Commit eb5626c572 for openssl.org
commit eb5626c572691d50ad7a580e1a66291400114af6
Author: Georgy Karataev <georgyk@openssl.org>
Date: Tue Aug 4 11:47:30 2026 +0200
ci: let the CI bot dispatch the compiler, merge and AVX512 zoos
These three only run after the fact: compiler-zoo and run-checker-merge on a
push, avx512-sde on a nightly cron. Their coverage therefore lands once a pull
request is already merged, which is when it is most expensive to act on.
Give all three the dispatch entry point the daily workflows already have:
validated pr/head_sha/check_run_id inputs, the run-name both services correlate
on, concurrency keyed on the pull request, and every checkout pinned to the
requested commit.
Existing behaviour is untouched. A push or a cron carries no inputs, so the
validator is skipped and each checkout falls back to github.sha -- the build jobs
still run on a push to a fork branch, the only pre-merge signal a contributor
gets here. The jitter library stays pinned to its release tag: a dispatched run
may choose the OpenSSL tree, never its dependencies.
Refs: openssl/project#2027
Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Reviewed-by: Dmitry Misharov <dmitry@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Andrew Dinh <andrewd@openssl.org>
MergeDate: Sat Aug 8 15:34:06 2026
(Merged from https://github.com/openssl/openssl/pull/32174)
diff --git a/.github/workflows/avx512-sde.yml b/.github/workflows/avx512-sde.yml
index 1b94df9922..38beee25bd 100644
--- a/.github/workflows/avx512-sde.yml
+++ b/.github/workflows/avx512-sde.yml
@@ -22,6 +22,28 @@ on:
schedule:
- cron: '30 02 * * *'
workflow_dispatch:
+ inputs:
+ pr:
+ description: 'Internal: openssl-ci-bot PR number. Leave empty for a normal manual run.'
+ required: false
+ type: string
+ head_sha:
+ description: 'Internal: openssl-ci-bot commit SHA. Leave empty for a normal manual run.'
+ required: false
+ type: string
+ check_run_id:
+ description: 'Internal: openssl-ci-bot check-run ID. Leave empty for a normal manual run.'
+ required: false
+ type: string
+
+# Keep in sync with openssl-ci-bot's run-name parser, and with the Actions statistics
+# collector that attributes CI load by parsing this same string. Both break silently.
+run-name: >-
+ ${{ github.event.inputs.pr && format('ci-dispatch pr={0} head={1} check_run_id={2}', github.event.inputs.pr, github.event.inputs.head_sha, github.event.inputs.check_run_id) || github.workflow }}
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.event.inputs.pr || github.run_id }}
+ cancel-in-progress: true
permissions:
contents: read
@@ -32,12 +54,26 @@ env:
SDE_MIRROR_ID: 915934
jobs:
+ # Only a dispatch carries inputs, so this is skipped on the nightly cron.
+ validate-dispatch-inputs:
+ if: inputs.pr != '' || inputs.head_sha != '' || inputs.check_run_id != ''
+ uses: ./.github/workflows/validate-dispatch-inputs.yml
+ with:
+ pr: ${{ inputs.pr }}
+ head_sha: ${{ inputs.head_sha }}
+ check_run_id: ${{ inputs.check_run_id }}
+
linux:
+ needs: [validate-dispatch-inputs]
+ if: |
+ !cancelled() &&
+ (needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
with:
persist-credentials: false
+ ref: ${{ github.event.inputs.head_sha || github.sha }}
- name: install NASM
run: sudo apt-get install -y nasm
@@ -75,6 +111,10 @@ jobs:
run: sde64 -icx -- ./apps/openssl fipsinstall -module ./providers/fips.so -out /tmp/fipsmodule.cnf -provider_name fips
windows:
+ needs: [validate-dispatch-inputs]
+ if: |
+ !cancelled() &&
+ (needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
runs-on: windows-2022
env:
VCVARS: C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat
@@ -82,6 +122,7 @@ jobs:
- uses: actions/checkout@v6
with:
persist-credentials: false
+ ref: ${{ github.event.inputs.head_sha || github.sha }}
- name: install nasm
if: github.repository == 'openssl/openssl'
diff --git a/.github/workflows/compiler-zoo.yml b/.github/workflows/compiler-zoo.yml
index 6422733a43..b5d1699c70 100644
--- a/.github/workflows/compiler-zoo.yml
+++ b/.github/workflows/compiler-zoo.yml
@@ -7,13 +7,52 @@
name: Compiler Zoo CI
-on: [push]
+on:
+ push:
+ workflow_dispatch:
+ inputs:
+ pr:
+ description: 'Internal: openssl-ci-bot PR number. Leave empty for a normal manual run.'
+ required: false
+ type: string
+ head_sha:
+ description: 'Internal: openssl-ci-bot commit SHA. Leave empty for a normal manual run.'
+ required: false
+ type: string
+ check_run_id:
+ description: 'Internal: openssl-ci-bot check-run ID. Leave empty for a normal manual run.'
+ required: false
+ type: string
+
+# Keep in sync with openssl-ci-bot's run-name parser, and with the Actions statistics
+# collector that attributes CI load by parsing this same string. Both break silently.
+run-name: >-
+ ${{ github.event.inputs.pr && format('ci-dispatch pr={0} head={1} check_run_id={2}', github.event.inputs.pr, github.event.inputs.head_sha, github.event.inputs.check_run_id) || github.workflow }}
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.event.inputs.pr || github.run_id }}
+ cancel-in-progress: true
permissions:
contents: read
jobs:
+ # Only a dispatch carries inputs, so this is skipped on a push. No repository clause:
+ # the build jobs below keep running in forks on push, and the validator must not claim
+ # a boundary they do not have.
+ validate-dispatch-inputs:
+ if: inputs.pr != '' || inputs.head_sha != '' || inputs.check_run_id != ''
+ uses: ./.github/workflows/validate-dispatch-inputs.yml
+ with:
+ pr: ${{ inputs.pr }}
+ head_sha: ${{ inputs.head_sha }}
+ check_run_id: ${{ inputs.check_run_id }}
+
gcc:
+ needs: [validate-dispatch-inputs]
+ if: |
+ !cancelled() &&
+ (needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
strategy:
fail-fast: false
matrix:
@@ -27,6 +66,7 @@ jobs:
- uses: actions/checkout@v6
with:
persist-credentials: false
+ ref: ${{ github.event.inputs.head_sha || github.sha }}
- name: checkout fuzz/corpora submodule
run: git submodule update --init --depth 1 fuzz/corpora
- name: config
@@ -46,6 +86,10 @@ jobs:
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
clang:
+ needs: [validate-dispatch-inputs]
+ if: |
+ !cancelled() &&
+ (needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
strategy:
fail-fast: false
matrix:
@@ -63,6 +107,7 @@ jobs:
- uses: actions/checkout@v6
with:
persist-credentials: false
+ ref: ${{ github.event.inputs.head_sha || github.sha }}
- name: checkout fuzz/corpora submodule
run: git submodule update --init --depth 1 fuzz/corpora
- name: config
diff --git a/.github/workflows/run-checker-merge.yml b/.github/workflows/run-checker-merge.yml
index 4342d97bb6..db40542ca1 100644
--- a/.github/workflows/run-checker-merge.yml
+++ b/.github/workflows/run-checker-merge.yml
@@ -8,12 +8,52 @@
name: Run-checker merge
# Jobs run per merge to master
-on: [push]
+on:
+ push:
+ workflow_dispatch:
+ inputs:
+ pr:
+ description: 'Internal: openssl-ci-bot PR number. Leave empty for a normal manual run.'
+ required: false
+ type: string
+ head_sha:
+ description: 'Internal: openssl-ci-bot commit SHA. Leave empty for a normal manual run.'
+ required: false
+ type: string
+ check_run_id:
+ description: 'Internal: openssl-ci-bot check-run ID. Leave empty for a normal manual run.'
+ required: false
+ type: string
+
+# Keep in sync with openssl-ci-bot's run-name parser, and with the Actions statistics
+# collector that attributes CI load by parsing this same string. Both break silently.
+run-name: >-
+ ${{ github.event.inputs.pr && format('ci-dispatch pr={0} head={1} check_run_id={2}', github.event.inputs.pr, github.event.inputs.head_sha, github.event.inputs.check_run_id) || github.workflow }}
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.event.inputs.pr || github.run_id }}
+ cancel-in-progress: true
+
permissions:
contents: read
jobs:
+ # Only a dispatch carries inputs, so this is skipped on a push. No repository clause:
+ # the build jobs below keep running in forks on push, and the validator must not claim
+ # a boundary they do not have.
+ validate-dispatch-inputs:
+ if: inputs.pr != '' || inputs.head_sha != '' || inputs.check_run_id != ''
+ uses: ./.github/workflows/validate-dispatch-inputs.yml
+ with:
+ pr: ${{ inputs.pr }}
+ head_sha: ${{ inputs.head_sha }}
+ check_run_id: ${{ inputs.check_run_id }}
+
run-checker:
+ needs: [validate-dispatch-inputs]
+ if: |
+ !cancelled() &&
+ (needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
strategy:
fail-fast: false
matrix:
@@ -46,6 +86,7 @@ jobs:
- uses: actions/checkout@v6
with:
persist-credentials: false
+ ref: ${{ github.event.inputs.head_sha || github.sha }}
- name: checkout fuzz/corpora submodule
run: git submodule update --init --depth 1 fuzz/corpora
- name: config
@@ -62,12 +103,18 @@ jobs:
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
jitter:
+ needs: [validate-dispatch-inputs]
+ if: |
+ !cancelled() &&
+ (needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
runs-on: ubuntu-latest
steps:
- name: checkout openssl
uses: actions/checkout@v6
with:
persist-credentials: false
+ ref: ${{ github.event.inputs.head_sha || github.sha }}
+ # Third-party, pinned to a release tag: not repointed at the pull request's choice.
- name: checkout jitter
uses: actions/checkout@v6
with:
@@ -91,11 +138,16 @@ jobs:
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
threads_sanitizer_atomic_fallback:
+ needs: [validate-dispatch-inputs]
+ if: |
+ !cancelled() &&
+ (needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
with:
persist-credentials: false
+ ref: ${{ github.event.inputs.head_sha || github.sha }}
- name: checkout fuzz/corpora submodule
run: git submodule update --init --depth 1 fuzz/corpora
- name: Adjust ASLR for sanitizer