CI

Continuous Integration

wolfNanoTLS's CI runs on GitHub Actions. Because wolfNanoTLS compiles the pinned wolfSSL submodule sources directly (it never builds wolfSSL via ./configure), "testing a wolfSSL version" just means checking out the submodule at a ref and running wolfNanoTLS's Makefile.

wolfSSL version tracking

The repo carries one committed submodule pin. CI exercises three refs:

Ref	When	Meaning
pinned	every PR + push	the committed submodule SHA (reproducible baseline)
latest -stable	nightly	newest v*-stable tag (release-drift signal)
master	nightly	wolfSSL master HEAD (upstream tracking)

auto-pin-master.yml keeps main on a recent, frozen, test-passing master SHA. Nightly it fetches master, and if it differs from the pin, runs the full suite against it:

• green -> bumps the committed pin to that SHA, updates .github/wolfssl-master-known-good.txt, and closes any open break issue.
• red -> leaves the pin alone and opens (or updates) an issue labeled wolfssl-master-break, assigned to @aidangarske, with the failing SHA, the upstream short-log since the pin, and a link to the run.

Release branches pin the newest v*-stable so shipped artifacts ride QA'd wolfSSL while main rides known-good master.

Workflows

Build and test

• build-test.yml - make test (all suites) across GitHub's runner fleet: Linux x86_64, Linux arm64, macOS x86_64, macOS arm64 (OS- and arch-agnostic).
• wolfssl-versions.yml - the pinned/stable/master matrix.
• build-matrix.yml - feature toggles (floor, +MLKEM, +MLDSA, +X509, +RSA, +CHACHA) each build cleanly; off-state has no undefined refs.
• arch-build.yml - host asm bench (none+intel); bare-metal cross-compile of the floor (thumb2/aarch64/armv7/riscv64); and a qemu job that runs the suites under qemu-user for arm/aarch64/riscv64 Linux cross-targets (real execution, catching endian/word-size/alignment bugs without silicon).
• minimal-build.yml - the bench/min minimal clients build + size assertion.
• interop.yml - make interop: wolfNanoTLS client vs OpenSSL, wolfSSL, and mbedTLS servers (PSK + cert).

Standards

• house-style.yml - no //, no em/en-dash, no tabs, no trailing whitespace.
• empty-brace-scan.yml - no bare scope blocks.
• no-alloc-scan.yml - no raw libc allocation in the product source (static).
• no-malloc-runtime.yml - runtime proof: runs the crypto path and the full PSK handshake under a --wrap allocation probe, asserting zero allocations (Linux/GNU ld only).
• consttime.yml - the shell compares secrets (Finished MAC, PSK binder) with ConstantCompare only; fails on any variable-time memcmp/XMEMCMP in src/.
• c89-compliance.yml - compile the shell -std=c89 -Werror.

Analysis

• sanitizer.yml - ASAN/UBSAN of make test.
• valgrind.yml - Valgrind memcheck of the offline suites (MSan was dropped: it false-positives on wolfcrypt's DRBG seed-health read, no value over ASan).
• compilers.yml - make test across GCC 11-14 and Clang 16-18.
• fuzz.yml - coverage-guided libFuzzer over the ServerHello parser (60s on PR/push, 10min nightly), ASan-instrumented.
• semgrep.yml, codespell.yml, static-analysis.yml (cppcheck).
• coverage.yml - lcov of make test.
• stack-bounds.yml - -fstack-usage report.
• coverity.yml - Coverity Scan (token-gated; skips without COVERITY_TOKEN).

Footprint/speed comparison vs mbedTLS is run locally via sh bench/footprint-clients.sh / make bench, not as a CI workflow.

Orchestration

• nightly.yml - cron 09:00 UTC; runs the heavy reusable workflows.
• auto-pin-master.yml - cron 08:00 UTC; the green-gated pin bump above.
• wiki-sync.yml - mirrors docs/** to the wiki on push to main.

Reusable building blocks

• .github/actions/wolfssl-checkout - checkout repo + submodule at a ref.
• .github/actions/setup - install toolchains and peer build deps.
• .github/workflows/_discover-wolfssl.yml - emit the version matrix.

Running the checks locally

make test                 # all suites
make interop              # vs OpenSSL / wolfSSL / mbedTLS
make bench                # speed tables (ASM=none vs ASM=intel)
scripts/check_house_style.sh
scripts/empty_brace_scan.sh
scripts/no_alloc_scan.sh