Commit 0dcf16644d for openssl.org

commit 0dcf16644d97178c933b8f360ce87edcddf87f12
Author: Igor Ustinov <igus@openssl.foundation>
Date:   Fri Sep 18 10:55:42 2026 +0200

    CI: treat [aarch64 ci]/[riscv ci] in a PR body as a full-test opt-in

    In the extended cross-compile workflows for aarch64 and RISC-V, the
    "make all tests" and "make some tests" steps now also run when the
    marker appears in the pull request body, and the "make evp tests" step
    is skipped in that case.  A pull request matching only on its title
    still gets the EVP tier, and legs setting `tests: none` stay
    build-only.

    Assisted-by: Claude:claude-opus-5
    Reviewed-by: Richard Levitte <levitte@openssl.org>
    Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
    Merge-date: Thu Sep 24 07:44:32 2026
    Merged-from: https://github.com/openssl/openssl/pull/32879

diff --git a/.github/workflows/aarch64-more-cross-compiles.yml b/.github/workflows/aarch64-more-cross-compiles.yml
index 2a0e00d42f..8f9ca5f626 100644
--- a/.github/workflows/aarch64-more-cross-compiles.yml
+++ b/.github/workflows/aarch64-more-cross-compiles.yml
@@ -211,23 +211,24 @@ jobs:
       if: matrix.platform.tests != 'none'
       run: QEMU_LD_PREFIX=/usr/${{ matrix.platform.arch }} ./util/opensslwrap.sh info -cpusettings

-    # A dispatched run takes the push tier, not the pull_request one below: it exists to run
-    # pre-merge what currently only runs post-merge, and evp-only is the weaker signal. Legs
-    # setting `tests: none` stay build-only on every trigger, by design.
+    # A dispatched run, and a pull request that opts in with `[aarch64 ci]` in its body, take the
+    # push tier: both exist to run pre-merge what otherwise only runs post-merge, and evp-only
+    # is the weaker signal. A pull request that only matches on its title keeps the evp tier.
+    # Legs setting `tests: none` stay build-only on every trigger, by design.
     - name: make all tests
-      if: (github.event_name == 'push' || inputs.pr != '') && matrix.platform.tests == ''
+      if: (github.event_name == 'push' || inputs.pr != '' || contains(github.event.pull_request.body, '[aarch64 ci]')) && matrix.platform.tests == ''
       run: |
         .github/workflows/make-test \
                   TESTS="-test_afalg" \
                   QEMU_LD_PREFIX=/usr/${{ matrix.platform.arch }}
     - name: make some tests
-      if: (github.event_name == 'push' || inputs.pr != '') && matrix.platform.tests != 'none' && matrix.platform.tests != ''
+      if: (github.event_name == 'push' || inputs.pr != '' || contains(github.event.pull_request.body, '[aarch64 ci]')) && matrix.platform.tests != 'none' && matrix.platform.tests != ''
       run: |
         .github/workflows/make-test \
                   TESTS="${{ matrix.platform.tests }} -test_afalg" \
                   QEMU_LD_PREFIX=/usr/${{ matrix.platform.arch }}
     - name: make evp tests
-      if: github.event_name == 'pull_request' && matrix.platform.tests != 'none'
+      if: github.event_name == 'pull_request' && !contains(github.event.pull_request.body, '[aarch64 ci]') && matrix.platform.tests != 'none'
       run: |
         .github/workflows/make-test \
                   TESTS="test_evp*" \
diff --git a/.github/workflows/riscv-more-cross-compiles.yml b/.github/workflows/riscv-more-cross-compiles.yml
index d191f2b6c9..5755866013 100644
--- a/.github/workflows/riscv-more-cross-compiles.yml
+++ b/.github/workflows/riscv-more-cross-compiles.yml
@@ -343,23 +343,24 @@ jobs:
           ./util/opensslwrap.sh info -cpusettings | \
           grep -qE "${{ matrix.platform.capscheck }}"

-    # A dispatched run takes the push tier, not the pull_request one below: it exists to run
-    # pre-merge what currently only runs post-merge, and evp-only is the weaker signal. Legs
-    # setting `tests: none` stay build-only on every trigger, by design.
+    # A dispatched run, and a pull request that opts in with `[riscv ci]` in its body, take the
+    # push tier: both exist to run pre-merge what otherwise only runs post-merge, and evp-only
+    # is the weaker signal. A pull request that only matches on its title keeps the evp tier.
+    # Legs setting `tests: none` stay build-only on every trigger, by design.
     - name: make all tests
-      if: (github.event_name == 'push' || inputs.pr != '') && matrix.platform.tests == ''
+      if: (github.event_name == 'push' || inputs.pr != '' || contains(github.event.pull_request.body, '[riscv ci]')) && matrix.platform.tests == ''
       run: |
         .github/workflows/make-test \
                   TESTS="-test_afalg" \
                   QEMU_LD_PREFIX=/usr/${{ matrix.platform.arch }}
     - name: make some tests
-      if: (github.event_name == 'push' || inputs.pr != '') && matrix.platform.tests != 'none' && matrix.platform.tests != ''
+      if: (github.event_name == 'push' || inputs.pr != '' || contains(github.event.pull_request.body, '[riscv ci]')) && matrix.platform.tests != 'none' && matrix.platform.tests != ''
       run: |
         .github/workflows/make-test \
                   TESTS="${{ matrix.platform.tests }} -test_afalg" \
                   QEMU_LD_PREFIX=/usr/${{ matrix.platform.arch }}
     - name: make evp tests
-      if: github.event_name == 'pull_request' && matrix.platform.tests != 'none'
+      if: github.event_name == 'pull_request' && !contains(github.event.pull_request.body, '[riscv ci]') && matrix.platform.tests != 'none'
       run: |
         .github/workflows/make-test \
                   TESTS="test_evp*" \