - WOLFSSL_CFLAGS: -isystem /home/runner/wolfssl-release/include - WOLFSSL_LIBS: -L/home/runner/wolfssl-release/lib -lwolfssl - WOLFSSL_LDFLAGS: -L/home/runner/wolfssl-release/lib -lwolfssl - LD_LIBRARY_PATH: /home/runner/wolfssl-release/lib + WOLFSSL_CFLAGS: -isystem ${{ env.WOLFSSL_RELEASE_DIR }}/include + WOLFSSL_LIBS: -L${{ env.WOLFSSL_RELEASE_DIR }}/lib -lwolfssl + WOLFSSL_LDFLAGS: -L${{ env.WOLFSSL_RELEASE_DIR }}/lib -lwolfssl + LD_LIBRARY_PATH: ${{ env.WOLFSSL_RELEASE_DIR }}/lib run: make release-coverage - name: Build and smoke-test source archives env: - WOLFSSL_CFLAGS: -isystem /home/runner/wolfssl-release/include - WOLFSSL_LIBS: -L/home/runner/wolfssl-release/lib -lwolfssl - LD_LIBRARY_PATH: /home/runner/wolfssl-release/lib + WOLFSSL_CFLAGS: -isystem ${{ env.WOLFSSL_RELEASE_DIR }}/include + WOLFSSL_LIBS: -L${{ env.WOLFSSL_RELEASE_DIR }}/lib -lwolfssl + LD_LIBRARY_PATH: ${{ env.WOLFSSL_RELEASE_DIR }}/lib run: | make release-artifacts \ VERSION="${{ needs.metadata.outputs.version }}" \ diff --git a/.github/workflows/sanitizer.yml b/.github/workflows/sanitizer.yml index 98f2cf5..cfed070 100644 --- a/.github/workflows/sanitizer.yml +++ b/.github/workflows/sanitizer.yml @@ -2,7 +2,7 @@ name: Sanitizers on: push: - branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] + branches: [ 'main', 'release/**' ] pull_request: branches: [ '*' ] workflow_dispatch: diff --git a/.github/workflows/scenarios.yml b/.github/workflows/scenarios.yml index ececcd1..5b1d508 100644 --- a/.github/workflows/scenarios.yml +++ b/.github/workflows/scenarios.yml @@ -2,7 +2,7 @@ name: Real-World Scenarios on: push: - branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] + branches: [ 'main', 'release/**' ] pull_request: branches: [ '*' ] workflow_dispatch: diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index 7cf2307..a7baa7a 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -2,7 +2,7 @@ name: Semgrep on: push: - branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] + branches: [ 'main', 'release/**' ] pull_request: branches: [ '*' ] diff --git a/.github/workflows/stack-bounds.yml b/.github/workflows/stack-bounds.yml index 744e4d8..03b7a2e 100644 --- a/.github/workflows/stack-bounds.yml +++ b/.github/workflows/stack-bounds.yml @@ -2,7 +2,7 @@ name: Stack Bounds on: push: - branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] + branches: [ 'main', 'release/**' ] pull_request: branches: [ '*' ] workflow_dispatch: diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml index 00e52a2..36a321e 100644 --- a/.github/workflows/static-analysis.yml +++ b/.github/workflows/static-analysis.yml @@ -2,7 +2,7 @@ name: Static Analysis on: push: - branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] + branches: [ 'main', 'release/**' ] pull_request: branches: [ '*' ] workflow_dispatch: diff --git a/.github/workflows/wolfssl-versions.yml b/.github/workflows/wolfssl-versions.yml index 046942f..1f3827d 100644 --- a/.github/workflows/wolfssl-versions.yml +++ b/.github/workflows/wolfssl-versions.yml @@ -2,7 +2,7 @@ name: wolfSSL Version Matrix on: push: - branches: [ 'main', 'release/**', 'ci/ghcr-ci-image' ] + branches: [ 'main', 'release/**' ] pull_request: branches: [ '*' ] workflow_dispatch: From 089071b0ca5d8b7919ceef9f6264b246b5f45d4d Mon Sep 17 00:00:00 2001 From: Aidan Garske Date: Wed, 7 Oct 2026 15:21:32 -0700 Subject: [PATCH 7/8] Run CI image publishing only on main and manual dispatch --- .github/docker/wolfcose-ci/README.md | 4 ++-- .github/workflows/publish-ci-image.yml | 27 ++------------------------ 2 files changed, 4 insertions(+), 27 deletions(-) diff --git a/.github/docker/wolfcose-ci/README.md b/.github/docker/wolfcose-ci/README.md index 82083c9..27fca76 100644 --- a/.github/docker/wolfcose-ci/README.md +++ b/.github/docker/wolfcose-ci/README.md @@ -20,8 +20,8 @@ and Python interop requirements. Add shared dependencies here instead of installing them in workflow jobs. Go patch releases, stable Rust, Semgrep, and Codespell are resolved when the image is rebuilt. -`publish-ci-image.yml` validates image changes in PRs without publishing. In -`wolfSSL/wolfCOSE`, relevant pushes to `main` and manual dispatches publish +In `wolfSSL/wolfCOSE`, `publish-ci-image.yml` runs on relevant pushes to +`main` and manual dispatches. It builds and smoke-tests the image, then publishes `latest` and `sha-` tags. Publication is serialized and uses the repository's `GITHUB_TOKEN`. The GHCR package must be public so fork PRs can pull anonymously. diff --git a/.github/workflows/publish-ci-image.yml b/.github/workflows/publish-ci-image.yml index ba1fbf8..b86e55d 100644 --- a/.github/workflows/publish-ci-image.yml +++ b/.github/workflows/publish-ci-image.yml @@ -7,42 +7,19 @@ on: - '.github/docker/wolfcose-ci/**' - '.github/workflows/publish-ci-image.yml' - 'tests/interop/python_cwt/requirements.txt' - pull_request: - paths: - - '.github/docker/wolfcose-ci/**' - - '.github/workflows/publish-ci-image.yml' - - 'tests/interop/python_cwt/requirements.txt' workflow_dispatch: permissions: contents: read concurrency: - group: ${{ github.event_name == 'pull_request' && format('ci-image-pr-{0}', github.event.pull_request.number) || 'publish-ci-image' }} + group: publish-ci-image cancel-in-progress: false jobs: - validate: - name: Build CI image - if: github.event_name == 'pull_request' - runs-on: ubuntu-latest - timeout-minutes: 45 - steps: - - uses: actions/checkout@v4 - - uses: docker/setup-buildx-action@v3 - - name: Build and smoke-test image - uses: docker/build-push-action@v6 - with: - context: . - file: .github/docker/wolfcose-ci/Dockerfile - platforms: linux/amd64 - pull: true - push: false - cache-from: type=registry,ref=ghcr.io/wolfssl/wolfcose-ci:latest - publish: name: Publish CI image - if: github.repository == 'wolfSSL/wolfCOSE' && github.event_name != 'pull_request' + if: github.repository == 'wolfSSL/wolfCOSE' runs-on: ubuntu-latest timeout-minutes: 45 permissions: From 2c412ad34594596314a1672a6091804945058e2f Mon Sep 17 00:00:00 2001 From: Aidan Garske Date: Wed, 7 Oct 2026 15:33:51 -0700 Subject: [PATCH 8/8] Restrict CI image publishing and pin execution dependencies --- .github/docker/wolfcose-ci/README.md | 25 +++++++++++++++-------- .github/workflows/_resolve-wolfssl.yml | 2 +- .github/workflows/build-test.yml | 8 ++++---- .github/workflows/c99-compliance.yml | 2 +- .github/workflows/cmdline-test.yml | 2 +- .github/workflows/codeql.yml | 2 +- .github/workflows/codespell.yml | 2 +- .github/workflows/comprehensive-tests.yml | 2 +- .github/workflows/cose-hpke.yml | 2 +- .github/workflows/coverage.yml | 2 +- .github/workflows/coverity.yml | 2 +- .github/workflows/empty-brace-scan.yml | 2 +- .github/workflows/examples.yml | 2 +- .github/workflows/house-style.yml | 2 +- .github/workflows/interop.yml | 2 +- .github/workflows/lean-build.yml | 6 +++--- .github/workflows/minimal-build.yml | 2 +- .github/workflows/misra-2012.yml | 2 +- .github/workflows/misra-2023.yml | 4 ++-- .github/workflows/multi-compiler.yml | 2 +- .github/workflows/nightly.yml | 2 +- .github/workflows/publish-ci-image.yml | 17 ++++++++------- .github/workflows/release-prep.yml | 8 ++++---- .github/workflows/sanitizer.yml | 2 +- .github/workflows/scenarios.yml | 2 +- .github/workflows/semgrep.yml | 2 +- .github/workflows/stack-bounds.yml | 4 ++-- .github/workflows/static-analysis.yml | 6 +++--- .github/workflows/wiki-sync.yml | 2 +- .github/workflows/wolfssl-versions.yml | 4 ++-- 30 files changed, 67 insertions(+), 57 deletions(-) diff --git a/.github/docker/wolfcose-ci/README.md b/.github/docker/wolfcose-ci/README.md index 27fca76..e398814 100644 --- a/.github/docker/wolfcose-ci/README.md +++ b/.github/docker/wolfcose-ci/README.md @@ -1,8 +1,9 @@ # wolfCOSE CI image -Linux workflows use `ghcr.io/wolfssl/wolfcose-ci:latest`. Native macOS builds -retain their Homebrew dependencies. The image contains the C compiler matrix, -analysis and coverage tools, Go 1.24.x, stable Rust, and Python 3.12 peers. +Linux workflows pin `ghcr.io/wolfssl/wolfcose-ci` by its immutable image digest. +Native macOS builds retain their Homebrew dependencies. The image contains the +C compiler matrix, analysis and coverage tools, Go 1.24.x, stable Rust, and +Python 3.12 peers. The GitHub CLI supports the existing wiki publishing action. Python interop requirements come from the existing pinned requirements file; Semgrep and Codespell use a separate environment. @@ -21,14 +22,15 @@ installing them in workflow jobs. Go patch releases, stable Rust, Semgrep, and Codespell are resolved when the image is rebuilt. In `wolfSSL/wolfCOSE`, `publish-ci-image.yml` runs on relevant pushes to -`main` and manual dispatches. It builds and smoke-tests the image, then publishes +`main` and manual dispatches targeting `main`. Publication is restricted to +`refs/heads/main`. It builds and smoke-tests the image, then publishes `latest` and `sha-` tags. Publication is serialized and uses the repository's `GITHUB_TOKEN`. The GHCR package must be public so fork PRs can pull anonymously. -After publishing, a container job repeats the smoke checks in the GitHub runner -environment and exercises the wiki action in dry-run mode without publishing -documentation. +After publishing, a container job uses the build's output digest to repeat the +smoke checks in the GitHub runner environment and exercises the wiki action in +dry-run mode without publishing documentation. Consumers should never fall back to building the image or installing packages. @@ -38,5 +40,10 @@ the previous host shell's error behavior. Linux wolfSSL caches use the `wolfcose-ci-v1` prefix to separate them from previous host builds. Bump this prefix if an image change makes cached builds -incompatible. To roll back, point consumers at a previously published -`sha-` tag. +incompatible. + +To adopt a rebuilt image, inspect its `sha-` tag with +`docker buildx imagetools inspect` and copy the reported image digest into the +consumer workflows in a reviewed change. The publisher's smoke job tests the +new digest immediately, while consumer jobs keep using their reviewed digest. +To roll back, restore the previous digest in those workflows. diff --git a/.github/workflows/_resolve-wolfssl.yml b/.github/workflows/_resolve-wolfssl.yml index 6b86d72..c0e4ec2 100644 --- a/.github/workflows/_resolve-wolfssl.yml +++ b/.github/workflows/_resolve-wolfssl.yml @@ -28,7 +28,7 @@ jobs: name: Resolve wolfSSL version matrix runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc outputs: matrix: ${{ steps.set-matrix.outputs.matrix }} refs: ${{ steps.set-matrix.outputs.refs }} diff --git a/.github/workflows/build-test.yml b/.github/workflows/build-test.yml index 1a15ee8..48cf8b1 100644 --- a/.github/workflows/build-test.yml +++ b/.github/workflows/build-test.yml @@ -31,7 +31,7 @@ jobs: wolfssl-ref: ${{ fromJson(needs.discover.outputs.refs) }} include: - os: ubuntu-latest - container: ghcr.io/wolfssl/wolfcose-ci:latest + container: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc - os: macos-latest container: '' @@ -217,7 +217,7 @@ jobs: needs: discover runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc strategy: fail-fast: false matrix: @@ -292,7 +292,7 @@ jobs: name: LMS verify-only wolfSSL profile runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc steps: - uses: actions/checkout@v4 @@ -353,7 +353,7 @@ jobs: needs: discover runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc strategy: fail-fast: false matrix: ${{ fromJson(needs.discover.outputs.matrix) }} diff --git a/.github/workflows/c99-compliance.yml b/.github/workflows/c99-compliance.yml index f035e3e..7262432 100644 --- a/.github/workflows/c99-compliance.yml +++ b/.github/workflows/c99-compliance.yml @@ -20,7 +20,7 @@ jobs: name: ISO C99 conformance (${{ matrix.cc }}) runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc strategy: fail-fast: false matrix: diff --git a/.github/workflows/cmdline-test.yml b/.github/workflows/cmdline-test.yml index 7d8510f..9ac4460 100644 --- a/.github/workflows/cmdline-test.yml +++ b/.github/workflows/cmdline-test.yml @@ -24,7 +24,7 @@ jobs: needs: discover runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc strategy: fail-fast: false matrix: ${{ fromJson(needs.discover.outputs.matrix) }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 9c775ec..d612c08 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -26,7 +26,7 @@ jobs: name: CodeQL (C, security) runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc timeout-minutes: 30 steps: - uses: actions/checkout@v4 diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml index 01e287b..648e3f6 100644 --- a/.github/workflows/codespell.yml +++ b/.github/workflows/codespell.yml @@ -20,7 +20,7 @@ jobs: name: Check for spelling errors runs-on: ubuntu-22.04 container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc timeout-minutes: 5 steps: - uses: actions/checkout@v4 diff --git a/.github/workflows/comprehensive-tests.yml b/.github/workflows/comprehensive-tests.yml index fb73d13..8fffdd2 100644 --- a/.github/workflows/comprehensive-tests.yml +++ b/.github/workflows/comprehensive-tests.yml @@ -24,7 +24,7 @@ jobs: needs: discover runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc strategy: fail-fast: false matrix: ${{ fromJson(needs.discover.outputs.matrix) }} diff --git a/.github/workflows/cose-hpke.yml b/.github/workflows/cose-hpke.yml index 4c8f239..4a80779 100644 --- a/.github/workflows/cose-hpke.yml +++ b/.github/workflows/cose-hpke.yml @@ -27,7 +27,7 @@ jobs: needs: discover runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc strategy: fail-fast: false matrix: diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index 30031dc..5929715 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -20,7 +20,7 @@ jobs: name: Line Coverage runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc steps: - uses: actions/checkout@v4 diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index fd861bf..bdf12eb 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -18,7 +18,7 @@ jobs: name: Coverity Scan runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc # Only run from the original repo, not forks if: github.repository == 'wolfSSL/wolfCOSE' diff --git a/.github/workflows/empty-brace-scan.yml b/.github/workflows/empty-brace-scan.yml index 20eff08..df07a43 100644 --- a/.github/workflows/empty-brace-scan.yml +++ b/.github/workflows/empty-brace-scan.yml @@ -20,7 +20,7 @@ jobs: name: Empty Brace Scope Scan runs-on: ubuntu-22.04 container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc timeout-minutes: 5 steps: - uses: actions/checkout@v4 diff --git a/.github/workflows/examples.yml b/.github/workflows/examples.yml index 8a4f483..f5c0d08 100644 --- a/.github/workflows/examples.yml +++ b/.github/workflows/examples.yml @@ -24,7 +24,7 @@ jobs: needs: discover runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc strategy: fail-fast: false matrix: ${{ fromJson(needs.discover.outputs.matrix) }} diff --git a/.github/workflows/house-style.yml b/.github/workflows/house-style.yml index fb00f8c..20fa838 100644 --- a/.github/workflows/house-style.yml +++ b/.github/workflows/house-style.yml @@ -23,7 +23,7 @@ jobs: name: wolfCOSE house-style conventions runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc timeout-minutes: 5 steps: - uses: actions/checkout@v4 diff --git a/.github/workflows/interop.yml b/.github/workflows/interop.yml index 0660a3a..0ca5260 100644 --- a/.github/workflows/interop.yml +++ b/.github/workflows/interop.yml @@ -31,7 +31,7 @@ jobs: needs: discover runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc # All external peers share this job and its wolfSSL build. Keeping them # together avoids repeating the matrix setup for short interop commands. strategy: diff --git a/.github/workflows/lean-build.yml b/.github/workflows/lean-build.yml index a871835..1976915 100644 --- a/.github/workflows/lean-build.yml +++ b/.github/workflows/lean-build.yml @@ -20,7 +20,7 @@ jobs: name: Lean verify-only (WOLFCOSE_LEAN_VERIFY) runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc steps: - uses: actions/checkout@v4 @@ -111,7 +111,7 @@ jobs: name: Lean configs compile clean (strict) runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc steps: - uses: actions/checkout@v4 @@ -203,7 +203,7 @@ jobs: name: Post-quantum ML-DSA lean sign+verify and verify-only runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc steps: - uses: actions/checkout@v4 diff --git a/.github/workflows/minimal-build.yml b/.github/workflows/minimal-build.yml index b6133dc..cbffd95 100644 --- a/.github/workflows/minimal-build.yml +++ b/.github/workflows/minimal-build.yml @@ -20,7 +20,7 @@ jobs: name: ${{ matrix.name }} runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc strategy: fail-fast: false matrix: diff --git a/.github/workflows/misra-2012.yml b/.github/workflows/misra-2012.yml index 6855eeb..07f4947 100644 --- a/.github/workflows/misra-2012.yml +++ b/.github/workflows/misra-2012.yml @@ -23,7 +23,7 @@ jobs: name: MISRA C 2012 (cppcheck) runs-on: ubuntu-24.04 container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc env: WOLFSSL_REF: ac01707f552c611fbd135cc723b2682b3e7f80f2 diff --git a/.github/workflows/misra-2023.yml b/.github/workflows/misra-2023.yml index d845a19..a1772a4 100644 --- a/.github/workflows/misra-2023.yml +++ b/.github/workflows/misra-2023.yml @@ -28,7 +28,7 @@ jobs: name: MISRA C 2023 Compiler Warnings runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc steps: - uses: actions/checkout@v4 @@ -168,7 +168,7 @@ jobs: name: MISRA C 2023 (clang-tidy) runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc steps: - uses: actions/checkout@v4 diff --git a/.github/workflows/multi-compiler.yml b/.github/workflows/multi-compiler.yml index 244e3a0..5bffcd9 100644 --- a/.github/workflows/multi-compiler.yml +++ b/.github/workflows/multi-compiler.yml @@ -24,7 +24,7 @@ jobs: needs: discover runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc strategy: fail-fast: false matrix: diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 893721d..a5a7182 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -19,7 +19,7 @@ jobs: name: Trigger All CI Workflows runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc if: github.repository == 'wolfSSL/wolfCOSE' steps: diff --git a/.github/workflows/publish-ci-image.yml b/.github/workflows/publish-ci-image.yml index b86e55d..6deb8f0 100644 --- a/.github/workflows/publish-ci-image.yml +++ b/.github/workflows/publish-ci-image.yml @@ -19,22 +19,25 @@ concurrency: jobs: publish: name: Publish CI image - if: github.repository == 'wolfSSL/wolfCOSE' + if: github.repository == 'wolfSSL/wolfCOSE' && github.ref == 'refs/heads/main' runs-on: ubuntu-latest timeout-minutes: 45 permissions: contents: read packages: write + outputs: + digest: ${{ steps.build.outputs.digest }} steps: - - uses: actions/checkout@v4 - - uses: docker/setup-buildx-action@v3 - - uses: docker/login-action@v3 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 + - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Build, smoke-test, and push image - uses: docker/build-push-action@v6 + id: build + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 with: context: . file: .github/docker/wolfcose-ci/Dockerfile @@ -53,13 +56,13 @@ jobs: needs: publish runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@${{ needs.publish.outputs.digest }} timeout-minutes: 10 defaults: run: shell: bash -e {0} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Exercise installed tools run: wolfcose-ci-smoke - name: Trust workspace diff --git a/.github/workflows/release-prep.yml b/.github/workflows/release-prep.yml index 639baad..27261f4 100644 --- a/.github/workflows/release-prep.yml +++ b/.github/workflows/release-prep.yml @@ -32,7 +32,7 @@ jobs: github.event.label.name == 'ci:release' runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc outputs: version: ${{ steps.release.outputs.version }} commit: ${{ steps.release.outputs.commit }} @@ -79,7 +79,7 @@ jobs: needs: metadata runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc timeout-minutes: 120 steps: - uses: actions/checkout@v4 @@ -246,7 +246,7 @@ jobs: needs: metadata runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc timeout-minutes: 125 steps: - name: Wait for required workflows @@ -354,7 +354,7 @@ jobs: needs: [metadata, qualify, required-ci] runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc steps: - name: Enforce all release gates env: diff --git a/.github/workflows/sanitizer.yml b/.github/workflows/sanitizer.yml index cfed070..87a949c 100644 --- a/.github/workflows/sanitizer.yml +++ b/.github/workflows/sanitizer.yml @@ -24,7 +24,7 @@ jobs: needs: discover runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc strategy: fail-fast: false matrix: ${{ fromJson(needs.discover.outputs.matrix) }} diff --git a/.github/workflows/scenarios.yml b/.github/workflows/scenarios.yml index 5b1d508..7b8b655 100644 --- a/.github/workflows/scenarios.yml +++ b/.github/workflows/scenarios.yml @@ -24,7 +24,7 @@ jobs: needs: discover runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc strategy: fail-fast: false matrix: ${{ fromJson(needs.discover.outputs.matrix) }} diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index a7baa7a..a005a98 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -22,7 +22,7 @@ jobs: name: Semgrep (wolfCOSE security rules) runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc timeout-minutes: 10 steps: - uses: actions/checkout@v4 diff --git a/.github/workflows/stack-bounds.yml b/.github/workflows/stack-bounds.yml index 03b7a2e..69f6f7d 100644 --- a/.github/workflows/stack-bounds.yml +++ b/.github/workflows/stack-bounds.yml @@ -20,7 +20,7 @@ jobs: name: Frame budget (full, worst case) runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc env: FRAME_BUDGET: 6144 steps: @@ -77,7 +77,7 @@ jobs: name: SMALL_FOOTPRINT (ECC-only) runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc steps: - uses: actions/checkout@v4 diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml index 36a321e..dd03151 100644 --- a/.github/workflows/static-analysis.yml +++ b/.github/workflows/static-analysis.yml @@ -16,7 +16,7 @@ jobs: name: cppcheck runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc steps: - uses: actions/checkout@v4 @@ -100,7 +100,7 @@ jobs: name: Clang Static Analyzer runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc steps: - uses: actions/checkout@v4 @@ -156,7 +156,7 @@ jobs: name: GCC -fanalyzer runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc steps: - uses: actions/checkout@v4 diff --git a/.github/workflows/wiki-sync.yml b/.github/workflows/wiki-sync.yml index 3003c2a..7785d7d 100644 --- a/.github/workflows/wiki-sync.yml +++ b/.github/workflows/wiki-sync.yml @@ -23,7 +23,7 @@ jobs: sync: runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc steps: - uses: actions/checkout@v4 diff --git a/.github/workflows/wolfssl-versions.yml b/.github/workflows/wolfssl-versions.yml index 1f3827d..a3f8a17 100644 --- a/.github/workflows/wolfssl-versions.yml +++ b/.github/workflows/wolfssl-versions.yml @@ -32,7 +32,7 @@ jobs: name: Resolve wolfSSL version matrix runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc outputs: matrix: ${{ steps.set-matrix.outputs.matrix }} latest-stable: ${{ steps.set-matrix.outputs.latest-stable }} @@ -84,7 +84,7 @@ jobs: needs: discover-versions runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfcose-ci:latest + image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc timeout-minutes: 25 strategy: fail-fast: false