Commit 03cd9dafab for openssl.org
commit 03cd9dafab20e82f2c902dc4100e64a0440f93ca
Author: Dmitry Misharov <dmitry@openssl.org>
Date: Tue Oct 6 15:39:51 2026 +0200
CI: run zero-yield jobs nightly instead of on every push
These jobs build configurations that, from May to October 2026, never
failed on master when the other push jobs passed, so they cost runner
time on every push and pull request without adding signal. Run the
whole compiler-zoo workflow, and the moved ci.yml, run-checker-merge
and windows.yml jobs, once a day; the latter in a new Nightly CI
workflow. mingw64 is a primary platform, so the MSYS2 UCRT64 build stays
on every pull request. Drop the run-checker-merge options and the plain
libFuzzer leg that other jobs already cover, and the duplicate
no-shared option in run-checker-daily.
Assisted-by: Claude:claude-opus-5-5
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Bob Beck <beck@openssl.org>
Merge-date: Wed Oct 21 16:56:52 2026
Merged-from: https://github.com/openssl/openssl/pull/33125
diff --git a/.github/workflows/ci-nightly.yml b/.github/workflows/ci-nightly.yml
new file mode 100644
index 0000000000..a5731bd9c5
--- /dev/null
+++ b/.github/workflows/ci-nightly.yml
@@ -0,0 +1,227 @@
+# Copyright 2026 The OpenSSL Project Authors. All Rights Reserved.
+#
+# Licensed under the Apache License 2.0 (the "License"). You may not use
+# this file except in compliance with the License. You can obtain a copy
+# in the file LICENSE in the source distribution or at
+# https://www.openssl.org/source/license.html
+
+# Configurations that used to run on every push and pull request but, over
+# May to October 2026, never failed when the other jobs passed. They run once
+# a day instead. See https://github.com/openssl/project/issues/2071
+
+name: Nightly CI
+
+on:
+ schedule:
+ - cron: '45 02 * * *'
+ workflow_dispatch:
+
+permissions:
+ contents: read
+
+jobs:
+ non-caching:
+ if: github.event_name == 'workflow_dispatch' || github.repository == 'openssl/openssl'
+ runs-on: ubuntu-latest
+ env:
+ OSSL_RUN_CI_TESTS: 1
+ steps:
+ - uses: actions/checkout@v7
+ with:
+ persist-credentials: false
+ - name: checkout fuzz/corpora submodule
+ run: git submodule update --init --depth 1 fuzz/corpora
+ - name: Adjust ASLR for sanitizer
+ run: |
+ sudo cat /proc/sys/vm/mmap_rnd_bits
+ sudo sysctl -w vm.mmap_rnd_bits=28
+ - name: config
+ run: ./config --strict-warnings --banner=Configured --debug enable-demos enable-h3demo enable-asan enable-ubsan no-cached-fetch no-fips no-dtls no-tls1 no-tls1-method no-tls1_1 no-tls1_1-method no-async && perl configdata.pm --dump
+ - name: make
+ run: make -s -j4
+ - name: get cpu info
+ run: |
+ cat /proc/cpuinfo
+ ./util/opensslwrap.sh version -c
+ - name: make test
+ run: .github/workflows/make-test OPENSSL_TEST_RAND_ORDER=0 TESTS="-test_fuzz* -test_ssl_* -test_sslapi -test_evp -test_cmp_http -test_verify -test_cms -test_store -test_enc -[01][0-9]"
+ - name: save artifacts
+ if: success() || failure()
+ uses: actions/upload-artifact@v5
+ with:
+ name: "ci@non-caching"
+ path: artifacts.tar.gz
+
+ full_featured:
+ if: github.event_name == 'workflow_dispatch' || github.repository == 'openssl/openssl'
+ runs-on: ubuntu-latest
+ env:
+ OSSL_RUN_CI_TESTS: 1
+ steps:
+ - uses: actions/checkout@v7
+ with:
+ persist-credentials: false
+ - name: checkout fuzz/corpora submodule
+ run: git submodule update --init --depth 1 fuzz/corpora
+ - name: modprobe tls
+ run: sudo modprobe tls
+ - name: Enable sctp
+ run: sudo modprobe sctp
+ - name: Enable auth in sctp
+ run: sudo sysctl -w net.sctp.auth_enable=1
+ - name: install extra config support
+ run: sudo apt-get -y install libsctp-dev abigail-tools libzstd-dev zstd
+ - name: config
+ run: ./config --strict-warnings --banner=Configured enable-demos enable-h3demo enable-ec_explicit_curves enable-ktls enable-fips enable-lms enable-egd enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-sctp enable-weak-ssl-ciphers enable-trace enable-zlib enable-zstd && perl configdata.pm --dump
+ - name: make
+ run: make -s -j4
+ - name: get cpu info
+ run: |
+ cat /proc/cpuinfo
+ ./util/opensslwrap.sh version -c
+ - name: make test
+ run: .github/workflows/make-test
+ - name: save artifacts
+ if: success() || failure()
+ uses: actions/upload-artifact@v5
+ with:
+ name: "ci@full_featured"
+ path: artifacts.tar.gz
+
+ threads_sanitizer_atomic_fallback:
+ if: github.event_name == 'workflow_dispatch' || github.repository == 'openssl/openssl'
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@v7
+ with:
+ persist-credentials: false
+ - name: checkout fuzz/corpora submodule
+ run: git submodule update --init --depth 1 fuzz/corpora
+ - name: Adjust ASLR for sanitizer
+ run: |
+ sudo cat /proc/sys/vm/mmap_rnd_bits
+ sudo sysctl -w vm.mmap_rnd_bits=28
+ - name: config
+ run: CC=clang ./config --strict-warnings --banner=Configured no-shared no-fips -g -fsanitize=thread -DBROKEN_CLANG_ATOMICS && perl configdata.pm --dump
+ - name: make
+ run: make -s -j4
+ - name: get cpu info
+ run: |
+ cat /proc/cpuinfo
+ ./util/opensslwrap.sh version -c
+ - name: make test
+ run: make test V=1 TESTS="test_lhash test_threads test_internal_provider test_provfetch test_provider test_pbe test_evp_kdf test_pkcs12 test_store test_evp test_quic* test_dtls_listener_races"
+
+ cygwin:
+ if: github.event_name == 'workflow_dispatch' || github.repository == 'openssl/openssl'
+ # Run a job for each of the specified target architectures:
+ strategy:
+ matrix:
+ os:
+ - windows-2022
+ platform:
+ - arch: win64
+ config: -DCMAKE_C_COMPILER=gcc --strict-warnings enable-demos no-fips
+ runs-on: ${{ matrix.os }}
+ env:
+ CYGWIN_NOWINPATH: 1
+ SHELLOPTS: igncr
+# Don't overwhelm github CI VMs:
+ MAKE_PARAMS: -s -j 4
+ steps:
+# Checkout before cygwin can mess with PATH...
+ - uses: actions/checkout@v7
+ with:
+ persist-credentials: false
+ - uses: cygwin/cygwin-install-action@f2009323764960f80959895c7bc3bb30210afe4d #v6
+ with:
+ packages: perl git make gcc-core
+ - name: Check repo
+ run: cygcheck -V
+ - name: Full cygcheck status
+ run: cygcheck -s -v -r -h
+ - name: Full build
+ shell: bash
+ run: |
+ gcc --version
+ ./config ${{ matrix.platform.config }}
+ make $MAKE_PARAMS
+# Disable testing for now. TBD: Need local cygwin installation to debug .
+# - name: Run openssl tests
+# run: bash -c "cd openssl && make V=1 test"
+
+ msys2-mingw64:
+ if: github.event_name == 'workflow_dispatch' || github.repository == 'openssl/openssl'
+ strategy:
+ matrix:
+ platform:
+ - arch: CLANG64
+ cc: clang
+ pkgs: mingw-w64-clang-x86_64-clang
+ config: mingw64
+ runs-on: windows-latest
+ env:
+ CC: ${{ matrix.platform.cc }}
+ MSYSTEM: ${{ matrix.platform.arch }}
+ CHERE_INVOKING: 'yes'
+ steps:
+ - uses: actions/checkout@v7
+ with:
+ persist-credentials: false
+ - name: install MSYS2
+ run: |
+ $url = 'https://github.com/msys2/msys2-installer/releases/download/nightly-x86_64/msys2-base-x86_64-latest.sfx.exe'
+ (New-Object System.Net.WebClient).DownloadFile($url, 'msys2.exe')
+ # Remove preinstalled MSYS2
+ if (Test-Path C:\msys64) { Remove-Item -Recurse -Force C:\msys64 }
+ .\msys2.exe -y -oC:\
+ Remove-Item msys2.exe
+
+ - name: update MSYS2
+ run: |
+ C:\msys64\usr\bin\bash.exe -lc ' '
+ # Update core and then normal update
+ C:\msys64\usr\bin\bash.exe -lc 'pacman --noconfirm -Syuu'
+ C:\msys64\usr\bin\bash.exe -lc 'pacman --noconfirm -Syuu'
+
+ - name: install dependencies
+ run: C:\msys64\usr\bin\bash.exe -lc 'pacman --noconfirm -S --needed perl git make ${{ matrix.platform.pkgs }}'
+
+ - name: config
+ run: C:\msys64\usr\bin\bash.exe -lc './config --strict-warnings --banner=Configured ${{ matrix.platform.config }}'
+
+ - name: make
+ run: C:\msys64\usr\bin\bash.exe -lc 'make -j4 -s'
+# Tests are broken for now
+# - name: test
+# run: C:\msys64\usr\bin\bash.exe -lc 'make test'
+
+ mingw64:
+ if: github.event_name == 'workflow_dispatch' || github.repository == 'openssl/openssl'
+ strategy:
+ matrix:
+ platform:
+ - arch: mingw64
+ target: x86_64
+ # Avoid MINGW bug in headers. Remove when CI is upgraded.
+ config: enable-demos -Wno-array-bounds
+ - arch: mingw
+ target: i686
+ config: -Wno-array-bounds -Wno-stringop-overflow
+ runs-on: ubuntu-latest
+ env:
+ CC: ${{ matrix.platform.target }}-w64-mingw32-gcc
+ CXX: ${{ matrix.platform.target }}-w64-mingw32-g++
+ AR: ${{ matrix.platform.target }}-w64-mingw32-ar
+ RANLIB: ${{ matrix.platform.target }}-w64-mingw32-ranlib
+ RC: ${{ matrix.platform.target }}-w64-mingw32-windres
+ steps:
+ - uses: actions/checkout@v6
+ with:
+ persist-credentials: false
+ - name: install MINGW64
+ run: sudo apt-get install -y mingw-w64
+ - name: config
+ run: ./config ${{ matrix.platform.arch }} --strict-warnings --banner=Configured ${{ matrix.platform.config }}
+ - name: make
+ run: make -j4 -s
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6ea3d90fbb..e048b9b0cc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -384,35 +384,6 @@ jobs:
name: "ci@no-shared-macos-14"
path: artifacts.tar.gz
- non-caching:
- runs-on: ubuntu-latest
- steps:
- - uses: actions/checkout@v6
- with:
- persist-credentials: false
- - name: checkout fuzz/corpora submodule
- run: git submodule update --init --depth 1 fuzz/corpora
- - name: Adjust ASLR for sanitizer
- run: |
- sudo cat /proc/sys/vm/mmap_rnd_bits
- sudo sysctl -w vm.mmap_rnd_bits=28
- - name: config
- run: ./config --strict-warnings --banner=Configured --debug enable-demos enable-h3demo enable-asan enable-ubsan no-cached-fetch no-fips no-dtls no-tls1 no-tls1-method no-tls1_1 no-tls1_1-method no-async && perl configdata.pm --dump
- - name: make
- run: make -s -j4
- - name: get cpu info
- run: |
- cat /proc/cpuinfo
- ./util/opensslwrap.sh version -c
- - name: make test
- run: .github/workflows/make-test OPENSSL_TEST_RAND_ORDER=0 TESTS="-test_fuzz* -test_ssl_* -test_sslapi -test_evp -test_cmp_http -test_verify -test_cms -test_store -test_enc -[01][0-9]"
- - name: save artifacts
- if: success() || failure()
- uses: actions/upload-artifact@v5
- with:
- name: "ci@non-caching"
- path: artifacts.tar.gz
-
address_ub_sanitizer:
runs-on: ubuntu-latest
steps:
@@ -442,7 +413,6 @@ jobs:
name: "ci@address_ub_sanitizer"
path: artifacts.tar.gz
- # Same configuration as the run-checker-merge variant, promoted to per-PR CI.
# no-asm builds the sanitizer-instrumented C fallback primitives (e.g. the
# OPENSSL_cleanse() C implementation), which the asm-enabled asan job above
# cannot observe; keep both, as each covers C code the other does not build.
@@ -629,39 +599,6 @@ jobs:
name: "ci@enable_non-default_options"
path: artifacts.tar.gz
- full_featured:
- runs-on: ubuntu-latest
- steps:
- - uses: actions/checkout@v6
- with:
- persist-credentials: false
- - name: checkout fuzz/corpora submodule
- run: git submodule update --init --depth 1 fuzz/corpora
- - name: modprobe tls
- run: sudo modprobe tls
- - name: Enable sctp
- run: sudo modprobe sctp
- - name: Enable auth in sctp
- run: sudo sysctl -w net.sctp.auth_enable=1
- - name: install extra config support
- run: sudo apt-get -y install libsctp-dev abigail-tools libzstd-dev zstd
- - name: config
- run: ./config --strict-warnings --banner=Configured enable-demos enable-h3demo enable-ec_explicit_curves enable-ktls enable-fips enable-lms enable-egd enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-sctp enable-weak-ssl-ciphers enable-trace enable-zlib enable-zstd && perl configdata.pm --dump
- - name: make
- run: make -s -j4
- - name: get cpu info
- run: |
- cat /proc/cpuinfo
- ./util/opensslwrap.sh version -c
- - name: make test
- run: .github/workflows/make-test
- - name: save artifacts
- if: success() || failure()
- uses: actions/upload-artifact@v5
- with:
- name: "ci@full_featured"
- path: artifacts.tar.gz
-
legacy:
runs-on: ubuntu-latest
steps:
diff --git a/.github/workflows/compiler-zoo.yml b/.github/workflows/compiler-zoo.yml
index 72d42a9883..eb475a573b 100644
--- a/.github/workflows/compiler-zoo.yml
+++ b/.github/workflows/compiler-zoo.yml
@@ -8,7 +8,8 @@
name: Compiler Zoo CI
on:
- push:
+ schedule:
+ - cron: '45 02 * * *'
workflow_dispatch:
inputs:
pr:
@@ -51,6 +52,7 @@ jobs:
gcc:
needs: [validate-dispatch-inputs]
if: |
+ (github.event_name != 'schedule' || github.repository == 'openssl/openssl') &&
!cancelled() &&
(needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
strategy:
@@ -88,6 +90,7 @@ jobs:
vs2013:
needs: [validate-dispatch-inputs]
if: |
+ (github.event_name != 'schedule' || github.repository == 'openssl/openssl') &&
!cancelled() &&
(needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
strategy:
@@ -148,6 +151,7 @@ jobs:
clang:
needs: [validate-dispatch-inputs]
if: |
+ (github.event_name != 'schedule' || github.repository == 'openssl/openssl') &&
!cancelled() &&
(needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
strategy:
diff --git a/.github/workflows/fuzz-checker.yml b/.github/workflows/fuzz-checker.yml
index 3f7f864976..449f1089c1 100644
--- a/.github/workflows/fuzz-checker.yml
+++ b/.github/workflows/fuzz-checker.yml
@@ -23,14 +23,6 @@ jobs:
config: enable-fuzz-afl no-module,
install: afl++,
cc: afl-clang-fast
- }, {
- name: libFuzzer,
- config: enable-fuzz-libfuzzer enable-asan enable-ubsan -fno-sanitize=function,
- libs: --with-fuzzer-lib=/usr/lib/llvm-18/lib/libFuzzer.a --with-fuzzer-include=/usr/include/clang/18/include/fuzzer,
- install: libfuzzer-18-dev,
- cc: clang-18,
- linker: clang++-18,
- tests: -test_memleak
}, {
name: libFuzzer+,
config: enable-fuzz-libfuzzer enable-asan enable-ubsan -fno-sanitize=function -fsanitize-coverage=trace-cmp -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION,
diff --git a/.github/workflows/run-checker-daily.yml b/.github/workflows/run-checker-daily.yml
index 46f5cef261..ecdad30f9e 100644
--- a/.github/workflows/run-checker-daily.yml
+++ b/.github/workflows/run-checker-daily.yml
@@ -133,7 +133,6 @@ jobs:
no-scrypt,
no-secure-memory,
no-seed,
- no-shared,
no-siphash,
no-siv,
no-sm2-precomp,
diff --git a/.github/workflows/run-checker-merge.yml b/.github/workflows/run-checker-merge.yml
index 8b571582c8..6aa95cc83e 100644
--- a/.github/workflows/run-checker-merge.yml
+++ b/.github/workflows/run-checker-merge.yml
@@ -58,13 +58,10 @@ jobs:
fail-fast: false
matrix:
opt: [
- enable-asan enable-ubsan no-shared no-asm -DOPENSSL_SMALL_FOOTPRINT -fno-sanitize=function,
no-dso,
no-ec2m enable-fips,
- no-shared,
no-err,
no-filenames,
- enable-ubsan no-asm -DOPENSSL_SMALL_FOOTPRINT -fno-sanitize=function,
no-module,
no-ocsp,
no-pinshared,
@@ -136,31 +133,3 @@ jobs:
./util/opensslwrap.sh version -c
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
-
- threads_sanitizer_atomic_fallback:
- needs: [validate-dispatch-inputs]
- if: |
- !cancelled() &&
- (needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
- runs-on: ubuntu-latest
- steps:
- - uses: actions/checkout@v6
- with:
- persist-credentials: false
- ref: ${{ github.event.inputs.head_sha || github.sha }}
- - name: checkout fuzz/corpora submodule
- run: git submodule update --init --depth 1 fuzz/corpora
- - name: Adjust ASLR for sanitizer
- run: |
- sudo cat /proc/sys/vm/mmap_rnd_bits
- sudo sysctl -w vm.mmap_rnd_bits=28
- - name: config
- run: CC=clang ./config --strict-warnings --banner=Configured no-shared no-fips -g -fsanitize=thread -DBROKEN_CLANG_ATOMICS && perl configdata.pm --dump
- - name: make
- run: make -s -j4
- - name: get cpu info
- run: |
- cat /proc/cpuinfo
- ./util/opensslwrap.sh version -c
- - name: make test
- run: make test V=1 TESTS="test_lhash test_threads test_internal_provider test_provfetch test_provider test_pbe test_evp_kdf test_pkcs12 test_store test_evp test_quic* test_dtls_listener_races"
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 7222304e03..79e4d3a770 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -365,78 +365,6 @@ jobs:
call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
apps\openssl.exe version -a
- cygwin:
- # Run a job for each of the specified target architectures:
- strategy:
- matrix:
- os:
- - windows-2022
- platform:
- - arch: win64
- config: -DCMAKE_C_COMPILER=gcc --strict-warnings enable-demos no-fips
-# are we really learning sth new from win32? So let's save some CO2 for now disabling this
-# - arch: win32
-# config: -DCMAKE_C_COMPILER=gcc --strict-warnings no-fips
- runs-on: ${{ matrix.os }}
- env:
- CYGWIN_NOWINPATH: 1
- SHELLOPTS: igncr
-# Don't overwhelm github CI VMs:
- MAKE_PARAMS: -j 4
- steps:
-# Checkout before cygwin can mess with PATH...
- - uses: actions/checkout@v6
- with:
- persist-credentials: false
- - uses: cygwin/cygwin-install-action@f2009323764960f80959895c7bc3bb30210afe4d #v6
- with:
- packages: perl git make gcc-core
- - name: Check repo
- run: cygcheck -V
- - name: Full cygcheck status
- run: cygcheck -s -v -r -h
-# Activate this if checkout action fails:
-# - name: Clone repo
-# run: bash -c "pwd && git clone --branch ${{ github.ref_name }} --depth 1 https://github.com/${{ github.repository }}.git"
- - name: Full build
- shell: bash
- run: |
- gcc --version
- ./config ${{ matrix.platform.config }}
- make $MAKE_PARAMS
-# Disable testing for now. TBD: Need local cygwin installation to debug .
-# - name: Run openssl tests
-# run: bash -c "cd openssl && make V=1 test"
-
- mingw64:
- strategy:
- matrix:
- platform:
- - arch: mingw64
- target: x86_64
- # Avoid MINGW bug in headers. Remove when CI is upgraded.
- config: enable-demos -Wno-array-bounds
- - arch: mingw
- target: i686
- config: -Wno-array-bounds -Wno-stringop-overflow
- runs-on: ubuntu-latest
- env:
- CC: ${{ matrix.platform.target }}-w64-mingw32-gcc
- CXX: ${{ matrix.platform.target }}-w64-mingw32-g++
- AR: ${{ matrix.platform.target }}-w64-mingw32-ar
- RANLIB: ${{ matrix.platform.target }}-w64-mingw32-ranlib
- RC: ${{ matrix.platform.target }}-w64-mingw32-windres
- steps:
- - uses: actions/checkout@v6
- with:
- persist-credentials: false
- - name: install MINGW64
- run: sudo apt-get install -y mingw-w64
- - name: config
- run: ./config ${{ matrix.platform.arch }} --strict-warnings --banner=Configured ${{ matrix.platform.config }}
- - name: make
- run: make -j4 -s
-
msys2-mingw64:
strategy:
matrix:
@@ -445,10 +373,6 @@ jobs:
cc: gcc
pkgs: mingw-w64-ucrt-x86_64-gcc
config: mingw64 enable-demos
- - arch: CLANG64
- cc: clang
- pkgs: mingw-w64-clang-x86_64-clang
- config: mingw64
runs-on: windows-latest
env:
CC: ${{ matrix.platform.cc }}