@@ -178,8 +178,8 @@ jobs:
178178 free-threading : ${{ matrix.free-threading }}
179179
180180 build-windows-msi :
181- name : >- # ${{ '' } is a hack to nest jobs under the same sidebar category
182- Windows MSI${{ '' }}
181+ # ${{ '' } is a hack to nest jobs under the same sidebar category.
182+ name : Windows MSI${{ '' }} # zizmor: ignore[obfuscation]
183183 needs : build-context
184184 if : fromJSON(needs.build-context.outputs.run-windows-msi)
185185 strategy :
@@ -260,7 +260,7 @@ jobs:
260260 free-threading : ${{ matrix.free-threading }}
261261 os : ${{ matrix.os }}
262262
263- build-ubuntu-ssltests :
263+ build-ubuntu-ssltests-openssl :
264264 name : ' Ubuntu SSL tests with OpenSSL'
265265 runs-on : ${{ matrix.os }}
266266 timeout-minutes : 60
@@ -322,6 +322,104 @@ jobs:
322322 - name : SSL tests
323323 run : ./python Lib/test/ssltests.py
324324
325+ build-ubuntu-ssltests-awslc :
326+ name : ' Ubuntu SSL tests with AWS-LC'
327+ runs-on : ${{ matrix.os }}
328+ timeout-minutes : 60
329+ needs : build-context
330+ if : needs.build-context.outputs.run-tests == 'true'
331+ strategy :
332+ fail-fast : false
333+ matrix :
334+ os : [ubuntu-24.04]
335+ awslc_ver : [1.55.0]
336+ env :
337+ AWSLC_VER : ${{ matrix.awslc_ver}}
338+ MULTISSL_DIR : ${{ github.workspace }}/multissl
339+ OPENSSL_DIR : ${{ github.workspace }}/multissl/aws-lc/${{ matrix.awslc_ver }}
340+ LD_LIBRARY_PATH : ${{ github.workspace }}/multissl/aws-lc/${{ matrix.awslc_ver }}/lib
341+ steps :
342+ - uses : actions/checkout@v4
343+ with :
344+ persist-credentials : false
345+ - name : Runner image version
346+ run : echo "IMAGE_OS_VERSION=${ImageOS}-${ImageVersion}" >> "$GITHUB_ENV"
347+ - name : Restore config.cache
348+ uses : actions/cache@v4
349+ with :
350+ path : config.cache
351+ key : ${{ github.job }}-${{ env.IMAGE_OS_VERSION }}-${{ needs.build-context.outputs.config-hash }}
352+ - name : Register gcc problem matcher
353+ run : echo "::add-matcher::.github/problem-matchers/gcc.json"
354+ - name : Install dependencies
355+ run : sudo ./.github/workflows/posix-deps-apt.sh
356+ - name : Configure SSL lib env vars
357+ run : |
358+ echo "MULTISSL_DIR=${GITHUB_WORKSPACE}/multissl" >> "$GITHUB_ENV"
359+ echo "OPENSSL_DIR=${GITHUB_WORKSPACE}/multissl/aws-lc/${AWSLC_VER}" >> "$GITHUB_ENV"
360+ echo "LD_LIBRARY_PATH=${GITHUB_WORKSPACE}/multissl/aws-lc/${AWSLC_VER}/lib" >> "$GITHUB_ENV"
361+ name : ' Restore AWS-LC build'
362+ id : cache-aws-lc
363+ uses : actions/cache@v4
364+ with :
365+ path : ./multissl/aws-lc/${{ matrix.awslc_ver }}
366+ key : ${{ matrix.os }}-multissl-aws-lc-${{ matrix.awslc_ver }}
367+ - name : Install AWS-LC
368+ if : steps.cache-aws-lc.outputs.cache-hit != 'true'
369+ run : |
370+ python3 Tools/ssl/multissltests.py \
371+ --steps=library \
372+ --base-directory "$MULTISSL_DIR" \
373+ --awslc ${{ matrix.awslc_ver }} \
374+ --system Linux
375+ name : Add ccache to PATH
376+ run : |
377+ echo "PATH=/usr/lib/ccache:$PATH" >> "$GITHUB_ENV"
378+ name : Configure ccache action
379+ uses : hendrikmuhs/ccache-action@v1.2
380+ with :
381+ save : false
382+ - name : Configure CPython
383+ run : |
384+ ./configure CFLAGS="-fdiagnostics-format=json" \
385+ --config-cache \
386+ --enable-slower-safety \
387+ --with-pydebug \
388+ --with-openssl="$OPENSSL_DIR" \
389+ --with-builtin-hashlib-hashes=blake2 \
390+ --with-ssl-default-suites=openssl
391+ name : Build CPython
392+ run : make -j
393+ - name : Display build info
394+ run : make pythoninfo
395+ - name : Verify python is linked to AWS-LC
396+ run : ./python -c 'import ssl; print(ssl.OPENSSL_VERSION)' | grep AWS-LC
397+ - name : SSL tests
398+ run : ./python Lib/test/ssltests.py
399+
400+ build-android :
401+ name : Android (${{ matrix.arch }})
402+ needs : build-context
403+ if : needs.build-context.outputs.run-tests == 'true'
404+ timeout-minutes : 60
405+ strategy :
406+ fail-fast : false
407+ matrix :
408+ include :
409+ # Use the same runs-on configuration as build-macos and build-ubuntu.
410+ - arch : aarch64
411+ runs-on : ${{ github.repository_owner == 'python' && 'ghcr.io/cirruslabs/macos-runner:sonoma' || 'macos-14' }}
412+ - arch : x86_64
413+ runs-on : ubuntu-24.04
414+
415+ runs-on : ${{ matrix.runs-on }}
416+ steps :
417+ - uses : actions/checkout@v4
418+ with :
419+ persist-credentials : false
420+ - name : Build and test
421+ run : ./Android/android.py ci ${{ matrix.arch }}-linux-android
422+
325423 build-wasi :
326424 name : ' WASI'
327425 needs : build-context
@@ -510,31 +608,31 @@ jobs:
510608 - name : Tests
511609 run : xvfb-run make ci
512610
513- build-tsan :
514- name : >-
515- Thread sanitizer
516- ${{ fromJSON(matrix.free-threading) && '(free-threading)' || '' }}
611+ build-san :
612+ # ${{ '' } is a hack to nest jobs under the same sidebar category.
613+ name : Sanitizers${{ '' }} # zizmor: ignore[obfuscation]
517614 needs : build-context
518615 if : needs.build-context.outputs.run-tests == 'true'
519616 strategy :
520617 fail-fast : false
521618 matrix :
619+ check-name :
620+ - Thread
522621 free-threading :
523622 - false
524623 - true
525- uses : ./.github/workflows/reusable-tsan.yml
624+ sanitizer :
625+ - TSan
626+ include :
627+ - check-name : Undefined behavior
628+ sanitizer : UBSan
629+ free-threading : false
630+ uses : ./.github/workflows/reusable-san.yml
526631 with :
632+ sanitizer : ${{ matrix.sanitizer }}
527633 config_hash : ${{ needs.build-context.outputs.config-hash }}
528634 free-threading : ${{ matrix.free-threading }}
529635
530- build-ubsan :
531- name : Undefined behavior sanitizer
532- needs : build-context
533- if : needs.build-context.outputs.run-tests == 'true'
534- uses : ./.github/workflows/reusable-ubsan.yml
535- with :
536- config_hash : ${{ needs.build-context.outputs.config-hash }}
537-
538636 cross-build-linux :
539637 name : Cross build Linux
540638 runs-on : ubuntu-latest
@@ -628,11 +726,13 @@ jobs:
628726 - build-windows-msi
629727 - build-macos
630728 - build-ubuntu
631- - build-ubuntu-ssltests
729+ - build-ubuntu-ssltests-awslc
730+ - build-ubuntu-ssltests-openssl
731+ - build-android
632732 - build-wasi
633733 - test-hypothesis
634734 - build-asan
635- - build-tsan
735+ - build-san
636736 - cross-build-linux
637737 - cifuzz
638738 if : always()
@@ -643,7 +743,8 @@ jobs:
643743 with :
644744 allowed-failures : >-
645745 build-windows-msi,
646- build-ubuntu-ssltests,
746+ build-ubuntu-ssltests-awslc,
747+ build-ubuntu-ssltests-openssl,
647748 test-hypothesis,
648749 cifuzz,
649750allowed-skips : >-
@@ -661,11 +762,13 @@ jobs:
661762 check-generated-files,
662763 build-macos,
663764 build-ubuntu,
664- build-ubuntu-ssltests,
765+ build-ubuntu-ssltests-awslc,
766+ build-ubuntu-ssltests-openssl,
767+ build-android,
665768 build-wasi,
666769 test-hypothesis,
667770 build-asan,
668- build-tsan ,
771+ build-san ,
669772 cross-build-linux,
670773 '
671774 || ''
0 commit comments