c-cpp.yml

name: CI

# For testing, you can set variables in your repo (Repo -> Settings ->
# Security -> Actions -> Variables) to restrict the tests that are run.
# The supported variables are:
#
# RUN_ONLY_TARGET_CONFIG: Run only the single matching target and config,
#   separated by spaces, eg "ubuntu-latest default".  All other tests will
#   fail immediately.
#
# LTESTS: Override the set of tests run.

on:
  push:
    paths: [ '**.c', '**.h', '**.m4', '**.sh', '**/Makefile.in', 'configure.ac', '.github/configs', '.github/*.sh', '.github/workflows/c-cpp.yml' ]
  pull_request:
    paths: [ '**.c', '**.h', '**.m4', '**.sh', '**/Makefile.in', 'configure.ac', '.github/configs', '.github/*.sh', '.github/workflows/c-cpp.yml' ]

jobs:
  ci:
    name: "${{ matrix.target }} ${{ matrix.config }}"
    if: github.repository != 'openssh/openssh-portable-selfhosted'
    strategy:
      fail-fast: false
      matrix:
        # First we test all OSes in the default configuration.
        target:
          - ubuntu-22.04
          - ubuntu-latest
          - ubuntu-22.04-arm
          - ubuntu-24.04-arm
          - macos-14
          - macos-15
          - macos-15-intel
          - windows-2022
          - windows-2025
        config: [default]
        # Then we include any extra configs we want to test for specific VMs.
        # Valgrind slows things down quite a bit, so start them first.
        include:
          - { target: windows-2022, config: cygwin-release }
          - { target: windows-2025, config: cygwin-release }
          - { target: ubuntu-22.04, config: c89 }
          - { target: ubuntu-22.04, config: clang-11 }
          - { target: ubuntu-22.04, config: clang-12-Werror }
          - { target: ubuntu-22.04, config: clang-14 }
          - { target: ubuntu-22.04, config: clang-sanitize-address }
          - { target: ubuntu-22.04, config: clang-sanitize-undefined }
          - { target: ubuntu-22.04, config: gcc-9 }
          - { target: ubuntu-22.04, config: gcc-11-Werror }
          - { target: ubuntu-22.04, config: gcc-12-Werror }
          - { target: ubuntu-22.04, config: gcc-sanitize-address }
          - { target: ubuntu-22.04, config: gcc-sanitize-undefined }
          - { target: ubuntu-22.04, config: hardenedmalloc }
          - { target: ubuntu-22.04, config: heimdal }
          - { target: ubuntu-22.04, config: kitchensink }
          - { target: ubuntu-22.04, config: krb5 }
          - { target: ubuntu-22.04, config: libedit }
          - { target: ubuntu-22.04, config: pam }
          - { target: ubuntu-22.04, config: selinux }
          - { target: ubuntu-22.04, config: sk }
          - { target: ubuntu-22.04, config: valgrind-1 }
          - { target: ubuntu-22.04, config: valgrind-2 }
          - { target: ubuntu-22.04, config: valgrind-3 }
          - { target: ubuntu-22.04, config: valgrind-4 }
          - { target: ubuntu-22.04, config: valgrind-pam-1 }
          - { target: ubuntu-22.04, config: valgrind-unit }
          - { target: ubuntu-22.04, config: without-bearssl }
          - { target: ubuntu-latest, config: gcc-14 }
          - { target: ubuntu-latest, config: clang-15 }
          - { target: ubuntu-latest, config: clang-19 }
          - { target: ubuntu-latest, config: bearssl-head }
          - { target: ubuntu-latest, config: putty-versions }
          - { target: ubuntu-latest, config: zlib-develop }
          - { target: ubuntu-latest, config: tcmalloc }
          - { target: ubuntu-latest, config: musl }
          - { target: ubuntu-22.04-arm, config: kitchensink }
          - { target: ubuntu-24.04-arm, config: kitchensink }
          - { target: macos-14, config: pam }
          - { target: macos-15, config: pam }
    runs-on: ${{ matrix.target }}
    env:
      EPHEMERAL_VM: yes
    steps:
    - name: check RUN_ONLY_TARGET_CONFIG
      if: vars.RUN_ONLY_TARGET_CONFIG != ''
      run: sh -c 'if [ "${{ vars.RUN_ONLY_TARGET_CONFIG }}" != "${{ matrix.target }} ${{matrix.config }}" ]; then exit 1; else exit 0; fi'
    - name: set cygwin git params
      if: ${{ startsWith(matrix.target, 'windows') }}
      run: git config --global core.autocrlf input
    - name: install cygwin
      id: cygwin_install
      if: ${{ startsWith(matrix.target, 'windows') }}
      uses: cygwin/cygwin-install-action@master
      env:
        CYGWIN: "winsymlinks:native"
    - uses: actions/checkout@main
    - name: setup CI system
      run: sh ./.github/setup_ci.sh ${{ matrix.config }} ${{ matrix.target }}
      env:
        CYGWIN_SETUP: ${{ steps.cygwin_install.outputs.setup }}
    - name: autoreconf
      run: sh -c autoreconf
    - name: configure
      run: sh ./.github/configure.sh ${{ matrix.config }}
    - name: save config
      uses: actions/upload-artifact@main
      with:
        name: ${{ matrix.target }}-${{ matrix.config }}-config
        path: config.h
    - name: make clean
      run: make clean
    - name: make
      run: make
    - name: make tests
      run: sh ./.github/run_test.sh ${{ matrix.config }}
      env:
        TEST_SSH_UNSAFE_PERMISSIONS: 1
        TEST_SSH_HOSTBASED_AUTH: yes
        LTESTS: ${{ vars.LTESTS }}
    - name: test OpenSSL3 ABI compatibility
      if: ${{ startsWith(matrix.config, 'openssl-3') }}
      run: |
       sh .github/install_libcrypto.sh -a ${{ matrix.config }} /opt/openssl
       sh .github/run_test.sh ${{ matrix.config }}
    - name: show logs
      if: failure()
      run: for i in regress/failed*.log; do echo ====; echo logfile $i; echo =====; cat $i; done
    - name: chown logs
      if: failure()
      run: test -x "$(which sudo 2>&1)" && sudo chown -R "${LOGNAME}" regress
    - name: save logs
      if: failure()
      uses: actions/upload-artifact@main
      with:
        name: ${{ matrix.target }}-${{ matrix.config }}-logs
        path: |
          config.h
          config.log
          regress/