Install the macOS fuzz linker #10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: cpp-ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| linux: | |
| name: Ubuntu 24.04 / ${{ matrix.compiler }} | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 45 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| compiler: [g++, clang++] | |
| steps: | |
| - name: Check out C++ verifier | |
| uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 | |
| with: | |
| path: credbind-cpp | |
| - name: Install system prerequisites | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install --yes clang libssl-dev pkg-config | |
| - name: Fetch and verify the pinned conformance corpus | |
| working-directory: credbind-cpp | |
| env: | |
| GH_TOKEN: ${{ secrets.CREDBIND_CROSS_REPO_READ_TOKEN }} | |
| run: | | |
| test -n "$GH_TOKEN" || { echo "CREDBIND_CROSS_REPO_READ_TOKEN must grant read-only access to credbind/spec" >&2; exit 1; } | |
| artifact="$RUNNER_TEMP/credbind-ssh-v1-conformance-v1.0.0-rc.2.tar.gz" | |
| trap 'rm -f "$artifact"' EXIT | |
| gh release download v1.0.0-rc.2 --repo credbind/spec \ | |
| --pattern credbind-ssh-v1-conformance-v1.0.0-rc.2.tar.gz --output "$artifact" | |
| CREDBIND_FIXTURE_SOURCE="$artifact" make fixtures test-fixtures | |
| - name: Run strict deterministic and sanitizer gates | |
| working-directory: credbind-cpp | |
| env: | |
| CXX: ${{ matrix.compiler }} | |
| run: make check test-readme test-sanitize | |
| - name: Run Clang fuzz smoke | |
| if: matrix.compiler == 'clang++' | |
| working-directory: credbind-cpp | |
| env: | |
| CXX: clang++ | |
| run: make test-fuzz-smoke | |
| macos: | |
| name: macOS 15 arm64 / Apple Clang | |
| runs-on: macos-15 | |
| timeout-minutes: 45 | |
| steps: | |
| - name: Check out C++ verifier | |
| uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 | |
| with: | |
| path: credbind-cpp | |
| - name: Install and select Homebrew OpenSSL 3, LLVM and LLD | |
| run: | | |
| brew install llvm lld | |
| echo "PKG_CONFIG_PATH=$(brew --prefix openssl@3)/lib/pkgconfig" >> "$GITHUB_ENV" | |
| echo "FUZZ_CXX=$(brew --prefix llvm)/bin/clang++" >> "$GITHUB_ENV" | |
| echo "FUZZ_LDFLAGS=-fuse-ld=$(brew --prefix lld)/bin/ld64.lld" >> "$GITHUB_ENV" | |
| echo "LLVM_SYMBOLIZER=$(brew --prefix llvm)/bin/llvm-symbolizer" >> "$GITHUB_ENV" | |
| - name: Fetch and verify the pinned conformance corpus | |
| working-directory: credbind-cpp | |
| env: | |
| GH_TOKEN: ${{ secrets.CREDBIND_CROSS_REPO_READ_TOKEN }} | |
| run: | | |
| test -n "$GH_TOKEN" || { echo "CREDBIND_CROSS_REPO_READ_TOKEN must grant read-only access to credbind/spec" >&2; exit 1; } | |
| artifact="$RUNNER_TEMP/credbind-ssh-v1-conformance-v1.0.0-rc.2.tar.gz" | |
| trap 'rm -f "$artifact"' EXIT | |
| gh release download v1.0.0-rc.2 --repo credbind/spec \ | |
| --pattern credbind-ssh-v1-conformance-v1.0.0-rc.2.tar.gz --output "$artifact" | |
| CREDBIND_FIXTURE_SOURCE="$artifact" make fixtures test-fixtures | |
| - name: Run strict, sanitizer and fuzz gates | |
| working-directory: credbind-cpp | |
| run: make check test-readme test-sanitize test-fuzz-smoke |