Merge remote-tracking branch 'upstream/main' into ci-pipeline

Author: nhatnghiho

.clang-tidy

@@ -0,0 +1,15 @@
+---
+Checks: '
+  -*,
+  bugprone-*,
+  cert-*,
+  clang-analyzer,
+  concurrency-*,
+  cppcoreguidelines-*,
+  hicpp-*,
+  misc-*,
+  modernize-*,
+  performance-*,
+  portability-*,
+  '
+WarningsAsErrors: ''

.github/workflows/actions-ci.yml

@@ -37,8 +37,7 @@ jobs:
       fail-fast: false
       matrix:
         os:
-          - "macos-14-large"
-          - "macos-13-large"
+          - "macos-13"
     steps:
       - uses: actions/checkout@v3
       - uses: actions/setup-go@v4
@@ -56,8 +55,7 @@ jobs:
       fail-fast: false
       matrix:
         os:
-          - "macos-14-large"
-          - "macos-13-large"
+          - "macos-13"
     steps:
       - uses: actions/checkout@v3
       - uses: actions/setup-go@v4
@@ -75,8 +73,8 @@ jobs:
       fail-fast: false
       matrix:
         os:
-          - "macos-14-xlarge"
-          - "macos-13-xlarge"
+          - "macos-14"
+          - "macos-15"
     steps:
       - uses: actions/checkout@v3
       - uses: actions/setup-go@v4
@@ -94,8 +92,8 @@ jobs:
       fail-fast: false
       matrix:
         os:
-          - "macos-14-xlarge"
-          - "macos-13-xlarge"
+          - "macos-14"
+          - "macos-15"
     steps:
       - uses: actions/checkout@v3
       - uses: actions/setup-go@v4
@@ -115,8 +113,8 @@ jobs:
         uses: actions/checkout@v3
       - name: Build Windows Dependencies
         run: |
-          choco install ninja --version 1.9.0.20190208 -y &&
-          choco install nasm --version 2.14.02 -y
+          choco install ninja  -y &&
+          choco install nasm -y
       - name: Run Windows Tests on MSVC-2019
         run: |
           .\tests\ci\run_windows_tests.bat "C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\vcvarsall.bat" x64
@@ -130,8 +128,8 @@ jobs:
         uses: actions/checkout@v3
       - name: Build Windows Dependencies
         run: |
-          choco install ninja --version 1.9.0.20190208 -y &&
-          choco install nasm --version 2.14.02 -y
+          choco install ninja -y &&
+          choco install nasm -y
       - name: Run Windows Tests on MSVC-2022
         run: |
           .\tests\ci\run_windows_tests.bat "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvarsall.bat" x64
@@ -148,8 +146,8 @@ jobs:
 
       - name: Build Windows Dependencies
         run: |
-          choco install ninja --version 1.9.0.20190208 -y &&
-          choco install nasm --version 2.14.02 -y
+          choco install ninja -y &&
+          choco install nasm -y
 
       - name: Install SDE simulator
         run: |
@@ -177,23 +175,80 @@ jobs:
         fips:
           - "0"
           - "1"
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
+    container:
+      image: ubuntu:20.04
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v4
-        with:
-          go-version: '>=1.18'
-      - name: Setup CMake
-        uses: threeal/[email protected]
-        with:
-          generator: Ninja
-          c-compiler: gcc-${{ matrix.gccversion }}
-          cxx-compiler: g++-${{ matrix.gccversion }}
-          options: FIPS=${{ matrix.fips }} CMAKE_BUILD_TYPE=Release
+      - run: |
+          env DEBIAN_FRONTEND=noninteractive apt-get update
+          env DEBIAN_FRONTEND=noninteractive apt-get install -y build-essential git curl cmake ninja-build \
+            gcc-${{ matrix.gccversion }} g++-${{ matrix.gccversion }}
+      - name: Install Newer Go Compiler
+        run: |
+          curl -L -o /tmp/go.tar.gz https://go.dev/dl/go1.24.2.linux-amd64.tar.gz
+          cat <<EOF >/tmp/go.tar.gz.sha256
+          68097bd680839cbc9d464a0edce4f7c333975e27a90246890e9f1078c7e702ad  /tmp/go.tar.gz
+          EOF
+          sha256sum -c /tmp/go.tar.gz.sha256
+          (cd /usr/local && tar xvf /tmp/go.tar.gz)
+      - name: Checkout
+        run: |
+          git config --global --add safe.directory '*'
+          git clone --recursive ${{ github.server_url }}/${{ github.repository }}.git .
+          git fetch origin ${{ github.sha }}
+          git checkout --recurse-submodules -b ci-job ${{ github.sha }}
       - name: Build Project
-        run: cmake --build ./build --target all
-      - name: Run tests
-        run: cmake --build ./build --target run_tests
+        run: |
+          env PATH="/usr/local/go/bin:${PATH}" \
+            CC=gcc-${{ matrix.gccversion }} CXX=g++-${{ matrix.gccversion }} \
+            cmake -B build -S . -DCMAKE_BUILD_TYPE=Release -DFIPS=${{ matrix.fips }} -GNinja
+          cmake --build build --target all
+      - name: Run Tests
+        run: |
+          cmake --build build --target run_tests
+
+  clang-ubuntu-2004-sanity:
+    if: github.repository_owner == 'aws'
+    needs: [sanity-test-run]
+    strategy:
+      fail-fast: false
+      matrix:
+        clangversion:
+          - "10"
+        fips:
+          - "0"
+          - "1"
+    runs-on: ubuntu-22.04
+    container:
+      image: ubuntu:20.04
+    steps:
+      - run: |
+          env DEBIAN_FRONTEND=noninteractive apt-get update
+          env DEBIAN_FRONTEND=noninteractive apt-get install -y build-essential git curl cmake ninja-build \
+            clang-${{ matrix.clangversion }} clang++-${{ matrix.clangversion }}
+      - name: Install Newer Go Compiler
+        run: |
+          curl -L -o /tmp/go.tar.gz https://go.dev/dl/go1.24.2.linux-amd64.tar.gz
+          cat <<EOF >/tmp/go.tar.gz.sha256
+          68097bd680839cbc9d464a0edce4f7c333975e27a90246890e9f1078c7e702ad  /tmp/go.tar.gz
+          EOF
+          sha256sum -c /tmp/go.tar.gz.sha256
+          (cd /usr/local && tar xvf /tmp/go.tar.gz)
+      - name: Checkout
+        run: |
+          git config --global --add safe.directory '*'
+          git clone --recursive ${{ github.server_url }}/${{ github.repository }}.git .
+          git fetch origin ${{ github.sha }}
+          git checkout --recurse-submodules -b ci-job ${{ github.sha }}
+      - name: Build Project
+        run: |
+          env PATH="/usr/local/go/bin:${PATH}" \
+            CC=clang-${{ matrix.clangversion }} CXX=clang++-${{ matrix.clangversion }} \
+            cmake -B build -S . -DCMAKE_BUILD_TYPE=Release -DFIPS=${{ matrix.fips }} -GNinja
+          cmake --build build --target all
+      - name: Run Tests
+        run: |
+          cmake --build build --target run_tests
 
   gcc-ubuntu-2204-sanity:
     if: github.repository_owner == 'aws'
@@ -302,44 +357,15 @@ jobs:
       - name: Build SSL
         run: cmake --build ./build --target ssl
 
-  clang-ubuntu-2004-sanity:
+  clang-ubuntu-2204-sanity:
     if: github.repository_owner == 'aws'
     needs: [sanity-test-run]
     strategy:
       fail-fast: false
       matrix:
         clangversion:
-          - "10"
           - "11"
           - "12"
-        fips:
-          - "0"
-          - "1"
-    runs-on: ubuntu-20.04
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v4
-        with:
-          go-version: '>=1.18'
-      - name: Setup CMake
-        uses: threeal/[email protected]
-        with:
-          generator: Ninja
-          c-compiler: clang-${{ matrix.clangversion }}
-          cxx-compiler: clang++-${{ matrix.clangversion }}
-          options: FIPS=${{ matrix.fips }} CMAKE_BUILD_TYPE=Release
-      - name: Build Project
-        run: cmake --build ./build --target all
-      - name: Run tests
-        run: cmake --build ./build --target run_tests
-
-  clang-ubuntu-2204-sanity:
-    if: github.repository_owner == 'aws'
-    needs: [sanity-test-run]
-    strategy:
-      fail-fast: false
-      matrix:
-        clangversion:
           - "13"
           - "14"
           - "15"
@@ -352,6 +378,11 @@ jobs:
       - uses: actions/setup-go@v4
         with:
           go-version: '>=1.18'
+      - name: Install Clang ${{ matrix.clangversion }}
+        if: ${{ matrix.clangversion == '11' || matrix.clangversion == '12' }}
+        run: |
+          env DEBIAN_FRONTEND=noninteractive sudo apt-get update
+          env DEBIAN_FRONTEND=noninteractive sudo apt-get install -y clang-${{ matrix.clangversion }}
       - name: Setup CMake
         uses: threeal/[email protected]
         with:
@@ -439,7 +470,7 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - name: OpenBSD
-        uses: cross-platform-actions/action@595d543e5d1aeb6d48c0a176965028afe56c7018
+        uses: cross-platform-actions/action@2d97d42e1972a17b045fd709a422f7e55a86230d
         env:
           AWS_LC_SSL_TEST_RUNNER_PEEK_ROUNDS: 5
           AWS_LC_GO_TEST_TIMEOUT: 120m
@@ -566,14 +597,14 @@ jobs:
           - 'x86-64'
           - 'arm64'
         version:
-          - '13.3'
-          - '14.1'
+          - '13.5'
+          - '14.2'
     steps:
       - uses: actions/checkout@v4
         with:
           submodules: 'recursive'
       - name: Prepare VM
-        uses: cross-platform-actions/action@v0.25.0
+        uses: cross-platform-actions/action@2d97d42e1972a17b045fd709a422f7e55a86230d
         env:
           AWS_LC_SSL_TEST_RUNNER_PEEK_ROUNDS: 5
           AWS_LC_GO_TEST_TIMEOUT: 90m

.github/workflows/aws-lc-rs.yml

@@ -20,7 +20,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ ubuntu-latest, macos-14-xlarge, windows-latest ]
+        os: [ ubuntu-latest, macos-latest, windows-latest ]
     steps:
       - uses: actions/checkout@v3
         with:
@@ -87,4 +87,4 @@ jobs:
       - name: Collect source from ${{ matrix.os }}
         if: runner.os != 'Windows'
         working-directory: ./aws-lc-rs
-        run: ./scripts/build/collect_build_src.sh
+        run: ./scripts/build/collect_build_src.sh

.github/workflows/clang-tidy-post.yml

@@ -0,0 +1,17 @@
+name: clang-tidy-post
+
+on:
+  workflow_run:
+    workflows: ["clang-tidy-review"]
+    types:
+      - completed
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: ZedThree/clang-tidy-review/[email protected]
+        with:
+          lgtm_comment_body: '' # An empty string means it won't post a LGTM message
+          annotations: false
+          max_comments: 10

.github/workflows/clang-tidy-review.yml

@@ -0,0 +1,17 @@
+name: clang-tidy-review
+on: [pull_request]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v4
+        with:
+          go-version: '>=1.18'
+      - uses: ZedThree/[email protected]
+        with:
+          split_workflow: true
+          clang_tidy_version: 19
+          install_commands: /github/workspace/util/build_compilation_database.sh
+      - uses: ZedThree/clang-tidy-review/[email protected]

.github/workflows/cmake.yml

@@ -20,6 +20,7 @@ jobs:
         cmake:
           - { version: "3.5", url: "https://cmake.org/files/v3.5/cmake-3.5.0.tar.gz", hash: "92c83ad8a4fd6224cf6319a60b399854f55b38ebe9d297c942408b792b1a9efa" }
           - { version: "3.28", url: "https://cmake.org/files/v3.28/cmake-3.28.1.tar.gz", hash: "15e94f83e647f7d620a140a7a5da76349fc47a1bfed66d0f5cdee8e7344079ad" }
+          - { version: "4.0", url: "https://cmake.org/files/v4.0/cmake-4.0.0.tar.gz", hash: "ddc54ad63b87e153cf50be450a6580f1b17b4881de8941da963ff56991a4083b" }
         generator:
           - "Unix Makefiles"
           - "Ninja"

.github/workflows/integrations.yml

@@ -48,4 +48,42 @@ jobs:
       - name: Run librdkafka build
         run: |
           ./tests/ci/integration/run_librdkafka_integration.sh
-          
+  socat:
+    if: github.repository_owner == 'aws'
+    runs-on: ubuntu-latest
+    env:
+      SHELL: /usr/bin/bash
+    steps:
+      - name: Install OS Dependencies
+        run: |
+          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
+          sudo apt-get -y --no-install-recommends install cmake gcc ninja-build golang make autoconf pkg-config openssl
+      - uses: actions/checkout@v4
+      - name: Run socat integration test
+        run: |
+          ./tests/ci/integration/run_socat_integration.sh
+  rust-openssl:
+    if: github.repository_owner == 'aws'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout aws-lc
+        uses: actions/checkout@v4
+        with:
+          path: aws-lc
+      - name: Checkout rust-openssl
+        uses: actions/checkout@v4
+        with:
+          repository: sfackler/rust-openssl
+          path: rust-openssl
+      - uses: dtolnay/rust-toolchain@stable
+        id: toolchain
+      - name: Set Rust toolchain override
+        run: rustup override set ${{ steps.toolchain.outputs.name }}
+      - name: Install bindgen-cli
+        run: cargo install --locked bindgen-cli
+      - name: Run rust-openssl integration tests
+        env:
+          RUST_OPENSSL_SRC_DIR: "${{ github.workspace }}/rust-openssl"
+        run: |
+          pushd "${GITHUB_WORKSPACE}/aws-lc"
+          ./tests/ci/integration/run_rust_openssl_integration.sh