Merge pull request #77 from TaurusTLS-Developers/build_from_branch

JPeterMugaas · web-flow · commit ff2f534aac75 · 2026-03-15T00:22:22.000-06:00
Build from branch
diff --git a/.github/workflows/build-openssl.yml b/.github/workflows/build-openssl.yml
@@ -4,8 +4,16 @@ run-name: Build OpenSSL ${{ inputs.version }} via ${{ github.event_name }}
 on:
   workflow_dispatch:
     inputs:
+      build_type:
+        description: 'Build Type'
+        required: true
+        type: choice
+        options:
+          - release
+          - branch
+        default: release
       version:
-        description: 'OpenSSL Version (e.g., 3.4.0)'
+        description: 'OpenSSL Version or Branch (e.g., 3.4.0 or master)'
         required: true
         type: string
       ignore_eol:
@@ -20,6 +28,10 @@ on:
         default: false
   workflow_call:
     inputs:
+      build_type:
+        required: false
+        type: string
+        default: release
       version:
         required: true
         type: string
@@ -37,33 +49,51 @@ jobs:
   # 0. VALIDATE VERSION & EOL
   # =========================================================================
   validate-version:
-    name: Validate Version
+    name: Validate ${{ inputs.build_type == 'release' && 'Version' || 'Branch' }}
     runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.check.outputs.version }}
+      ref: ${{ steps.check.outputs.ref }}
+      artifact_version: ${{ steps.check.outputs.artifact_version }}
     steps:
-      - name: Check EOL Status
+      - name: Check EOL or Branch Existence
         id: check
         run: |
           VERSION="${{ inputs.version }}"
+          BUILD_TYPE="${{ inputs.build_type }}"
           IGNORE_EOL="${{ inputs.ignore_eol }}"
           
-          MAJOR_MINOR=$(echo "$VERSION" | cut -d. -f1,2)
-          EOL_DATE=$(curl -s https://endoflife.date/api/openssl.json | jq -r ".[] | select(.cycle == \"$MAJOR_MINOR\") | .eol")
-          
-          if [ -z "$EOL_DATE" ] || [ "$EOL_DATE" == "null" ]; then
-            echo "⚠️ Could not determine EOL date for $MAJOR_MINOR. Proceeding cautiously."
-          else
-            TODAY=$(date +%Y-%m-%d)
-            if [[ "$TODAY" > "$EOL_DATE" ]]; then
-              echo "❌ OpenSSL $MAJOR_MINOR reached EOL on $EOL_DATE."
-              if [ "$IGNORE_EOL" != "true" ]; then
-                echo "Aborting build. Check 'Ignore EOL' to override."
-                exit 1
+          if [ "$BUILD_TYPE" == "release" ]; then
+            MAJOR_MINOR=$(echo "$VERSION" | cut -d. -f1,2)
+            EOL_DATE=$(curl -s https://endoflife.date/api/openssl.json | jq -r ".[] | select(.cycle == \"$MAJOR_MINOR\") | .eol")
+            
+            if [ -z "$EOL_DATE" ] || [ "$EOL_DATE" == "null" ]; then
+              echo "⚠️ Could not determine EOL date for $MAJOR_MINOR. Proceeding cautiously."
+            else
+              TODAY=$(date +%Y-%m-%d)
+              if [[ "$TODAY" > "$EOL_DATE" ]]; then
+                echo "❌ OpenSSL $MAJOR_MINOR reached EOL on $EOL_DATE."
+                if [ "$IGNORE_EOL" != "true" ]; then
+                  echo "Aborting build. Check 'Ignore EOL' to override."
+                  exit 1
+                fi
+                echo "⚠️ Ignore EOL is checked. Proceeding anyway."
               fi
-              echo "⚠️ Ignore EOL is checked. Proceeding anyway."
             fi
+            echo "ref=openssl-$VERSION" >> $GITHUB_OUTPUT
+            echo "artifact_version=$VERSION" >> $GITHUB_OUTPUT
+          else
+            # Branch Mode
+            echo "🔍 Verifying branch '$VERSION' in upstream repository..."
+            if ! git ls-remote --heads https://github.com/openssl/openssl.git "$VERSION" | grep -q "$VERSION"; then
+              echo "❌ Branch '$VERSION' does not exist in openssl/openssl repository."
+              exit 1
+            fi
+            TIMESTAMP=$(date -u +%Y%m%dT%H%M%SZ)
+            echo "ref=$VERSION" >> $GITHUB_OUTPUT
+            echo "artifact_version=${VERSION}_${TIMESTAMP}" >> $GITHUB_OUTPUT
           fi
+          
           echo "version=$VERSION" >> $GITHUB_OUTPUT
 
   # =========================================================================
@@ -77,7 +107,7 @@ jobs:
       - uses: actions/checkout@v6
         with:
           repository: openssl/openssl
-          ref: openssl-${{ needs.validate-version.outputs.version }}
+          ref: ${{ needs.validate-version.outputs.ref }}
       
       - name: Build Common Assets
         run: |
@@ -173,7 +203,7 @@ jobs:
       - uses: actions/checkout@v6
         with:
           repository: openssl/openssl
-          ref: openssl-${{ needs.validate-version.outputs.version }}
+          ref: ${{ needs.validate-version.outputs.ref }}
 
       - name: Compile Windows (Standard)
         if: matrix.platform.label == 'Windows' && matrix.platform.arch != 'arm64ec'
@@ -525,7 +555,11 @@ jobs:
           cp common-assets/README.txt dist/ 2>/dev/null || true
           
           # Create Metadata
-          echo "${{ needs.validate-version.outputs.version }}" > dist/version.txt
+          if [ "${{ inputs.build_type }}" == "branch" ]; then
+            echo "branch: ${{ needs.validate-version.outputs.version }}" > dist/version.txt
+          else
+            echo "${{ needs.validate-version.outputs.version }}" > dist/version.txt
+          fi
           
           # Create Symlink Script (POSIX only, if not already present)
           if [ ! -f dist/install_symlinks.sh ]; then
@@ -540,7 +574,7 @@ jobs:
           
           find dist -type d -empty -delete
           
-          ARCHIVE_NAME="openssl-${{ needs.validate-version.outputs.version }}-${{ matrix.label }}-${{ matrix.arch }}.zip"
+          ARCHIVE_NAME="openssl-${{ needs.validate-version.outputs.artifact_version }}-${{ matrix.label }}-${{ matrix.arch }}.zip"
           cd dist
           zip -r -y "../$ARCHIVE_NAME" .
           cd ..
@@ -550,7 +584,7 @@ jobs:
       - name: Upload Final Archive
         uses: actions/upload-artifact@v7
         with:
-          name: openssl-${{ needs.validate-version.outputs.version }}-${{ matrix.label }}-${{ matrix.arch }}
+          name: openssl-${{ needs.validate-version.outputs.artifact_version }}-${{ matrix.label }}-${{ matrix.arch }}
           path: ${{ env.ARCHIVE_FILE }}
           archive: false
           retention-days: 5
diff --git a/.github/workflows/check-upstream.yml b/.github/workflows/check-upstream.yml
@@ -52,7 +52,7 @@ jobs:
               echo "✅ Release v$VERSION already exists. Skipping."
             else
               echo "🚀 New release v$VERSION missing! Triggering build..."
-              gh workflow run build-openssl.yml -f version="$VERSION"
+              gh workflow run build-openssl.yml -f version="$VERSION" -f build_type="release"
               echo "Build triggered for $VERSION."
             fi
           done
diff --git a/doc/MAINTAINING.md b/doc/MAINTAINING.md
@@ -10,51 +10,53 @@ The pipeline consists of three primary workflows:
     *   Runs daily via cron.
     *   Uses the `endoflife.date` API to fetch active 3.x branches.
     *   Triggers the Build workflow via `gh workflow run` using a Personal Access Token (`RBPW_PAT`) to allow workflow chaining.
+    *   Explicitly passes `build_type="release"` to ensure correct mode selection.
 
 2.  **Build (`build-openssl.yml`):**
-    *   **Validate Version:** Checks EOL status. Aborts if EOL unless `ignore_eol` is true.
-    *   **Build Common Assets:** Compiles architecture-independent headers and HTML docs once on a Linux runner.
-    *   **Compile Binaries (Fan-Out):** A highly parallel matrix that splits builds by OS, Architecture, AND Linkage (`shared` vs `static`). Uploads raw, unstripped binaries as temporary artifacts.
-    *   **Package Release (Fan-In):** Downloads common assets and raw binaries.
+    *   **Validate Mode & Version:** Handles two build modes:
+        *   `release`: Uses official tags (e.g., `openssl-3.4.0`) and performs EOL checks.
+        *   `branch`: Clones a specific git branch (e.g., `master`, `openssl-3.0`) and verifies its existence.
+    *   **Build Common Assets:** Compiles architecture-independent headers and HTML docs once.
+        *   Generates a centralized `README.txt`.
+        *   Extracts `LICENSE.txt` from the source root.
+        *   Removes unnecessary large directories to keep the "common assets" artifact lean.
+    *   **Compile Binaries (Fan-Out):** A highly parallel matrix that splits builds by OS, Architecture, AND Linkage (`shared` vs `static`). Uses parallelized `make -j$(nproc)` for speed.
+    *   **Package Release (Fan-In):** Downloads assets and raw binaries.
+        *   *Adaptive Merging:* Handles inconsistent `actions/download-artifact` behavior by detecting both nested and flattened artifact structures.
         *   *macOS:* Combines x64 and arm64 into Universal binaries using `lipo` and `install_name_tool`.
-        *   *Windows/Linux/Android/iOS:* Organizes files into a strict directory layout.
-        *   Strips debug symbols, drops PDBs, and generates `install_symlinks.sh` (POSIX only) and `README.txt`.
-        *   Uploads the final `.zip` without double-zipping (`archive: false`).
-    *   **Cleanup:** Automatically deletes intermediate `raw-*` and common assets artifacts via GitHub API to save storage space, unless `keep_raw_artifacts` is true.
+        *   *Naming:* Releases use standard version naming; Branch builds use `<branch>_<timestamp>` (e.g., `master_20260314T150000Z`).
+        *   *Metadata:* Generates `version.txt`. If in `branch` mode, prepends `branch: ` to the content.
+    *   **Cleanup:** Deletes intermediate artifacts via GitHub API unless `keep_raw_artifacts` is true.
 
 3.  **Publish (`publish-release.yml`):**
     *   Triggered automatically when a Build completes.
-    *   Downloads the raw `.zip` artifacts intact.
-    *   Reads the version from the `build-metadata` artifact.
     *   Creates a Draft release and opens a GitHub Issue for maintainer review.
 
 ## 🛠️ Manual Operations
 
-### How to build a specific version manually
+### How to build manually
 1.  Go to **Actions** tab -> **Build OpenSSL 3.x**.
 2.  Click **Run workflow**.
-3.  Enter the version (e.g., `3.4.0`).
-4.  *(Optional)* Check **Ignore EOL Check** if you specifically need to build an older, unsupported version (e.g., `3.0.0`).
-5.  *(Optional)* Check  **Keep raw build artifacts** if you need to keep compiled artifacts, for example for debug purposes.
-6.  The pipeline will build the artifacts and automatically trigger the Publish workflow as a Draft.
+3.  **Build Type:** Select `release` for official tags or `branch` for moving git branches.
+4.  **OpenSSL Version or Branch:** Enter the tag (e.g., `3.4.0`) or branch name (e.g., `openssl-3.6`).
+5.  *(Optional)* Check **Ignore EOL Check** if you need to build an unsupported release.
+6.  *(Optional)* Check **Keep raw build artifacts** for debugging.
 
 ### How to publish a release manually
-If an automatic publish fails, or you want to publish a specific build run manually:
+If an automatic publish fails:
 1.  Go to **Actions** tab -> **Publish Release**.
 2.  Click **Run workflow**.
-3.  Provide the **Build Workflow Run ID** (found in the URL of the successful build run, e.g., `1234567890`).
-4.  Toggle the **Create as Draft** status as needed.
+3.  Provide the **Build Workflow Run ID** (found in the URL of the successful build run).
+4.  Toggle **Create as Draft** as needed.
 
 ### Reviewing and Publishing Drafts
-When the CI pipeline automatically builds a new upstream release, it creates a Draft release and opens a GitHub Issue.
 1. Check the **Issues** tab for a "👀 Review Required" notification.
-2. Click the link in the issue to view the Draft Release.
-3. Verify the release notes and attached `.zip` artifacts.
+2. Click the link to view the Draft Release.
+3. Verify the artifacts and release notes.
 4. Click **Edit**, uncheck "Set as a draft", and click **Publish release**.
 5. Close the notification issue.
 
 ### Secrets Configuration
-To allow the workflows to trigger each other (e.g., `check-upstream` triggering `build-openssl`), a **Personal Access Token (PAT)** is required.
 *   **Secret Name:** `RBPW_PAT`
-*   **Required Scopes:** `repo` (or specific `actions:write`, `contents:write`).
-*   **Note:** The default `GITHUB_TOKEN` cannot trigger recursive workflows. (However, `publish-release.yml` uses the standard `GITHUB_TOKEN` to create releases and issues).
+*   **Required Scopes:** `repo`, `actions:write`.
+*   **Note:** Required for workflow chaining (`check-upstream` -> `build-openssl`). Standard operations use the default `GITHUB_TOKEN`.
