build_and_test.yml

name: Build and test

on:
  push:
    branches: [ master ]
  pull_request:
    branches: [ master ]
  workflow_dispatch:

jobs:
  test:
    name: ${{ matrix.name }}
    runs-on: ubuntu-latest

    strategy:
      fail-fast: false
      matrix:
        include:
          - name: "nginx 1.31.7 + OpenSSL"
            NGINX_VERSION: "1.31.7"
            TEST_NGINX_TIMEOUT: "5"

          - name: "nginx 1.31.7 + OpenSSL + HTTP/2"
            NGINX_VERSION: "1.31.7"
            TEST_NGINX_TIMEOUT: "5"
            TEST_NGINX_USE_HTTP2: "1"

          - name: "nginx 1.31.7 + OpenSSL + HTTP/3"
            NGINX_VERSION: "1.31.7"
            TEST_NGINX_USE_HTTP3: "1"
            TEST_NGINX_QUIC_IDLE_TIMEOUT: "3"

          - name: "nginx 1.31.7 + BoringSSL + HTTP/3"
            NGINX_VERSION: "1.31.7"
            BORINGSSL: "1"
            TEST_NGINX_USE_HTTP3: "1"
            TEST_NGINX_QUIC_IDLE_TIMEOUT: "3"

          - name: "nginx 1.31.6 + OpenSSL + ASan"
            NGINX_VERSION: "1.31.6"
            # ASan slows every request down, so allow more time than the
            # other jobs before a test is called timed out.
            TEST_NGINX_TIMEOUT: "10"
            ASAN: "1"

    services:
      redis:
        image: redis:7-alpine
        ports:
          - 6379:6379
      mysql:
        image: mysql:8.0
        env:
          MYSQL_ALLOW_EMPTY_PASSWORD: yes
        ports:
          - 3306:3306
        options: >-
          --health-cmd="mysqladmin ping --silent"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=10

    env:
      JOBS: 3
      NGX_BUILD_JOBS: 3
      CC: gcc
      DRIZZLE_VER: "2011.07.21"
      LUAJIT_PREFIX: /opt/luajit21
      LUAJIT_LIB: /opt/luajit21/lib
      LUAJIT_INC: /opt/luajit21/include/luajit-2.1
      LUA_INCLUDE_DIR: /opt/luajit21/include/luajit-2.1
      PCRE2_PREFIX: /usr/local/openresty/pcre2
      PCRE2_LIB: /usr/local/openresty/pcre2/lib
      PCRE2_INC: /usr/local/openresty/pcre2/include
      OPENSSL_PREFIX: /usr/local/openresty/openssl3
      OPENSSL_LIB: /usr/local/openresty/openssl3/lib
      OPENSSL_INC: /usr/local/openresty/openssl3/include
      LIBDRIZZLE_PREFIX: /opt/drizzle
      LIBDRIZZLE_INC: /opt/drizzle/include/libdrizzle-1.0
      LIBDRIZZLE_LIB: /opt/drizzle/lib
      TEST_NGINX_SLEEP: "0.006"
      TEST_NGINX_SKIP_COSOCKET_LOG_TEST: "1"
      MALLOC_PERTURB_: "9"

    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0

      - name: Install system packages
        run: |
          sudo apt-get update -q
          sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
            ack axel cpanminus \
            libtest-base-perl libtext-diff-perl liburi-perl libwww-perl \
            libtest-longstring-perl liblist-moreutils-perl \
            libgd-dev time cmake libunwind-dev wget \
            libbrotli1 lsb-release gnupg ca-certificates dnsutils

      - name: Install Perl test modules
        run: |
          /usr/bin/env perl $(command -v cpanm) --sudo --notest \
            Test::Nginx IPC::Run Test2::Util > build.log 2>&1 || (cat build.log && exit 1)

      - name: Add OpenResty apt repository
        run: |
          wget -qO- https://openresty.org/package/pubkey.gpg | gpg --dearmor | sudo tee /usr/share/keyrings/openresty.gpg > /dev/null
          echo "deb [signed-by=/usr/share/keyrings/openresty.gpg] https://openresty.org/package/ubuntu $(lsb_release -sc) main" \
            | sudo tee /etc/apt/sources.list.d/openresty.list
          sudo apt-get update -q
          sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
            openresty-pcre2 openresty-openssl3 openresty-pcre2-dev openresty-openssl3-dev

      - name: Cache download directory
        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
        with:
          path: download-cache
          key: download-cache-${{ runner.os }}-drizzle-${{ env.DRIZZLE_VER }}

      - name: Source code style check
        run: |
          ! grep -n -P '(?<=.{80}).+' --color $(find src -name '*.c') $(find . -name '*.h') \
            || (echo "ERROR: Found C source lines exceeding 80 columns." >&2; exit 1)
          ! grep -n -P '\t+' --color $(find src -name '*.c') $(find . -name '*.h') \
            || (echo "ERROR: Cannot use tabs." >&2; exit 1)

      - name: Clone dependency repositories
        run: |
          # Sibling repos — build scripts reference them via $root/../<name>
          git clone --depth=1 https://github.com/openresty/openresty.git             ../openresty
          git clone --depth=1 https://github.com/openresty/no-pool-nginx.git         ../no-pool-nginx
          git clone --depth=1 https://github.com/openresty/lua-upstream-nginx-module.git ../lua-upstream-nginx-module
          git clone --depth=1 https://github.com/openresty/echo-nginx-module.git         ../echo-nginx-module
          git clone --depth=1 https://github.com/openresty/nginx-eval-module.git         ../nginx-eval-module
          git clone --depth=1 https://github.com/openresty/ngx_devel_kit.git                 ../ndk-nginx-module
          git clone --depth=1 https://github.com/FRiCKLE/ngx_coolkit.git                 ../coolkit-nginx-module
          git clone --depth=1 https://github.com/openresty/headers-more-nginx-module.git ../headers-more-nginx-module
          git clone --depth=1 https://github.com/openresty/drizzle-nginx-module.git      ../drizzle-nginx-module
          git clone --depth=1 https://github.com/openresty/set-misc-nginx-module.git     ../set-misc-nginx-module
          git clone --depth=1 https://github.com/openresty/memc-nginx-module.git         ../memc-nginx-module
          git clone --depth=1 https://github.com/openresty/rds-json-nginx-module.git     ../rds-json-nginx-module
          git clone --depth=1 https://github.com/openresty/srcache-nginx-module.git      ../srcache-nginx-module
          git clone --depth=1 https://github.com/openresty/redis2-nginx-module.git       ../redis2-nginx-module
          git clone --depth=1 https://github.com/openresty/lua-resty-core.git            ../lua-resty-core
          git clone --depth=1 https://github.com/openresty/lua-resty-lrucache.git        ../lua-resty-lrucache
          git clone --depth=1 https://github.com/openresty/lua-resty-mysql.git           ../lua-resty-mysql
          git clone --depth=1 https://github.com/spacewander/lua-resty-rsa.git           ../lua-resty-rsa
          git clone --depth=1 https://github.com/openresty/lua-resty-string.git          ../lua-resty-string
          git clone --depth=1 https://github.com/openresty/stream-lua-nginx-module.git   ../stream-lua-nginx-module

          # Local repos — used directly from the working directory
          git clone --depth=1 https://github.com/openresty/test-nginx.git
          git clone --depth=1 https://github.com/openresty/openresty-devel-utils.git
          git clone --depth=1 https://github.com/openresty/mockeagain.git
          git clone --depth=1 https://github.com/openresty/lua-cjson.git lua-cjson
          git clone -b v2.1-agentzh --depth=1 https://github.com/openresty/luajit2.git luajit2

      - name: Download prebuilt tarballs
        run: |
          mkdir -p download-cache
          if [ ! -f download-cache/drizzle7-$DRIZZLE_VER.tar.gz ]; then
            wget -P download-cache \
              https://github.com/openresty/openresty-deps-prebuild/releases/download/v20230902/drizzle7-$DRIZZLE_VER.tar.gz
          fi
          wget https://github.com/openresty/openresty-deps-prebuild/releases/download/v20230902/boringssl-20230902-x64-focal.tar.gz
          wget https://github.com/stunnel/static-curl/releases/download/8.20.0/curl-linux-x86_64-glibc-8.20.0.tar.xz

      - name: Install HTTP/3-capable curl
        run: |
          sudo mkdir -p /opt/curl/bin
          sudo tar -C /opt/curl/bin -xf curl-linux-x86_64-glibc-8.20.0.tar.xz curl

      - name: Start memcached (native, UDP enabled)
        run: |
          sudo apt-get install -y --no-install-recommends memcached
          sudo systemctl stop memcached
          # Ubuntu's default /etc/memcached.conf has "-U 0" which disables UDP.
          # Start manually with UDP on port 11211 so udp-socket tests pass.
          memcached -d -l 127.0.0.1 -p 11211 -U 11211 -m 64
          sudo ss -lntup | grep 11211


      - name: Set up MySQL test database
        run: |
          mysql -h 127.0.0.1 -P 3306 -uroot \
            -e "CREATE DATABASE ngx_test; \
                CREATE USER 'ngx_test'@'%' IDENTIFIED WITH mysql_native_password BY 'ngx_test'; \
                GRANT ALL ON ngx_test.* TO 'ngx_test'@'%'; \
                FLUSH PRIVILEGES;"

      - name: Set up network rules
        run: |
          sudo iptables -I OUTPUT 1 -p udp --dport 10086 -j REJECT
          sudo iptables -I OUTPUT   -p tcp --dst 127.0.0.2 --dport 12345 -j DROP
          sudo iptables -I OUTPUT   -p udp --dst 127.0.0.2 --dport 12345 -j DROP
          sudo ip route add prohibit 0.0.0.1/32
          sudo sysctl -w kernel.pid_max=10000

      - name: Start local DNS cache (dnsmasq)
        run: |
          sudo apt-get install -y --no-install-recommends dnsmasq
          # Stop any pre-installed dnsmasq instance from the package's default unit.
          sudo systemctl stop dnsmasq 2>/dev/null || true
          # --no-resolv: ignore /etc/resolv.conf (which on ubuntu-latest points at
          #   systemd-resolved on 127.0.0.53), so we never loop back to ourselves.
          # Listen on 127.0.0.1:53: systemd-resolved's stub owns 127.0.0.53:53
          #   only, so this address is free, and --bind-interfaces keeps us off
          #   every other one. The tests can then name the resolver as a bare IP,
          #   which t/087-udp-socket.t TEST 10 needs: it hands
          #   $TEST_NGINX_RESOLVER to setpeername() with port 53.
          # --host-record: --no-hosts keeps /etc/hosts out, and public resolvers
          #   do not answer "localhost" (RFC 6761 makes it the stub resolver's
          #   job), so answer it here instead of relying on an outside name.
          # --min-cache-ttl: the names the suite resolves carry a 300s TTL while
          #   a job runs for ~20 minutes, so without a floor the cache expires
          #   several times per run and the queries leave the runner again --
          #   exactly the flakiness the cache is here to remove. 3600 is the
          #   highest floor dnsmasq accepts.
          sudo dnsmasq --port=53 \
                       --listen-address=127.0.0.1 \
                       --bind-interfaces \
                       --no-resolv --no-hosts \
                       --host-record=localhost,127.0.0.1,::1 \
                       --host-record=trailing-dot.test,127.0.0.1 \
                       --server=8.8.4.4 --server=8.8.8.8 --server=1.1.1.1 \
                       --cache-size=1000 \
                       --min-cache-ttl=3600 \
                       --pid-file=/tmp/dnsmasq.pid
          sudo ss -lnupt | grep -q '127\.0\.0\.1:53' \
            || (echo "ERROR: dnsmasq is not listening on 127.0.0.1:53" >&2; exit 1)
          # localhost must resolve locally, or the resolver tests fail.
          dig +short @127.0.0.1 localhost
          # Warm the cache for all external hostnames the test suite resolves.
          for h in openresty.org www.openresty.org agentzh.org sregex.org \
                   www.google.com google-public-dns-a.google.com; do
            dig +short +tries=3 +time=2 @127.0.0.1 "$h" || true
          done

      - name: Build LuaJIT
        run: |
          cd luajit2
          XCFLAGS='-DLUA_USE_APICHECK -DLUA_USE_ASSERT -msse4.2'
          if [ "${{ matrix.ASAN }}" = "1" ]; then
            # LuaJIT's own allocator hides use-after-free on Lua objects from
            # ASan, since the memory is never returned to the C allocator.
            XCFLAGS="$XCFLAGS -DLUAJIT_USE_SYSMALLOC"
          fi
          make -j$JOBS CCDEBUG=-g Q= PREFIX=$LUAJIT_PREFIX CC=$CC \
            XCFLAGS="$XCFLAGS" \
            > build.log 2>&1 || (cat build.log && exit 1)
          sudo make install PREFIX=$LUAJIT_PREFIX > build.log 2>&1 || (cat build.log && exit 1)

      - name: Build drizzle7
        run: |
          tar xzf download-cache/drizzle7-$DRIZZLE_VER.tar.gz
          cd drizzle7-$DRIZZLE_VER
          ./configure --prefix=$LIBDRIZZLE_PREFIX --without-server \
            > build.log 2>&1 || (cat build.log && exit 1)
          make libdrizzle-1.0 -j$JOBS > build.log 2>&1 || (cat build.log && exit 1)
          sudo make install-libdrizzle-1.0 > build.log 2>&1 || (cat build.log && exit 1)

      - name: Build mockeagain
        run: cd mockeagain && make CC=$CC -j$JOBS

      - name: Build lua-cjson
        run: cd lua-cjson && make -j$JOBS && sudo make install

      - name: Set up BoringSSL
        if: matrix.BORINGSSL == '1'
        run: |
          sudo rm -fr $OPENSSL_PREFIX
          sudo mkdir -p $OPENSSL_PREFIX
          sudo tar -C $OPENSSL_PREFIX -xf boringssl-20230902-x64-focal.tar.gz --strip-components=1

      - name: Build nginx
        run: |
          export LD_LIBRARY_PATH=$LUAJIT_LIB:$LD_LIBRARY_PATH
          export PATH=$PWD/work/nginx/sbin:$PWD/openresty-devel-utils:/opt/curl/bin:$PATH
          export NGX_BUILD_CC=$CC
          export NGX_BUILD_ASAN="${{ matrix.ASAN }}"
          if [ "${{ matrix.ASAN }}" != "1" ]; then
            sh util/build-without-ssl.sh ${{ matrix.NGINX_VERSION }} > build.log 2>&1 || (cat build.log && exit 1)
            sh util/build-with-dd.sh     ${{ matrix.NGINX_VERSION }} > build.log 2>&1 || (cat build.log && exit 1)
          fi
          rm -fr buildroot
          sh util/build.sh             ${{ matrix.NGINX_VERSION }} > build.log 2>&1 || (cat build.log && exit 1)
          nginx -V
          ldd $(which nginx) | grep -E 'luajit|ssl|pcre'

      - name: Run releng check
        run: |
          export PATH=$PWD/work/nginx/sbin:$PWD/openresty-devel-utils:/opt/curl/bin:$PATH
          ngx-releng > check.txt || true
          lines=$(wc -l check.txt | awk '{print $1}')
          if [ "$lines" -gt 5 ]; then cat check.txt; exit 1; fi

      - name: Set matrix-specific test env vars
        run: |
          # Only export vars that have actual values — Perl's defined() treats
          # empty strings as defined, which would cause false positives in tests
          # like t/103-req-http-ver.t that branch on defined $ENV{TEST_NGINX_USE_HTTP3}.
          [ -n "${{ matrix.TEST_NGINX_TIMEOUT }}" ] \
            && echo "TEST_NGINX_TIMEOUT=${{ matrix.TEST_NGINX_TIMEOUT }}" >> $GITHUB_ENV || true
          [ -n "${{ matrix.TEST_NGINX_USE_HTTP2 }}" ] \
            && echo "TEST_NGINX_USE_HTTP2=${{ matrix.TEST_NGINX_USE_HTTP2 }}" >> $GITHUB_ENV || true
          [ -n "${{ matrix.TEST_NGINX_USE_HTTP3 }}" ] \
            && echo "TEST_NGINX_USE_HTTP3=${{ matrix.TEST_NGINX_USE_HTTP3 }}" >> $GITHUB_ENV || true
          [ -n "${{ matrix.TEST_NGINX_QUIC_IDLE_TIMEOUT }}" ] \
            && echo "TEST_NGINX_QUIC_IDLE_TIMEOUT=${{ matrix.TEST_NGINX_QUIC_IDLE_TIMEOUT }}" >> $GITHUB_ENV || true

      - name: Run tests under ASan
        if: matrix.ASAN == '1'
        run: |
          export LD_LIBRARY_PATH=$LUAJIT_LIB:$PWD/mockeagain:$LD_LIBRARY_PATH
          export PATH=$PWD/work/nginx/sbin:$PWD/openresty-devel-utils:/opt/curl/bin:$PATH
          # The ASan runtime has to come first in the preload list: ASan refuses
          # to start behind another library, and some test files put mockeagain
          # there themselves.
          export LD_PRELOAD=$($CC -print-file-name=libasan.so):$PWD/mockeagain/mockeagain.so
          export TEST_NGINX_HTTP3_CRT=$PWD/t/cert/http3/http3.crt
          export TEST_NGINX_HTTP3_KEY=$PWD/t/cert/http3/http3.key
          # Resolve through the local dnsmasq cache, as the other job does.
          export TEST_NGINX_RESOLVER=127.0.0.1
          export TEST_NGINX_OPENRESTY_ORG_IP=$(dig +short @127.0.0.1 openresty.org | head -n1)
          mkdir -p asan-logs
          export ASAN_OPTIONS=detect_leaks=0,log_path=$PWD/asan-logs/asan,log_exe_name=true
          python3 ./util/nc_server.py &
          # ASan replaces the allocator, so glibc's malloc_trim() has nothing to
          # give back and t/146-malloc-trim.t sees it return 0 where it expects
          # 1. Run every other file.
          find t -name '*.t' ! -name '146-malloc-trim.t' -print0 | sort -z \
            | xargs -0 /usr/bin/env perl $(command -v prove) -I. -Itest-nginx/inc -Itest-nginx/lib

      - name: Show ASan reports
        if: matrix.ASAN == '1' && failure()
        run: |
          shopt -s nullglob
          for f in asan-logs/*; do
            echo "===== $f"
            cat "$f"
          done

      - name: Run tests
        if: matrix.ASAN != '1'
        run: |
          export LD_LIBRARY_PATH=$LUAJIT_LIB:$PWD/mockeagain:$LD_LIBRARY_PATH
          export PATH=$PWD/work/nginx/sbin:$PWD/openresty-devel-utils:/opt/curl/bin:$PATH
          export LD_PRELOAD=$PWD/mockeagain/mockeagain.so
          export TEST_NGINX_HTTP3_CRT=$PWD/t/cert/http3/http3.crt
          export TEST_NGINX_HTTP3_KEY=$PWD/t/cert/http3/http3.key
          # Resolve through the local dnsmasq cache. Without this the test files
          # fall back to their own default of 8.8.8.8, which sends every query
          # out to a public resolver -- the very thing the cache is here to
          # avoid -- and which cannot answer "localhost", so t/014-bugs.t TEST 37
          # and t/058-tcp-socket.t TEST 4 fail.
          export TEST_NGINX_RESOLVER=127.0.0.1
          export TEST_NGINX_OPENRESTY_ORG_IP=$(dig +short @127.0.0.1 openresty.org | head -n1)
          dig +short @127.0.0.1 openresty.org || true
          dig +short @127.0.0.1 agentzh.org || true
          python3 ./util/nc_server.py &
          /usr/bin/env perl $(command -v prove) -I. -Itest-nginx/inc -Itest-nginx/lib -r t/