main.yml

name: CI
on:
  push:
    branches: [ 'master', 'main', 'release/**' ]
  pull_request:
    branches: [ '*' ]

# Cancel superseded in-progress runs for the same PR. In-progress
# push runs are never cancelled, though a still-queued push run may
# be superseded by a newer queued one.
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  # Oracle JDK (Linux, Mac)
  # Oracle JDK requires JAR to be signed for some classes to load/run
  # properly, for example KeyAgreement. These tests are commented out
  # here until we get a solution in place for CI JAR signing
  #linux-oracle:
  #  strategy:
  #    matrix:
  #      os: [ 'ubuntu-latest', 'macos-latest' ]
  #      jdk_version: [ '17', '21', '24', '25' ]
  #      wolfssl_configure: [ '--enable-jni' ]
  #  name: ${{ matrix.os }} (Oracle JDK ${{ matrix.jdk_version }}, ${{ matrix.wolfssl_configure}})
  #  uses: ./.github/workflows/linux-common.yml
  #  with:
  #    os: ${{ matrix.os }}
  #    jdk_distro: "oracle"
  #    jdk_version: ${{ matrix.jdk_version }}
  #    wolfssl_configure: ${{ matrix.wolfssl_configure }}

  # Zulu JDK (Linux, Mac)
  linux-zulu:
    strategy:
      matrix:
        os: [ 'ubuntu-latest', 'macos-latest' ]
        jdk_version: [ '8', '11', '17', '21', '24', '25' ]
        wolfssl_configure: [ '--enable-jni' ]
    name: ${{ matrix.os }} (Zulu JDK ${{ matrix.jdk_version }}, ${{ matrix.wolfssl_configure}})
    uses: ./.github/workflows/linux-common.yml
    with:
      os: ${{ matrix.os }}
      jdk_distro: "zulu"
      jdk_version: ${{ matrix.jdk_version }}
      wolfssl_configure: ${{ matrix.wolfssl_configure }}

  # Corretto JDK (Linux, Mac)
  linux-corretto:
    strategy:
      matrix:
        os: [ 'ubuntu-latest', 'macos-latest' ]
        jdk_version: [ '8', '11', '17', '21', '24', '25' ]
        wolfssl_configure: [ '--enable-jni' ]
    name: ${{ matrix.os }} (Corretto JDK ${{ matrix.jdk_version }}, ${{ matrix.wolfssl_configure}})
    uses: ./.github/workflows/linux-common.yml
    with:
      os: ${{ matrix.os }}
      jdk_distro: "corretto"
      jdk_version: ${{ matrix.jdk_version }}
      wolfssl_configure: ${{ matrix.wolfssl_configure }}

  # Temurin JDK (Linux, Mac)
  # JDK 8 seems to have been removed from Temurin macos, with 8 we see the error
  # Could not find satisfied version for SemVer '8'
  linux-temurin:
    strategy:
      matrix:
        os: [ 'ubuntu-latest', 'macos-latest' ]
        jdk_version: [ '11', '17', '21', '24', '25' ]
        wolfssl_configure: [ '--enable-jni' ]
    name: ${{ matrix.os }} (Temurin JDK ${{ matrix.jdk_version }}, ${{ matrix.wolfssl_configure}})
    uses: ./.github/workflows/linux-common.yml
    with:
      os: ${{ matrix.os }}
      jdk_distro: "temurin"
      jdk_version: ${{ matrix.jdk_version }}
      wolfssl_configure: ${{ matrix.wolfssl_configure }}

  # Microsoft JDK (Linux, Mac)
  linux-microsoft:
    strategy:
      matrix:
        os: [ 'ubuntu-latest', 'macos-latest' ]
        jdk_version: [ '11.0.19', '17.0.7', '21.0.0', '25.0.0' ]
        wolfssl_configure: [ '--enable-jni' ]
    name: ${{ matrix.os }} (Microsoft JDK ${{ matrix.jdk_version }}, ${{ matrix.wolfssl_configure}})
    uses: ./.github/workflows/linux-common.yml
    with:
      os: ${{ matrix.os }}
      jdk_distro: "microsoft"
      jdk_version: ${{ matrix.jdk_version }}
      wolfssl_configure: ${{ matrix.wolfssl_configure }}

  # -------------------- enable-all sanity checks -----------------------
  # Only check one Linux and Mac JDK version with --enable-jni --enable-all
  # as sanity. Using Zulu, but this can be expanded if needed.
  linux-zulu-all:
    strategy:
      matrix:
        os: [ 'ubuntu-latest', 'macos-latest' ]
        jdk_version: [ '11' ]
        wolfssl_configure: [ '--enable-jni --enable-all' ]
    name: ${{ matrix.os }} (Zulu JDK ${{ matrix.jdk_version }}, ${{ matrix.wolfssl_configure}})
    uses: ./.github/workflows/linux-common.yml
    with:
      os: ${{ matrix.os }}
      jdk_distro: "zulu"
      jdk_version: ${{ matrix.jdk_version }}
      wolfssl_configure: ${{ matrix.wolfssl_configure }}

  # ------------------ RSA 1024 min size sanity check -------------------
  # Only check one Linux and Mac JDK version as a sanity check. Using Zulu,
  # but this can be expanded if needed.
  # wolfSSL ./configure:
  #     --enable-jni CFLAGS="-DRSA_MIN_SIZE=1024
  linux-zulu-rsa-min-size:
    strategy:
      matrix:
        os: [ 'ubuntu-latest', 'macos-latest' ]
        jdk_version: [ '11' ]
        wolfssl_configure: [ '--enable-jni CFLAGS="-DRSA_MIN_SIZE=1024"' ]
    name: ${{ matrix.os }} (Zulu JDK ${{ matrix.jdk_version }}, ${{ matrix.wolfssl_configure}})
    uses: ./.github/workflows/linux-common.yml
    with:
      os: ${{ matrix.os }}
      jdk_distro: "zulu"
      jdk_version: ${{ matrix.jdk_version }}
      wolfssl_configure: ${{ matrix.wolfssl_configure }}

  # -------------------- XMSS / XMSS^MT (RFC 8391) ----------------------
  # XMSS is verify-only and requires wolfSSL 5.9.2 or later. XMSS is not pulled
  # in by --enable-all, so it must be enabled explicitly with --enable-xmss.
  # Permutations: the basic build, SHAKE parameter sets (--enable-sha3), and
  # --enable-all plus XMSS.
  linux-zulu-xmss:
    strategy:
      matrix:
        os: [ 'ubuntu-latest', 'macos-latest' ]
        jdk_version: [ '11', '21', '24' ]
        wolfssl_configure:
          - '--enable-jni --enable-xmss'
          - '--enable-jni --enable-xmss --enable-sha3'
          - '--enable-jni --enable-all --enable-xmss'
    name: ${{ matrix.os }} (Zulu JDK ${{ matrix.jdk_version }}, ${{ matrix.wolfssl_configure }})
    uses: ./.github/workflows/linux-common.yml
    with:
      os: ${{ matrix.os }}
      jdk_distro: "zulu"
      jdk_version: ${{ matrix.jdk_version }}
      wolfssl_configure: ${{ matrix.wolfssl_configure }}

  # ----------------------- LMS / HSS (RFC 8554) ------------------------
  # LMS/HSS is verify-only in wolfJCE and requires wolfSSL to be built with
  # --enable-lms. It is not pulled in by --enable-all, so it is enabled
  # explicitly. The --enable-lms option is comma-separated and selects the
  # build variant and hash/parameter families:
  #   (default)      SHA-256/256 parameter sets, sign + verify
  #   verify-only    -> WOLFSSL_LMS_VERIFY_ONLY  (wolfJCE production posture)
  #   small          -> WOLFSSL_WC_LMS_SMALL     (low-memory, slower codepath)
  #   sha256-192     -> WOLFSSL_LMS_SHA256_192   (RFC 9858 SHA-256/192 sets)
  #   shake256       -> WOLFSSL_LMS_SHAKE256     (RFC 9858 SHAKE256 sets)
  # The LMS JUnit tests skip per hash family not compiled in (the JNI import
  # returns NOT_COMPILED_IN), so each permutation runs the KATs it can and
  # skips the rest. SHAKE parameter sets additionally require --enable-sha3.
  linux-zulu-lms:
    strategy:
      matrix:
        os: [ 'ubuntu-latest', 'macos-latest' ]
        jdk_version: [ '11', '21', '24' ]
        wolfssl_configure:
          - '--enable-jni --enable-lms'
          - '--enable-jni --enable-lms=verify-only'
          - '--enable-jni --enable-lms=verify-only,small'
          - '--enable-jni --enable-lms=sha256-192,shake256 --enable-sha3'
          - '--enable-jni --enable-all --enable-lms'
    name: ${{ matrix.os }} (Zulu JDK ${{ matrix.jdk_version }}, ${{ matrix.wolfssl_configure }})
    uses: ./.github/workflows/linux-common.yml
    with:
      os: ${{ matrix.os }}
      jdk_distro: "zulu"
      jdk_version: ${{ matrix.jdk_version }}
      wolfssl_configure: ${{ matrix.wolfssl_configure }}

  # ----------------------- SLH-DSA (FIPS 205) --------------------------
  # SLH-DSA provides full keygen/sign/verify in wolfJCE and requires wolfSSL
  # to be built with --enable-slhdsa. It is not pulled in by --enable-all.
  # The --enable-slhdsa option is comma-separated:
  #   (default/yes)  the six SHAKE parameter sets (128s/128f/192s/192f/
  #                  256s/256f), full keygen + sign + verify
  #   sha2           -> adds the six SHA2 parameter sets (SLH-DSA-SHA2-*)
  #   128f, sha2-128f, ... -> select individual parameter sets
  #   small          -> WOLFSSL_WC_SLHDSA_SMALL     (low-memory codepath)
  #   small-mem      -> WOLFSSL_WC_SLHDSA_SMALL_MEM (lower-memory codepath)
  #   verify-only    -> WOLFSSL_SLHDSA_VERIFY_ONLY  (no keygen/sign)
  # Extra options do not imply 'yes': parameter sets must be selected via
  # 'yes', 'sha2', or per-set tokens, otherwise no set is compiled in and
  # native wolfSSL fails to build ("No parameters defined"). SHAKE256/SHA-3
  # dependencies are auto-enabled by wolfSSL configure, so no --enable-sha3
  # is needed. JUnit tests probe per parameter set and per capability, so
  # each permutation runs what it can and skips the rest. Permutations:
  # default SHAKE-only, all 12 sets, all 12 + small codepath, a reduced
  # per-set selection + small-mem codepath, verify-only degradation, and
  # --enable-all interop.
  linux-zulu-slhdsa:
    strategy:
      matrix:
        os: [ 'ubuntu-latest', 'macos-latest' ]
        jdk_version: [ '11', '21', '24' ]
        wolfssl_configure:
          - '--enable-jni --enable-slhdsa'
          - '--enable-jni --enable-slhdsa=yes,sha2'
          - '--enable-jni --enable-slhdsa=yes,sha2,small'
          - '--enable-jni --enable-slhdsa=128f,sha2-128f,small-mem'
          - '--enable-jni --enable-slhdsa=yes,sha2,verify-only'
          - '--enable-jni --enable-all --enable-slhdsa=yes,sha2'
    name: ${{ matrix.os }} (Zulu JDK ${{ matrix.jdk_version }}, ${{ matrix.wolfssl_configure }})
    uses: ./.github/workflows/linux-common.yml
    with:
      os: ${{ matrix.os }}
      jdk_distro: "zulu"
      jdk_version: ${{ matrix.jdk_version }}
      wolfssl_configure: ${{ matrix.wolfssl_configure }}

  # ------------------ Facebook Infer static analysis -------------------
  # Run Facebook Infer over the Java sources, only running on Linux with
  # one JDK/version for now. Infer only compiles the .java files with
  # javac, so no native wolfSSL build or test run is needed here. Tests
  # for the equivalent configuration run in linux-zulu-all above.
  fb-infer:
    strategy:
      matrix:
        os: [ 'ubuntu-latest' ]
        jdk_version: [ '11' ]
    name: Facebook Infer (${{ matrix.os }} Zulu JDK ${{ matrix.jdk_version }})
    uses: ./.github/workflows/infer.yml
    with:
      os: ${{ matrix.os }}
      jdk_distro: "zulu"
      jdk_version: ${{ matrix.jdk_version }}

  # --------------------- Maven build - test pom.xml --------------------
  # Run Maven build over PR code, running on Linux and Mac with only one
  # JDK/version for now.
  maven-build:
    strategy:
      matrix:
        os: [ 'ubuntu-latest', 'macos-latest' ]
        jdk_version: [ '21' ]
        wolfssl_configure: [ '--enable-jni' ]
    name: Maven Build (${{ matrix.os }} Zulu JDK ${{ matrix.jdk_version }})
    uses: ./.github/workflows/maven.yml
    with:
      os: ${{ matrix.os }}
      jdk_distro: "zulu"
      jdk_version: ${{ matrix.jdk_version }}
      wolfssl_configure: ${{ matrix.wolfssl_configure }}

  # --------------- AddressSanitizer build and test ------------------
  # Run AddressSanitizer build and test on Linux only for memory error detection
  address-sanitizer:
    strategy:
      matrix:
        os: [ 'ubuntu-latest' ]
        jdk_version: [ '21' ]
        wolfssl_configure: [ '--enable-jni' ]
    name: AddressSanitizer (${{ matrix.os }} Zulu JDK ${{ matrix.jdk_version }})
    uses: ./.github/workflows/sanitizer-common.yml
    with:
      os: ${{ matrix.os }}
      jdk_distro: "zulu"
      jdk_version: ${{ matrix.jdk_version }}
      wolfssl_configure: ${{ matrix.wolfssl_configure }}

  # --------------- Filtered providers (native-free) -----------------
  # Build/test the filtered-providers ant targets and Maven profile.
  # JDK 8 added to verify it skips building filtered providers.
  filtered-providers:
    strategy:
      matrix:
        os: [ 'ubuntu-latest' ]
        jdk_version: [ '8', '11', '17', '21', '24', '25' ]
    name: Filtered Providers (${{ matrix.os }} Zulu JDK ${{ matrix.jdk_version }})
    uses: ./.github/workflows/filtered-providers.yml
    with:
      os: ${{ matrix.os }}
      jdk_distro: "zulu"
      jdk_version: ${{ matrix.jdk_version }}

  # ----------------- Windows Visual Studio build --------------------
  windows-build:
    uses: ./.github/workflows/windows-vs.yml