CI: github: cache QuicTLS builds

Resolve the QuicTLS ref to a commit SHA when generating the VTest
matrix and include it in the SSL build inputs and cache key. Keep job
labels readable by showing the ref and an eight-character SHA.

Fetch and check out the resolved commit in build-ssl.sh while retaining
QUICTLS_VERSION for the OpenSSL 1.1.1 build target selection. Preserve
the existing download behavior when QUICTLS_COMMIT is unset.

Enable SSL caching for QuicTLS.

diff --git a/.github/matrix.py b/.github/matrix.py
index 9b7fa58b656c9ce963c62378241cc60a326adaaa..03da1c14eaf553851beee72e02f6c27732e61aeb 100755 (executable)
--- a/.github/matrix.py
+++ b/.github/matrix.py
@@ -100,6 +100,19 @@ def determine_aws_lc_branch(ssl):
     release = re.search(r'^#define AWSLC_VERSION_NUMBER_STRING "([^"]+)"', header, re.MULTILINE).group(1)
     return "AWS_LC_VERSION=git-{}".format(sha), "AWS_LC_VERSION={}+{}".format(release, sha[:8])
 
+@functools.lru_cache(5)
+def determine_quictls_commit(ssl):
+    ref = ssl.split("=", 1)[1]
+    headers = {}
+    if environ.get("GITHUB_TOKEN") is not None:
+        headers["Authorization"] = "token {}".format(environ.get("GITHUB_TOKEN"))
+    url = "https://api.github.com/repos/quictls/openssl/commits/{}".format(ref)
+    request = urllib.request.Request(url, headers=headers)
+    with urllib.request.urlopen(request) as response:
+        commit = json.loads(response.read().decode("utf-8"))
+    sha = commit["sha"]
+    return "{} QUICTLS_COMMIT={}".format(ssl, sha), "{}+{}".format(ssl, sha[:8])
+
 def aws_lc_fips_version_string_to_num(version_string):
     return tuple(map(int, version_string[12:].split('.')))
 
@@ -283,6 +296,8 @@ def main(ref_name):
             if ssl != "stock":
                 flags.append("SSL_LIB=${HOME}/opt/lib")
                 flags.append("SSL_INC=${HOME}/opt/include")
+            if ssl.startswith("QUICTLS_VERSION="):
+                ssl, ssl_name = determine_quictls_commit(ssl)
             if ssl.startswith("AWS_LC_VERSION=branch-"):
                 ssl, ssl_name = determine_aws_lc_branch(ssl)
             if "AWS_LC" in ssl and "latest" in ssl:

diff --git a/.github/workflows/vtest.yml b/.github/workflows/vtest.yml
index 74aa89d2b19e0fa51b4da5d5e6102c921b405c68..f1af2d8e1ee70614c99f7f8a18a99ef772e15960 100644 (file)
--- a/.github/workflows/vtest.yml
+++ b/.github/workflows/vtest.yml
@@ -58,7 +58,7 @@ jobs:
         echo "key=$(echo ${{ matrix.name }} ${{ matrix.ssl }} | sha256sum | awk '{print $1}')" >> $GITHUB_OUTPUT
 
     - name: Cache SSL libs
-      if: ${{ matrix.ssl && matrix.ssl != 'stock' && matrix.ssl != 'BORINGSSL=yes' && !contains(matrix.ssl, 'QUICTLS') }}
+      if: ${{ matrix.ssl && matrix.ssl != 'stock' && matrix.ssl != 'BORINGSSL=yes' }}
       id: cache_ssl
       uses: actions/cache@v5
       with:

diff --git a/scripts/build-ssl.sh b/scripts/build-ssl.sh
index 9c3627c6926ed977f5ef62256b438a59d652340e..5421b055554f6f9949e80ba2768a0843222c36ad 100755 (executable)
--- a/scripts/build-ssl.sh
+++ b/scripts/build-ssl.sh
@@ -197,7 +197,15 @@ build_aws_lc_fips () {
 }
 
 download_quictls () {
-    if [ ! -d "${BUILDSSL_TMPDIR}/quictls" ]; then
+    if [ -n "${QUICTLS_COMMIT:-}" ]; then
+        mkdir -p "${BUILDSSL_TMPDIR}/quictls"
+        (
+            cd "${BUILDSSL_TMPDIR}/quictls"
+            git init
+            git fetch --depth=1 "${QUICTLS_URL}" "${QUICTLS_COMMIT}"
+            git checkout --detach "${QUICTLS_COMMIT}"
+        )
+    elif [ ! -d "${BUILDSSL_TMPDIR}/quictls" ]; then
         git clone -b "${QUICTLS_VERSION}" --depth=1 ${QUICTLS_URL} ${BUILDSSL_TMPDIR}/quictls
     else
        (