Repository navigation
Fix BIT STRING unused-bits byte in PKCS#8 v2 publicKey (RFC 5958) #8143
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Check Source Text | |
| # Source-hygiene + shell-script lint. Runs on drafts too - fast feedback. | |
| # | |
| # Checks: | |
| # * check-source-text.sh: trailing whitespace, hard tabs in C/H, CRLF, | |
| # BOM / non-ASCII. | |
| # * bash -n + shellcheck (warning level) on shell scripts. | |
| # * check-workflows.py: every `run:` step against GitHub's 21000 | |
| # character cap, past which GitHub stops loading the workflow file | |
| # altogether and its runs fail in 0s with zero jobs. | |
| # * check-ci-deps.py: every install-apt-deps call against the .deb bundle | |
| # it names, since a package missing from the bundle costs that job the | |
| # apt mirror without failing anything. | |
| # | |
| # Scope: | |
| # * pull_request: only files changed in the PR (catches new violations | |
| # without failing on historical debt). | |
| # * push: scan the full tree (baseline guard on master). | |
| on: | |
| push: | |
| branches: [ master, main ] | |
| pull_request: | |
| types: [opened, synchronize, reopened, ready_for_review] | |
| branches: [ master, main ] | |
| concurrency: | |
| group: check-source-text-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| check: | |
| # Only run from the wolfssl org to avoid burning forks' CI minutes. | |
| if: github.repository_owner == 'wolfssl' | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 5 | |
| steps: | |
| # The PR merge commit and its base parent are all the diff needs. | |
| - uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 2 | |
| # python3-yaml backs check-workflows.py, which measures run: steps | |
| # from the parsed YAML rather than from the raw text. | |
| - name: Install shellcheck | |
| uses: ./.github/actions/install-apt-deps | |
| with: | |
| # Fit the loop inside this job's timeout-minutes. | |
| budget-seconds: '120' | |
| pull-timeout: '60' | |
| packages: shellcheck python3-yaml | |
| ghcr-debs-tag: ubuntu-24.04-full | |
| - name: Collect files to check | |
| id: files | |
| run: | | |
| if [ "${{ github.event_name }}" = "pull_request" ]; then | |
| git diff --name-only --diff-filter=ACMR HEAD^1 HEAD > changed.txt | |
| # .test too: the automake test scripts under scripts/ are shell, | |
| # and were silently skipping both gates below. | |
| # IDE/GCC-ARM/Makefile.test is a Makefile, not a shell script. | |
| grep -E '\.(sh|test)$' changed.txt \ | |
| | grep -v -E '(^|/)Makefile\.test$' > changed-sh.txt || true | |
| echo "Files changed in PR:" | |
| cat changed.txt | |
| echo "Shell scripts changed (.sh/.test):" | |
| cat changed-sh.txt | |
| echo "count=$(wc -l < changed.txt)" >> "$GITHUB_OUTPUT" | |
| echo "sh_count=$(wc -l < changed-sh.txt)" >> "$GITHUB_OUTPUT" | |
| else | |
| : > changed.txt | |
| git ls-files '*.sh' '*.test' \ | |
| | grep -v -E '(^|/)Makefile\.test$' > changed-sh.txt || true | |
| echo "count=0" >> "$GITHUB_OUTPUT" | |
| echo "sh_count=$(wc -l < changed-sh.txt)" >> "$GITHUB_OUTPUT" | |
| fi | |
| # Always over the whole set, not just PR-changed files: the cap is a | |
| # property of each file on its own, the check takes well under a | |
| # second for the ~110 of them, and a workflow can be pushed over the | |
| # line by a change to a file the PR does not otherwise touch. | |
| - name: Lint workflow files | |
| run: ./.github/scripts/check-workflows.py | |
| # Same reasoning as above: over the whole set, because a package list | |
| # and the workflow that consumes it are rarely touched by one PR. | |
| - name: Check the ci-deps bundle contract | |
| run: ./.github/scripts/check-ci-deps.py | |
| - name: Run check-source-text (PR changed files) | |
| if: github.event_name == 'pull_request' && steps.files.outputs.count != '0' | |
| run: | | |
| # shellcheck disable=SC2046 | |
| ./.github/scripts/check-source-text.sh $(cat changed.txt) | |
| - name: Run check-source-text (full tree) | |
| if: github.event_name != 'pull_request' | |
| run: ./.github/scripts/check-source-text.sh | |
| - name: bash -n (syntax check) | |
| if: steps.files.outputs.sh_count != '0' | |
| run: | | |
| fail=0 | |
| while IFS= read -r f; do | |
| [ -f "$f" ] || continue | |
| if ! bash -n "$f"; then | |
| echo "::error file=$f::bash -n syntax error" | |
| fail=1 | |
| fi | |
| done < changed-sh.txt | |
| exit "$fail" | |
| - name: shellcheck (warning level) | |
| if: steps.files.outputs.sh_count != '0' | |
| run: | | |
| # Mirrors the internal multi-test check-shell-scripts subtest: | |
| # --severity=warning | |
| # -e SC2226,SC2166,SC2164,SC2046,SC2034,SC2188,SC2043 | |
| # SC2226 (no ln destination), SC2166 ([ p -a q ]), SC2164 (cd ||), | |
| # SC2046 (word splitting), SC2034 (unused var), SC2188 (redirect | |
| # w/o command), SC2043 (loop runs once) - common in this codebase, | |
| # suppressed in the internal multi-test for the same reason. | |
| fail=0 | |
| while IFS= read -r f; do | |
| [ -f "$f" ] || continue | |
| if ! shellcheck --severity=warning \ | |
| --exclude=SC2226,SC2166,SC2164,SC2046,SC2034,SC2188,SC2043 \ | |
| --format=gcc "$f"; then | |
| fail=1 | |
| fi | |
| done < changed-sh.txt | |
| exit "$fail" |