From: William Lallemand <wlallemand@irq6.net>
Date: Tue, 6 Oct 2026 08:41:30 +0000 (+0200)
Subject: CI: github: test the latest AWS-LC release on development branches
X-Git-Tag: v3.5-dev9~195
X-Git-Url: https://git.kaiwu.me/$%7BGITURL%7D$%7Bcid%7D?a=commitdiff_plain;h=4bbcc74a2c8d3a85ba34b90a72e6d849454caf6f;p=haproxy.git

CI: github: test the latest AWS-LC release on development branches

Replace the AWS-LC 1.39.0 pin with latest-release discovery using the
existing determine_latest_aws_lc() helper. Add it alongside the other
latest SSL libraries in the development-only matrix list.

Remove the separate AWS-LC workflow now that the VTest matrix covers
the latest release and both LTS branches.
---

diff --git a/.github/matrix.py b/.github/matrix.py
index 01f01ce2a..9b7fa58b6 100755
--- a/.github/matrix.py
+++ b/.github/matrix.py
@@ -260,7 +260,6 @@ def main(ref_name):
             "OPENSSL_VERSION=3.5.1",
             "QUICTLS_VERSION=OpenSSL_1_1_1w-quic1",
             "WOLFSSL_VERSION=5.7.0",
-            "AWS_LC_VERSION=1.39.0",
             "AWS_LC_VERSION=branch-fips-2024-09-27",
             "AWS_LC_VERSION=branch-fips-2025-09-12-lts",
             # "BORINGSSL=yes",
@@ -270,6 +269,7 @@ def main(ref_name):
             ssl_versions = ssl_versions + [
                 "OPENSSL_VERSION=latest",
                 "LIBRESSL_VERSION=latest",
+                "AWS_LC_VERSION=latest",
             ]
 
         for ssl in ssl_versions:
@@ -285,6 +285,9 @@ def main(ref_name):
                 flags.append("SSL_INC=${HOME}/opt/include")
             if ssl.startswith("AWS_LC_VERSION=branch-"):
                 ssl, ssl_name = determine_aws_lc_branch(ssl)
+            if "AWS_LC" in ssl and "latest" in ssl:
+                ssl = determine_latest_aws_lc(ssl)
+                skipdup=1
             if "LIBRESSL" in ssl and "latest" in ssl:
                 ssl = determine_latest_libressl(ssl)
                 skipdup=1
diff --git a/.github/workflows/aws-lc.yml b/.github/workflows/aws-lc.yml
deleted file mode 100644
index 90b2b91c1..000000000
--- a/.github/workflows/aws-lc.yml
+++ /dev/null
@@ -1,99 +0,0 @@
-name: AWS-LC
-
-on:
-  schedule:
-    - cron: "0 0 * * 4"
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  Test:
-    name: ${{ matrix.name }}
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        include:
-          - name: AWS-LC
-            command: "from matrix import determine_latest_aws_lc; print(determine_latest_aws_lc(''))"
-          - name: AWS-LC (FIPS)
-            command: "from matrix import determine_latest_aws_lc_fips; print(determine_latest_aws_lc_fips(''))"
-    if: ${{ github.repository_owner == 'haproxy' || github.event_name == 'workflow_dispatch' }}
-    steps:
-      - uses: actions/checkout@v6
-      - name: Determine latest AWS-LC release
-        id: get_aws_lc_release
-        run: |
-          result=$(cd .github && python3  -c "${{ matrix.command }}")
-          echo $result
-          echo "result=$result" >> $GITHUB_OUTPUT
-      - name: Cache AWS-LC
-        id: cache_aws_lc
-        uses: actions/cache@v5
-        with:
-          path: '~/opt/'
-          key: ssl-${{ steps.get_aws_lc_release.outputs.result }}-Ubuntu-latest-gcc
-      - name: Install apt dependencies
-        run: |
-          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
-          sudo apt-get --no-install-recommends -y install socat gdb jose
-      - name: Install AWS-LC
-        if: ${{ steps.cache_ssl.outputs.cache-hit != 'true' }}
-        run: env ${{ steps.get_aws_lc_release.outputs.result }} scripts/build-ssl.sh
-      - name: Compile HAProxy
-        run: |
-          make -j$(nproc) ERR=1 CC=gcc TARGET=linux-glibc \
-            USE_OPENSSL_AWSLC=1 USE_QUIC=1 USE_ECH=1 \
-            SSL_LIB=${HOME}/opt/lib SSL_INC=${HOME}/opt/include \
-            DEBUG="-DDEBUG_POOL_INTEGRITY -DDEBUG_UNIT" \
-            ADDLIB="-Wl,-rpath,/usr/local/lib/ -Wl,-rpath,$HOME/opt/lib/"
-          sudo make install
-      - name: Show HAProxy version
-        id: show-version
-        run: |
-          ldd $(which haproxy)
-          haproxy -vv
-          echo "version=$(haproxy -vq)" >> $GITHUB_OUTPUT
-      - uses: ./.github/actions/setup-vtest
-      - name: Run VTest for HAProxy
-        id: vtest
-        run: |
-          make reg-tests VTEST_PROGRAM=${{ github.workspace }}/vtest/vtest REGTESTS_TYPES=default,bug,devel
-      - name: Run Unit tests
-        id: unittests
-        run: |
-          make unit-tests
-      - name: Show VTest results
-        if: ${{ failure() && steps.vtest.outcome == 'failure' }}
-        run: |
-          for folder in ${TMPDIR:-/tmp}/haregtests-*/vtc.*; do
-            printf "::group::"
-            cat $folder/INFO
-            cat $folder/LOG
-            echo "::endgroup::"
-          done
-          exit 1
-      - name: Show coredumps
-        if: ${{ failure() && steps.vtest.outcome == 'failure' }}
-        run: |
-          failed=false
-          shopt -s nullglob
-          for file in /tmp/core.*; do
-            failed=true
-            printf "::group::"
-            gdb -ex 'thread apply all bt full' ./haproxy $file
-            echo "::endgroup::"
-          done
-          if [ "$failed" = true ]; then
-            exit 1;
-          fi
-      - name: Show Unit-Tests results
-        if: ${{ failure() && steps.unittests.outcome == 'failure' }}
-        run: |
-          for result in ${TMPDIR:-/tmp}/ha-unittests-*/results/res.*; do
-            printf "::group::"
-            cat $result
-            echo "::endgroup::"
-          done
-          exit 1