wolfCrypt JNI/JCE hardening fixes #320
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Android Gradle Build and Test | |
| on: | |
| push: | |
| branches: [ 'master', 'main', 'release/**' ] | |
| pull_request: | |
| branches: [ 'master' ] | |
| concurrency: | |
| group: android-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| jobs: | |
| build_wolfcryptjni: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Clone wolfcrypt-jni | |
| uses: actions/checkout@v4 | |
| # Free up disk space to prevent emulator from failing | |
| - name: Free up disk space | |
| run: | | |
| sudo rm -rf /usr/share/dotnet | |
| sudo rm -rf /usr/local/lib/android/sdk/ndk | |
| sudo rm -rf /opt/ghc | |
| sudo rm -rf /opt/hostedtoolcache/CodeQL | |
| sudo docker image prune --all --force | |
| df -h | |
| # Clone native wolfSSL | |
| - name: Clone native wolfSSL | |
| uses: actions/checkout@v4 | |
| with: | |
| repository: 'wolfssl/wolfssl' | |
| path: IDE/Android/app/src/main/cpp/wolfssl | |
| # Copy options.h.in to blank options.h | |
| - name: Create blank options.h | |
| run: cp IDE/Android/app/src/main/cpp/wolfssl/wolfssl/options.h.in IDE/Android/app/src/main/cpp/wolfssl/wolfssl/options.h | |
| # Setup Java with Gradle caching | |
| - name: Setup java | |
| uses: actions/setup-java@v4 | |
| with: | |
| distribution: 'zulu' | |
| java-version: '21' | |
| cache: 'gradle' | |
| # Build all targets in single Gradle invocation | |
| - name: Gradle Build | |
| run: cd IDE/Android && ./gradlew --build-cache assembleDebug assembleDebugUnitTest assembleDebugAndroidTest | |
| # Enable KVM for hardware acceleration (required for emulator) | |
| - name: Enable KVM | |
| run: | | |
| echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules | |
| sudo udevadm control --reload-rules | |
| sudo udevadm trigger --name-match=kvm | |
| # Cold boot with -no-snapshot. Restoring a snapshot brings back | |
| # sys.boot_completed already set, so the action runs its keyguard | |
| # dismiss (input keyevent 82) before the input service registers | |
| # and fails with "No service published for: input". | |
| # AOSP "default" image, these tests need no Play services. | |
| - name: Run Android Instrumented Tests | |
| uses: reactivecircus/android-emulator-runner@v2.37.0 | |
| timeout-minutes: 20 | |
| with: | |
| api-level: 30 | |
| arch: x86_64 | |
| target: default | |
| force-avd-creation: false | |
| emulator-options: -no-snapshot -no-window -gpu swiftshader_indirect -noaudio -no-boot-anim -camera-back none | |
| disable-animations: true | |
| script: | | |
| adb wait-for-device | |
| adb shell mkdir -p /data/local/tmp/examples/certs/intermediate | |
| adb shell mkdir -p /data/local/tmp/examples/certs/rsapss | |
| adb shell mkdir -p /data/local/tmp/examples/certs/crl | |
| adb push ./examples/certs/ /data/local/tmp/examples/ | |
| adb logcat -c | |
| # Shard the run, AGP returns results over gRPC with a 4MB cap | |
| # that the full suite exceeds, failing with RESOURCE_EXHAUSTED | |
| # even when every test passes. The action runs each line below | |
| # as its own shell, so the whole loop must stay on one line. | |
| cd IDE/Android && for S in 0 1; do echo "=== test shard $S of 2 ==="; ./gradlew connectedDebugAndroidTest --no-daemon --no-watch-fs -Pandroid.testInstrumentationRunnerArguments.numShards=2 -Pandroid.testInstrumentationRunnerArguments.shardIndex=$S || { adb logcat -d > /tmp/logcat.txt 2>&1; echo "=== LOGCAT (errors) ==="; grep -i "exception\|error\|fatal" /tmp/logcat.txt || true; exit 1; }; cp -r app/build/reports/androidTests/connected/debug app/build/reports/androidTests/shard-$S 2>/dev/null || true; done | |
| adb logcat -d > /tmp/logcat.txt 2>&1 || true | |
| pgrep -f '[q]emu-system' | xargs -r kill -9 2>/dev/null || true | |
| pgrep -f '[c]rashpad' | xargs -r kill -9 2>/dev/null || true | |
| sleep 2 | |
| # Upload test reports even on failure | |
| - name: Upload Test Reports | |
| uses: actions/upload-artifact@v4 | |
| if: always() | |
| timeout-minutes: 5 | |
| with: | |
| name: android-test-reports | |
| path: | | |
| IDE/Android/app/build/reports/androidTests/ | |
| /tmp/logcat.txt | |
| retention-days: 14 |