.github/workflows/boring.yaml

name: package:boring
permissions:
  contents: read

on:
  # Run on PRs and pushes to the default branch.
  push:
    branches: [ main ]
    paths:
      - '.github/workflows/boring.yaml'
      - 'pkgs/boring/**'
  pull_request:
    branches: [ main ]
    paths:
      - '.github/workflows/boring.yaml'
      - 'pkgs/boring/**'
  schedule:
    - cron: "0 0 * * 0"
  # Also runs the refresh job.
  workflow_dispatch:

defaults:
  run:
    working-directory: pkgs/boring/

jobs:
  # Check code formatting and static analysis on a single OS (linux)
  # against Dart dev.
  analyze:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        sdk: [dev]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
      - uses: dart-lang/setup-dart@7654d458321ee25acccccfdb86cd48bd95768ff1
        with:
          sdk: ${{ matrix.sdk }}
      - id: install
        name: Install dependencies
        run: dart pub get
      - name: Check formatting
        run: dart format --output=none --set-exit-if-changed .
        if: always() && steps.install.outcome == 'success'
      - name: Analyze code
        run: dart analyze --fatal-infos
        if: always() && steps.install.outcome == 'success'
      # The `fetch` build mode downloads the libraries pinned in hashes.dart,
      # which boring_binaries.yaml builds from the native sources on main. A
      # release of package:boring mustn't ship libraries built from other
      # sources than the ones it vendors, so this fails once the version is no
      # longer a -wip one.
      - name: Check that the prebuilt libraries match the native sources
        if: always() && steps.install.outcome == 'success'
        run: |
          source_commit="$(sed -n "s/^const sourceCommit = '\([0-9a-f]*\)';$/\1/p" lib/src/hook_helpers/hashes.dart)"
          stale=false
          if [ -z "$source_commit" ]; then
            stale=true
            message="The prebuilt libraries pinned in lib/src/hook_helpers/hashes.dart weren't built from this repository."
          else
            git fetch --quiet --depth=1 origin "$source_commit"
            if ! git diff --quiet "$source_commit" HEAD -- src third_party/boringssl tool/REVISION; then
              stale=true
              message="src/, third_party/boringssl/ or tool/REVISION changed since the prebuilt libraries pinned in lib/src/hook_helpers/hashes.dart were built at $source_commit."
            fi
          fi
          if [ "$stale" = true ]; then
            message="$message The 'package:boring binaries' workflow builds and pins new ones when such a change lands on main; merge its pull request before releasing."
            if grep -Eq '^version: .*-wip$' pubspec.yaml; then
              echo "::warning::$message"
            else
              echo "::error::$message"
              exit 1
            fi
          else
            echo "The prebuilt libraries were built from the current native sources ($source_commit)."
          fi

  # Build BoringSSL from source with the build hook and run the tests on each
  # desktop OS. The tree-shaking tests run hook/link.dart natively and when
  # cross-compiling to Linux, whose linker invocation differs per OS.
  test:
    needs: analyze
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        sdk: [stable]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
      - uses: dart-lang/setup-dart@7654d458321ee25acccccfdb86cd48bd95768ff1
        with:
          sdk: ${{ matrix.sdk }}
      - name: Setup NASM
        if: runner.os == 'Windows'
        uses: ilammy/setup-nasm@72793074d3c8cdda771dba85f6deafe00623038b
      - name: Install Linux cross toolchain (Linux)
        if: runner.os == 'Linux'
        run: sudo apt-get update && sudo apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
      # A third-party tap, which Homebrew can't pin, unlike the Windows download
      # below. It only links the test's cross-compiled example, never anything
      # that is released.
      - name: Install Linux cross toolchain (macOS)
        if: runner.os == 'macOS'
        run: brew install messense/macos-cross-toolchains/aarch64-unknown-linux-gnu
      - name: Install Linux cross toolchain (Windows)
        if: runner.os == 'Windows'
        shell: bash
        env:
          TOOLCHAIN_URL: https://developer.arm.com/-/media/Files/downloads/gnu/14.2.rel1/binrel/arm-gnu-toolchain-14.2.rel1-mingw-w64-x86_64-aarch64-none-linux-gnu.zip
          # From the .sha256asc file published next to the zip.
          TOOLCHAIN_SHA256: 9428b2039923916418ec7037025be8cec3202926d65db9452519977834ad2a89
        run: |
          curl -fSL -o "$RUNNER_TEMP/arm-gnu-toolchain.zip" "$TOOLCHAIN_URL"
          actual="$(sha256sum < "$RUNNER_TEMP/arm-gnu-toolchain.zip" | cut -d' ' -f1)"
          if [ "$actual" != "$TOOLCHAIN_SHA256" ]; then
            echo "::error::Expected SHA-256 $TOOLCHAIN_SHA256 for $TOOLCHAIN_URL, got $actual."
            exit 1
          fi
          7z x "$RUNNER_TEMP/arm-gnu-toolchain.zip" -o"$RUNNER_TEMP/arm-gnu-toolchain" -y >/dev/null
          BIN_DIR="$RUNNER_TEMP/arm-gnu-toolchain/bin"
          for f in "$BIN_DIR"/aarch64-none-linux-gnu-*.exe; do
            cp "$f" "${f/aarch64-none-linux-gnu-/aarch64-linux-gnu-}"
          done
          cygpath -w "$BIN_DIR" >> "$GITHUB_PATH"
      - id: install
        name: Install dependencies
        run: dart pub get
      - name: Run tests
        run: dart test
        if: always() && steps.install.outcome == 'success'

  # Check the bundled BoringSSL and the bindings against Project Wycheproof.
  conformance:
    needs: analyze
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
      - uses: dart-lang/setup-dart@7654d458321ee25acccccfdb86cd48bd95768ff1
        with:
          sdk: stable
      - name: Install dependencies
        run: dart pub get
      - name: Run Wycheproof conformance tests
        run: ./tool/run_conformance_tests.sh

  # Check X.509 path validation against x509-limbo.
  x509-limbo:
    needs: analyze
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
      - uses: dart-lang/setup-dart@7654d458321ee25acccccfdb86cd48bd95768ff1
        with:
          sdk: stable
      - name: Install dependencies
        run: dart pub get
      # limbo.json is ~40 MB, and the revision is pinned in the runner script.
      - name: Cache x509-limbo testcases
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
        with:
          path: pkgs/boring/build/x509-limbo
          key: x509-limbo-${{ hashFiles('pkgs/boring/tool/run_x509_limbo_tests.sh') }}
      - name: Run x509-limbo conformance tests
        run: ./tool/run_x509_limbo_tests.sh

  # Re-run the vendoring script at the pinned revision, which also regenerates
  # the bindings, and fail if that changes anything. This keeps the checked-in
  # sources and bindings in sync with tool/REVISION.
  generated:
    # The bindings include struct layouts from the glibc headers, so they are
    # generated on a fixed image. Keep in sync with the refresh job.
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
      - uses: dart-lang/setup-dart@7654d458321ee25acccccfdb86cd48bd95768ff1
        with:
          sdk: dev
      - name: Regenerate at tool/REVISION
        run: ./tool/bump-boringssl-revision.sh "$(cat tool/REVISION)"
      # Also checks that every prebuilt target's asset exists in the pinned
      # release, since `fetch` silently compiles from source for a target
      # without a hash.
      - name: Regenerate the hashes of the pinned release
        run: dart run tool/regenerate_hashes.dart
      - name: Check for changes
        run: |
          if [ -n "$(git status --porcelain -- .)" ]; then
            git status --short -- .
            echo "::error::Generated files are out of date. Run ./tool/bump-boringssl-revision.sh \"\$(cat tool/REVISION)\" and dart run tool/regenerate_hashes.dart in pkgs/boring and commit the result."
            exit 1
          fi

  # Weekly (and on manual runs), update BoringSSL to its latest revision and
  # open a PR if anything changed. The Dart Bot token is needed so that the
  # PR's CI runs.
  refresh:
    if: >-
      github.repository_owner == 'dart-lang' &&
      (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
    # Keep in sync with the generated job.
    runs-on: ubuntu-24.04
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Generate Dart Bot token
        id: generate-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
        with:
          client-id: ${{ vars.ECOSYSTEM_BOT_CLIENT_ID }}
          private-key: ${{ secrets.ECOSYSTEM_BOT_PRIVATE_KEY }}
          permission-contents: write
          permission-pull-requests: write
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          token: ${{ steps.generate-token.outputs.token }}
          persist-credentials: false
      - uses: dart-lang/setup-dart@7654d458321ee25acccccfdb86cd48bd95768ff1
        with:
          sdk: dev
      - name: Update BoringSSL
        id: refresh
        run: ./tool/bump-boringssl-revision.sh
      - name: Check for changes
        id: check_changes
        run: |
          if [ -n "$(git status --porcelain -- .)" ]; then
            echo "changed=true" >> "$GITHUB_OUTPUT"
          else
            echo "changed=false" >> "$GITHUB_OUTPUT"
          fi
      - name: Install changelog updater
        if: steps.check_changes.outputs.changed == 'true'
        run: |
          dart install --git-path pkgs/repo_manage https://github.com/dart-lang/ecosystem.git
          echo "$HOME/.local/state/Dart/install/bin" >> "$GITHUB_PATH"
      - name: Update changelog
        if: steps.check_changes.outputs.changed == 'true'
        run: report changelog "Update BoringSSL to ${SHORT_REVISION}."
        env:
          SHORT_REVISION: ${{ steps.refresh.outputs.short_revision }}
      - name: Create pull request
        if: steps.check_changes.outputs.changed == 'true'
        uses: peter-evans/create-pull-request@653ba8b281fa5e1ee78ec20dda96cf9a79102c04
        with:
          token: ${{ steps.generate-token.outputs.token }}
          committer: dart-ecosystem-bot <dart-ecosystem-bot@google.com>
          author: dart-ecosystem-bot <dart-ecosystem-bot@google.com>
          add-paths: pkgs/boring
          commit-message: "[boring] Update BoringSSL to ${{ steps.refresh.outputs.short_revision }}"
          branch: "boring-update-boringssl-${{ steps.refresh.outputs.short_revision }}"
          title: "[boring] Update BoringSSL to ${{ steps.refresh.outputs.short_revision }}"
          body: >-
            Automated update to the latest BoringSSL revision
            [`${{ steps.refresh.outputs.revision }}`](https://boringssl.googlesource.com/boringssl/+/${{ steps.refresh.outputs.revision }}),
            generated by `pkgs/boring/tool/bump-boringssl-revision.sh`.
          delete-branch: true