testsuite.yml

name: testsuite

on:
  push:
    branches:
      - '*'
    tags-ignore:
      - '*'
  pull_request:

jobs:

#
# A quick and cheap test first before running other jobs
#

  ubuntu:
    timeout-minutes: 5
    env:
      PERL_USE_UNSAFE_INC: 0
      AUTHOR_TESTING: 1
      AUTOMATED_TESTING: 1
      RELEASE_TESTING: 1

    runs-on: ubuntu-latest

    strategy:
      fail-fast: false

    steps:
      - uses: actions/checkout@v6
      - run: openssl version
      - run: perl -V
      - name: uses install-with-cpm
        uses: perl-actions/install-with-cpm@v1
        with:
          cpanfile: "cpanfile"
      - name: Makefile.PL
        run: perl -I$(pwd) Makefile.PL
      - run: make && prove -wbvm t/*.t

#
# Valgrind memory leak detection on OpenSSL 3.x
#

  valgrind:
    timeout-minutes: 15
    runs-on: ubuntu-latest
    needs: [ubuntu]
    name: "Valgrind (debian:bookworm)"
    container: debian:bookworm

    steps:
      - uses: actions/checkout@v6
      - name: Install dependencies
        run: |
          apt-get update
          apt-get install -y openssl perl make gcc libssl-dev sudo curl valgrind
      - name: uses install-with-cpm
        uses: perl-actions/install-with-cpm@v1
        with:
          cpanfile: "cpanfile"
      - name: Build
        run: |
          perl -I$(pwd) Makefile.PL
          make
      - name: Run tests under Valgrind
        run: |
          rc=0
          for t in t/*.t; do
            echo "=== valgrind: $t ==="
            valgrind \
              --leak-check=full \
              --show-leak-kinds=definite \
              --num-callers=20 \
              --log-file=valgrind.log \
              perl -Iblib/lib -Iblib/arch "$t"
            # Only fail if RSA.so appears in a "definitely lost" stack trace.
            # This filters out Perl-internal leaks (known false positives).
            if perl -0777 -e '
              my $log = do { local $/; <STDIN> };
              my $found = 0;
              for my $block (split /\n\n/, $log) {
                if ($block =~ /definitely lost/ && $block =~ /RSA\.so/) {
                  print STDERR "LEAK from RSA.xs:\n$block\n\n";
                  $found = 1;
                }
              }
              exit $found;
            ' < valgrind.log; then
              echo "  -> clean"
            else
              echo "Memory leak from RSA.xs in $t!"
              rc=1
            fi
          done
          exit $rc

  openssl-matrix:
    timeout-minutes: 5
    env:
      PERL_USE_UNSAFE_INC: 0
      AUTHOR_TESTING: 1
      AUTOMATED_TESTING: 1
      RELEASE_TESTING: 1

    runs-on: ubuntu-latest
    needs: [ubuntu]
    name: "OpenSSL ${{ matrix.os-version }}"

    strategy:
      fail-fast: false
      matrix:
        os-version:
        #  - debian:buster       # OpenSSL 1.1.1
          - debian:bullseye     # OpenSSL 1.1.1
          - debian:bookworm     # OpenSSL 3.0.x
          - debian:trixie       # OpenSSL 3.4.x (Debian 13)
          - almalinux:9         # OpenSSL with new crypto policies (RHEL-compatible)

    container: ${{ matrix.os-version }}
    steps:
      - uses: actions/checkout@v6
      - name: Install dependencies using apt-get
        if: ${{ startsWith(matrix.os-version, 'debian:') }}
        run: |
          apt-get update
          apt-get install -y openssl perl make gcc libssl-dev sudo curl
      - name: Install dependencies using yum
        if: ${{ matrix.os-version == 'almalinux:9' }}
        run: |
          yum install --skip-broken -y openssl perl make gcc openssl-devel sudo curl
      - run: openssl version
      - run: perl -V
      - name: uses install-with-cpm
        uses: perl-actions/install-with-cpm@v1
        with:
          cpanfile: "cpanfile"
      - name: Makefile.PL
        run: perl -I$(pwd) Makefile.PL
      - run: make && prove -wbvm t/*.t

#
# List of Perl Versions available
#

  perl-versions:
      timeout-minutes: 5
      runs-on: ubuntu-latest
      needs: [openssl-matrix]
      name: List Perl versions
      outputs:
        perl-versions: ${{ steps.action.outputs.perl-versions }}
      steps:
        - id: action
          uses: perl-actions/perl-versions@v2
          with:
            since-perl: v5.10
            with-devel: true

#
# The Perl matrix on linux
#

  perl:
    timeout-minutes: 5
    env:
      PERL_USE_UNSAFE_INC: 0
      AUTHOR_TESTING: 1
      AUTOMATED_TESTING: 1
      RELEASE_TESTING: 1

    runs-on: ubuntu-latest
    needs: [openssl-matrix,perl-versions]
    name: "Perl ${{ matrix.perl-version }}"

    strategy:
      fail-fast: false
      matrix:
        perl-version: ${{ fromJson (needs.perl-versions.outputs.perl-versions) }}

    container: perldocker/perl-tester:${{ matrix.perl-version }}

    steps:
      - uses: actions/checkout@v6
      - run: openssl version
      - run: perl -V
      - name: Deps for testing
        run: |
          cpanm --notest Crypt::OpenSSL::Random Crypt::OpenSSL::Guess Test::CPAN::Meta Perl::MinimumVersion Test::Pod::Coverage Test::Pod Test::MinimumVersion Crypt::OpenSSL::Bignum ||:
          cpanm --notest Crypt::OpenSSL::Random Crypt::OpenSSL::Guess Test::CPAN::Meta Perl::MinimumVersion Test::Pod::Coverage Test::Pod Test::MinimumVersion Crypt::OpenSSL::Bignum
          # not available < 5.12
          cpanm --notest Test::Kwalitee ||:
      - run: perl Makefile.PL
      - run: make && prove -wbvm t/*.t

#
# Windows
#

  windows:
    timeout-minutes: 5
    env:
      PERL_USE_UNSAFE_INC: 0
      AUTHOR_TESTING: 0
      AUTOMATED_TESTING: 1
      RELEASE_TESTING: 0

    needs: [openssl-matrix, perl-versions]
    runs-on: windows-latest

    strategy:
      fail-fast: false
      matrix:
        perl-version: [latest]

    steps:
      - uses: actions/checkout@v6
      - name: Set up Perl
        run: |
          # skip installing perl if it is already installed.
          if (!(Test-Path "C:\strawberry\perl\bin")) {
            choco install strawberryperl
          }
          echo @"
          C:\strawberry\c\bin
          C:\strawberry\perl\site\bin
          C:\strawberry\perl\bin
          "@ |
            Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
      - run: openssl version
      - run: perl -V
      - name: Deps for testing
        run: cpanm --notest Crypt::OpenSSL::Random Crypt::OpenSSL::Guess
      - run: perl Makefile.PL
      - run: make && prove -wbvm t/*.t

#
# macOS — covers LibreSSL (system default) and Homebrew OpenSSL 3.x
#

  macos:
    timeout-minutes: 5
    env:
      PERL_USE_UNSAFE_INC: 0
      AUTHOR_TESTING: 0
      AUTOMATED_TESTING: 1
      RELEASE_TESTING: 0

    needs: [ubuntu]
    runs-on: macos-latest
    name: "macOS - ${{ matrix.ssl }}"

    strategy:
      fail-fast: false
      matrix:
        include:
          - ssl: system LibreSSL
            openssl_prefix: ""
          - ssl: Homebrew OpenSSL
            openssl_prefix: HOMEBREW

    steps:
      - uses: actions/checkout@v6
      - name: Install Homebrew OpenSSL
        if: ${{ matrix.openssl_prefix == 'HOMEBREW' }}
        run: brew install openssl@3
      - name: Set OPENSSL_PREFIX for Homebrew OpenSSL
        if: ${{ matrix.openssl_prefix == 'HOMEBREW' }}
        run: echo "OPENSSL_PREFIX=$(brew --prefix openssl@3)" >> "$GITHUB_ENV"
      - run: openssl version
      - run: perl -V
      - name: Install cpanm
        run: |
          curl -L https://cpanmin.us/ -o cpanm
          chmod +x cpanm
          sudo mv cpanm /usr/local/bin/
      - name: Install dependencies
        run: cpanm --notest Crypt::OpenSSL::Guess Crypt::OpenSSL::Random Crypt::OpenSSL::Bignum
      - name: Makefile.PL
        run: perl Makefile.PL
      - run: make && prove -wbvm t/*.t