Test Installer #16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Test Installer | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| schedule: | |
| - cron: '0 4 * * *' | |
| workflow_dispatch: | |
| jobs: | |
| build: | |
| name: Build MSI (${{ matrix.openssl-ref }}) | |
| runs-on: windows-2025 | |
| env: | |
| # VS 2022 Enterprise and Strawberry Perl are preinstalled on windows-2025. | |
| VCVARS: 'C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat' | |
| # All currently-tested OpenSSL refs pair with the same NIST-validated | |
| # FIPS module (3.1.2). Pulled in as a sibling 'openssl-fips' checkout. | |
| FIPS_REF: openssl-3.1.2 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # Only refs with a corresponding windows-installer/<ref>.aip. | |
| openssl-ref: [openssl-3.5] | |
| steps: | |
| - name: Checkout installer | |
| uses: actions/checkout@v6 | |
| - name: Checkout OpenSSL (${{ matrix.openssl-ref }}) | |
| uses: actions/checkout@v6 | |
| with: | |
| repository: openssl/openssl | |
| ref: ${{ matrix.openssl-ref }} | |
| path: openssl | |
| fetch-tags: true | |
| - name: Detect OpenSSL version from latest tag | |
| id: openssl_version | |
| shell: pwsh | |
| working-directory: openssl | |
| run: | | |
| # Pick the highest patch-version tag in this branch's family. The | |
| # branch name itself is the tag prefix: openssl-3.5 branch → tags | |
| # named openssl-3.5.*. version:refname sort uses numeric component | |
| # ordering so openssl-3.5.10 ranks above openssl-3.5.9. | |
| # | |
| # We deliberately don't use --merged HEAD: the checkout is shallow | |
| # (fetch-depth: 1) so git can't compute reachability — the merged | |
| # filter would return an empty list. Pattern matching on the | |
| # branch's own tag prefix is the equivalent constraint. | |
| $pattern = '${{ matrix.openssl-ref }}.*' | |
| $tag = git tag --list $pattern --sort=-version:refname | Select-Object -First 1 | |
| if (-not $tag) { | |
| throw "no tags matching '$pattern' found in the openssl checkout" | |
| } | |
| $version = $tag -replace '^openssl-', '' | |
| $parts = $version.Split('.') | |
| if ($parts.Count -lt 3) { throw "unexpected tag format: $tag" } | |
| Write-Host "detected version: $version (from tag $tag)" | |
| "version=$version" >> $env:GITHUB_OUTPUT | |
| "major=$($parts[0])" >> $env:GITHUB_OUTPUT | |
| "minor=$($parts[1])" >> $env:GITHUB_OUTPUT | |
| "winctx=$($parts[0]).$($parts[1])-OpenSSLProject" >> $env:GITHUB_OUTPUT | |
| - name: Check out detected tag | |
| # Without this, nmake builds the branch tip (e.g. 3.5.7-dev) rather | |
| # than the tagged release (3.5.6) we just resolved + are about to | |
| # cache. Detached HEAD is fine — we never push from here. | |
| shell: cmd | |
| working-directory: openssl | |
| run: git -c advice.detachedHead=false checkout tags/openssl-${{ steps.openssl_version.outputs.version }} | |
| - name: Restore OpenSSL build cache | |
| id: openssl_cache | |
| uses: actions/cache@v5 | |
| with: | |
| path: | | |
| openssl | |
| openssl-fips | |
| # Builds for a given tagged release are deterministic; cache is | |
| # valid until a new tag appears (which bumps `version`) or | |
| # FIPS_REF changes. Bump the suffix (-v1 → -v2 …) to manually | |
| # invalidate if build flags change. | |
| key: openssl-build-${{ runner.os }}-${{ matrix.openssl-ref }}-${{ steps.openssl_version.outputs.version }}-fips-${{ env.FIPS_REF }}-v1 | |
| - name: Checkout OpenSSL for FIPS (${{ env.FIPS_REF }}) | |
| if: steps.openssl_cache.outputs.cache-hit != 'true' | |
| uses: actions/checkout@v6 | |
| with: | |
| repository: openssl/openssl | |
| ref: ${{ env.FIPS_REF }} | |
| path: openssl-fips | |
| - name: Apply Windows build patches to FIPS source | |
| # openssl-3.1.2 needs two backported fixes to build on modern MSVC. | |
| # Skipped for other FIPS refs. | |
| if: steps.openssl_cache.outputs.cache-hit != 'true' && env.FIPS_REF == 'openssl-3.1.2' | |
| shell: pwsh | |
| working-directory: openssl-fips | |
| run: | | |
| git apply --verbose "$env:GITHUB_WORKSPACE\windows-installer\0001-win-Fix-warning-build-issue.patch" | |
| if ($LASTEXITCODE -ne 0) { throw "patch 0001 failed" } | |
| git apply --verbose "$env:GITHUB_WORKSPACE\windows-installer\0002-windows-makefile-libdir-absolute.patch" | |
| if ($LASTEXITCODE -ne 0) { throw "patch 0002 failed" } | |
| - name: Install NASM | |
| if: steps.openssl_cache.outputs.cache-hit != 'true' | |
| shell: pwsh | |
| run: | | |
| choco install nasm -y --no-progress | |
| "C:\Program Files\NASM" | Out-File -FilePath "$env:GITHUB_PATH" -Append | |
| - name: Build OpenSSL | |
| if: steps.openssl_cache.outputs.cache-hit != 'true' | |
| shell: cmd | |
| working-directory: openssl | |
| run: | | |
| call "%VCVARS%" | |
| perl Configure VC-WIN64A enable-fips no-makedepend -DOSSL_WINCTX=OpenSSLProject | |
| nmake /S | |
| nmake build_docs | |
| - name: Build OpenSSL (FIPS source) | |
| if: steps.openssl_cache.outputs.cache-hit != 'true' | |
| shell: cmd | |
| working-directory: openssl-fips | |
| run: | | |
| call "%VCVARS%" | |
| perl Configure VC-WIN64A enable-fips no-makedepend | |
| nmake /S | |
| - name: Build installer | |
| uses: caphyon/advinst-github-action@7edde34c6ff935e53e3de72a5699efcfceb5f6c6 # v2.0.3 (current main HEAD) | |
| with: | |
| advinst-version: '23.5.1' | |
| advinst-license: ${{ secrets.ADVINST_LICENSE_KEY }} | |
| advinst-enable-automation: 'true' | |
| aip-path: ${{ github.workspace }}\windows-installer\${{ matrix.openssl-ref }}.aip | |
| aip-build-name: DefaultBuild | |
| # ResetSig is unconditional: this workflow produces unsigned | |
| # builds. The .aip's signing config references a certificate | |
| # that isn't available to GitHub Actions runners; ResetSig | |
| # clears it so the build doesn't fail on missing cert. | |
| aip-commands: | | |
| ResetSig | |
| SetVersion ${{ steps.openssl_version.outputs.version }} | |
| SetProperty VERSION_MAJOR=${{ steps.openssl_version.outputs.major }} | |
| SetProperty VERSION_MINOR=${{ steps.openssl_version.outputs.minor }} | |
| SetProperty VERSION_REGISTRY=${{ steps.openssl_version.outputs.winctx }} | |
| - name: Upload installer | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: installer-${{ matrix.openssl-ref }} | |
| path: build-target/Installer64/DefaultBuild/*.exe | |
| if-no-files-found: error | |
| test: | |
| name: Test on ${{ matrix.os }} (${{ matrix.openssl-ref }}) | |
| needs: build | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [windows-2022, windows-2025] | |
| openssl-ref: [openssl-3.5] | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Download installer | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: installer-${{ matrix.openssl-ref }} | |
| path: build | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39 # v3 (= release v3.2.4) | |
| with: | |
| enable-cache: true | |
| - name: Install Python deps | |
| run: uv sync --frozen || uv sync | |
| - name: Locate installer | |
| id: installer | |
| shell: pwsh | |
| run: | | |
| $exe = Get-ChildItem build -Recurse -Filter '*.exe' | Select-Object -First 1 | |
| if (-not $exe) { throw "No installer .exe found in build/" } | |
| "path=$($exe.FullName)" >> $env:GITHUB_OUTPUT | |
| - name: Run pytest | |
| run: uv run pytest tests --installer "${{ steps.installer.outputs.path }}" -v |