undefect. CWE-407 — 63 sites patched across 27 ecosystems
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com Patches, unit tests, benchmarks, whitepaper, and outreach briefs. Public domain — no copyright claimed. Use freely.
This commit is contained in:
commit
0a580b313d
70422 changed files with 17213626 additions and 0 deletions
451
.github/workflows/main.yml
vendored
Normal file
451
.github/workflows/main.yml
vendored
Normal file
|
|
@ -0,0 +1,451 @@
|
|||
#
|
||||
# Copyright (c) 2022, 2025, Oracle and/or its affiliates. All rights reserved.
|
||||
# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
#
|
||||
# This code is free software; you can redistribute it and/or modify it
|
||||
# under the terms of the GNU General Public License version 2 only, as
|
||||
# published by the Free Software Foundation. Oracle designates this
|
||||
# particular file as subject to the "Classpath" exception as provided
|
||||
# by Oracle in the LICENSE file that accompanied this code.
|
||||
#
|
||||
# This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
# version 2 for more details (a copy is included in the LICENSE file that
|
||||
# accompanied this code).
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License version
|
||||
# 2 along with this work; if not, write to the Free Software Foundation,
|
||||
# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
#
|
||||
# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
# or visit www.oracle.com if you need additional information or have any
|
||||
# questions.
|
||||
#
|
||||
|
||||
name: 'OpenJDK GHA Sanity Checks'
|
||||
|
||||
on:
|
||||
push:
|
||||
branches-ignore:
|
||||
- pr/*
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
platforms:
|
||||
description: 'Platform(s) to execute on (comma separated, e.g. "linux-x64, macos, aarch64")'
|
||||
required: true
|
||||
default: 'linux-x64, linux-x64-variants, linux-cross-compile, alpine-linux-x64, macos-x64, macos-aarch64, windows-x64, windows-aarch64, docs'
|
||||
configure-arguments:
|
||||
description: 'Additional configure arguments'
|
||||
required: false
|
||||
make-arguments:
|
||||
description: 'Additional make arguments'
|
||||
required: false
|
||||
dry-run:
|
||||
description: 'Dry run: skip actual builds and tests'
|
||||
required: false
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
|
||||
jobs:
|
||||
|
||||
###
|
||||
### Determine platforms to include
|
||||
###
|
||||
|
||||
prepare:
|
||||
name: 'Prepare the run'
|
||||
runs-on: ubuntu-24.04
|
||||
env:
|
||||
# List of platforms to exclude by default
|
||||
EXCLUDED_PLATFORMS: 'alpine-linux-x64'
|
||||
outputs:
|
||||
linux-x64: ${{ steps.include.outputs.linux-x64 }}
|
||||
linux-x64-variants: ${{ steps.include.outputs.linux-x64-variants }}
|
||||
linux-cross-compile: ${{ steps.include.outputs.linux-cross-compile }}
|
||||
alpine-linux-x64: ${{ steps.include.outputs.alpine-linux-x64 }}
|
||||
macos-x64: ${{ steps.include.outputs.macos-x64 }}
|
||||
macos-aarch64: ${{ steps.include.outputs.macos-aarch64 }}
|
||||
windows-x64: ${{ steps.include.outputs.windows-x64 }}
|
||||
windows-aarch64: ${{ steps.include.outputs.windows-aarch64 }}
|
||||
docs: ${{ steps.include.outputs.docs }}
|
||||
dry-run: ${{ steps.include.outputs.dry-run }}
|
||||
|
||||
steps:
|
||||
- name: 'Checkout the scripts'
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
sparse-checkout: |
|
||||
.github
|
||||
make/conf/github-actions.conf
|
||||
|
||||
- name: 'Build JTReg'
|
||||
id: jtreg
|
||||
uses: ./.github/actions/build-jtreg
|
||||
|
||||
# TODO: Now that we are checking out the repo scripts, we can put the following code
|
||||
# into a separate file
|
||||
- name: 'Check what jobs to run'
|
||||
id: include
|
||||
run: |
|
||||
# Determine which platform jobs to run
|
||||
|
||||
# Returns 'true' if the input platform list matches any of the platform monikers given as argument,
|
||||
# 'false' otherwise.
|
||||
# arg $1: platform name or names to look for
|
||||
|
||||
# Convert EXCLUDED_PLATFORMS from a comma-separated string to an array
|
||||
IFS=',' read -r -a excluded_array <<< "$EXCLUDED_PLATFORMS"
|
||||
|
||||
function check_platform() {
|
||||
if [[ $GITHUB_EVENT_NAME == workflow_dispatch ]]; then
|
||||
input='${{ github.event.inputs.platforms }}'
|
||||
elif [[ $GITHUB_EVENT_NAME == push ]]; then
|
||||
if [[ '${{ !secrets.JDK_SUBMIT_FILTER || startsWith(github.ref, 'refs/heads/submit/') }}' == 'false' ]]; then
|
||||
# If JDK_SUBMIT_FILTER is set, and this is not a "submit/" branch, don't run anything
|
||||
>&2 echo 'JDK_SUBMIT_FILTER is set and not a "submit/" branch'
|
||||
echo 'false'
|
||||
return
|
||||
else
|
||||
input='${{ secrets.JDK_SUBMIT_PLATFORMS }}'
|
||||
fi
|
||||
fi
|
||||
|
||||
normalized_input="$(echo ,$input, | tr -d ' ')"
|
||||
if [[ "$normalized_input" == ",," ]]; then
|
||||
# For an empty input, assume all platforms should run, except those in the EXCLUDED_PLATFORMS list
|
||||
for excluded in "${excluded_array[@]}"; do
|
||||
if [[ "$1" == "$excluded" ]]; then
|
||||
echo 'false'
|
||||
return
|
||||
fi
|
||||
done
|
||||
echo 'true'
|
||||
return
|
||||
else
|
||||
# Check for all acceptable platform names
|
||||
for part in $* ; do
|
||||
if echo "$normalized_input" | grep -q -e ",$part," ; then
|
||||
echo 'true'
|
||||
return
|
||||
fi
|
||||
done
|
||||
|
||||
# If not explicitly included, check against the EXCLUDED_PLATFORMS list
|
||||
for excluded in "${excluded_array[@]}"; do
|
||||
if [[ "$1" == "$excluded" ]]; then
|
||||
echo 'false'
|
||||
return
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
echo 'false'
|
||||
}
|
||||
|
||||
function check_dry_run() {
|
||||
if [[ $GITHUB_EVENT_NAME == workflow_dispatch ]]; then
|
||||
# Take the user-specified one.
|
||||
echo '${{ github.event.inputs.dry-run }}'
|
||||
return
|
||||
elif [[ $GITHUB_EVENT_NAME == push ]]; then
|
||||
# Cut out the real branch name
|
||||
BRANCH=${GITHUB_REF##*/}
|
||||
|
||||
# Dry run rebuilds the caches in current branch, so they can be reused
|
||||
# for any child PR branches. Because of this, we want to trigger this
|
||||
# workflow in master branch, so that actual PR branches can use the cache.
|
||||
# This workflow would trigger every time contributors sync their master
|
||||
# branches in their personal forks.
|
||||
if [[ $BRANCH == "master" ]]; then
|
||||
echo 'true'
|
||||
return
|
||||
fi
|
||||
|
||||
# ...same for stabilization branches
|
||||
if [[ $BRANCH =~ "jdk(.*)" ]]; then
|
||||
echo 'true'
|
||||
return
|
||||
fi
|
||||
fi
|
||||
|
||||
echo 'false'
|
||||
}
|
||||
|
||||
echo "linux-x64=$(check_platform linux-x64 linux x64)" >> $GITHUB_OUTPUT
|
||||
echo "linux-x64-variants=$(check_platform linux-x64-variants variants)" >> $GITHUB_OUTPUT
|
||||
echo "linux-cross-compile=$(check_platform linux-cross-compile cross-compile)" >> $GITHUB_OUTPUT
|
||||
echo "alpine-linux-x64=$(check_platform alpine-linux-x64 alpine-linux x64)" >> $GITHUB_OUTPUT
|
||||
echo "macos-x64=$(check_platform macos-x64 macos x64)" >> $GITHUB_OUTPUT
|
||||
echo "macos-aarch64=$(check_platform macos-aarch64 macos aarch64)" >> $GITHUB_OUTPUT
|
||||
echo "windows-x64=$(check_platform windows-x64 windows x64)" >> $GITHUB_OUTPUT
|
||||
echo "windows-aarch64=$(check_platform windows-aarch64 windows aarch64)" >> $GITHUB_OUTPUT
|
||||
echo "docs=$(check_platform docs)" >> $GITHUB_OUTPUT
|
||||
echo "dry-run=$(check_dry_run)" >> $GITHUB_OUTPUT
|
||||
|
||||
###
|
||||
### Build jobs
|
||||
###
|
||||
|
||||
build-linux-x64:
|
||||
name: linux-x64
|
||||
needs: prepare
|
||||
uses: ./.github/workflows/build-linux.yml
|
||||
with:
|
||||
platform: linux-x64
|
||||
gcc-major-version: '10'
|
||||
configure-arguments: ${{ github.event.inputs.configure-arguments }}
|
||||
make-arguments: ${{ github.event.inputs.make-arguments }}
|
||||
dry-run: ${{ needs.prepare.outputs.dry-run == 'true' }}
|
||||
if: needs.prepare.outputs.linux-x64 == 'true'
|
||||
|
||||
build-linux-x64-hs-nopch:
|
||||
name: linux-x64-hs-nopch
|
||||
needs: prepare
|
||||
uses: ./.github/workflows/build-linux.yml
|
||||
with:
|
||||
platform: linux-x64
|
||||
make-target: 'hotspot'
|
||||
debug-levels: '[ "debug" ]'
|
||||
gcc-major-version: '10'
|
||||
extra-conf-options: '--disable-precompiled-headers'
|
||||
configure-arguments: ${{ github.event.inputs.configure-arguments }}
|
||||
make-arguments: ${{ github.event.inputs.make-arguments }}
|
||||
dry-run: ${{ needs.prepare.outputs.dry-run == 'true' }}
|
||||
if: needs.prepare.outputs.linux-x64-variants == 'true'
|
||||
|
||||
build-linux-x64-hs-zero:
|
||||
name: linux-x64-hs-zero
|
||||
needs: prepare
|
||||
uses: ./.github/workflows/build-linux.yml
|
||||
with:
|
||||
platform: linux-x64
|
||||
make-target: 'hotspot'
|
||||
debug-levels: '[ "debug" ]'
|
||||
gcc-major-version: '10'
|
||||
extra-conf-options: '--with-jvm-variants=zero --disable-precompiled-headers'
|
||||
configure-arguments: ${{ github.event.inputs.configure-arguments }}
|
||||
make-arguments: ${{ github.event.inputs.make-arguments }}
|
||||
dry-run: ${{ needs.prepare.outputs.dry-run == 'true' }}
|
||||
if: needs.prepare.outputs.linux-x64-variants == 'true'
|
||||
|
||||
build-linux-x64-hs-minimal:
|
||||
name: linux-x64-hs-minimal
|
||||
needs: prepare
|
||||
uses: ./.github/workflows/build-linux.yml
|
||||
with:
|
||||
platform: linux-x64
|
||||
make-target: 'hotspot'
|
||||
debug-levels: '[ "debug" ]'
|
||||
gcc-major-version: '10'
|
||||
extra-conf-options: '--with-jvm-variants=minimal --disable-precompiled-headers'
|
||||
configure-arguments: ${{ github.event.inputs.configure-arguments }}
|
||||
make-arguments: ${{ github.event.inputs.make-arguments }}
|
||||
dry-run: ${{ needs.prepare.outputs.dry-run == 'true' }}
|
||||
if: needs.prepare.outputs.linux-x64-variants == 'true'
|
||||
|
||||
build-linux-x64-hs-optimized:
|
||||
name: linux-x64-hs-optimized
|
||||
needs: prepare
|
||||
uses: ./.github/workflows/build-linux.yml
|
||||
with:
|
||||
platform: linux-x64
|
||||
make-target: 'hotspot'
|
||||
# Technically this is not the "debug" level, but we can't inject a new matrix state for just this job
|
||||
debug-levels: '[ "debug" ]'
|
||||
gcc-major-version: '10'
|
||||
extra-conf-options: '--with-debug-level=optimized --disable-precompiled-headers'
|
||||
configure-arguments: ${{ github.event.inputs.configure-arguments }}
|
||||
make-arguments: ${{ github.event.inputs.make-arguments }}
|
||||
dry-run: ${{ needs.prepare.outputs.dry-run == 'true' }}
|
||||
if: needs.prepare.outputs.linux-x64-variants == 'true'
|
||||
|
||||
build-linux-x64-static:
|
||||
name: linux-x64-static
|
||||
needs: prepare
|
||||
uses: ./.github/workflows/build-linux.yml
|
||||
with:
|
||||
platform: linux-x64
|
||||
make-target: 'static-jdk-bundles'
|
||||
# There are issues with fastdebug static build in GHA due to space limit.
|
||||
# Only do release build for now.
|
||||
debug-levels: '[ "release" ]'
|
||||
gcc-major-version: '10'
|
||||
configure-arguments: ${{ github.event.inputs.configure-arguments }}
|
||||
make-arguments: ${{ github.event.inputs.make-arguments }}
|
||||
dry-run: ${{ needs.prepare.outputs.dry-run == 'true' }}
|
||||
static-suffix: "-static"
|
||||
if: needs.prepare.outputs.linux-x64 == 'true'
|
||||
|
||||
build-linux-x64-static-libs:
|
||||
name: linux-x64-static-libs
|
||||
needs: prepare
|
||||
uses: ./.github/workflows/build-linux.yml
|
||||
with:
|
||||
platform: linux-x64
|
||||
make-target: 'static-libs-bundles'
|
||||
# Only build static-libs-bundles for release builds.
|
||||
# For debug builds, building static-libs often exceeds disk space.
|
||||
debug-levels: '[ "release" ]'
|
||||
gcc-major-version: '10'
|
||||
configure-arguments: ${{ github.event.inputs.configure-arguments }}
|
||||
make-arguments: ${{ github.event.inputs.make-arguments }}
|
||||
dry-run: ${{ needs.prepare.outputs.dry-run == 'true' }}
|
||||
# Upload static libs bundles separately to avoid interference with normal linux-x64 bundle.
|
||||
# This bundle is not used by testing jobs, but downstreams use it to check that
|
||||
# dependent projects, e.g. libgraal, builds fine.
|
||||
bundle-suffix: "-static-libs"
|
||||
if: needs.prepare.outputs.linux-x64-variants == 'true'
|
||||
|
||||
build-linux-cross-compile:
|
||||
name: linux-cross-compile
|
||||
needs: prepare
|
||||
uses: ./.github/workflows/build-cross-compile.yml
|
||||
with:
|
||||
gcc-major-version: '10'
|
||||
configure-arguments: ${{ github.event.inputs.configure-arguments }}
|
||||
make-arguments: ${{ github.event.inputs.make-arguments }}
|
||||
dry-run: ${{ needs.prepare.outputs.dry-run == 'true' }}
|
||||
if: needs.prepare.outputs.linux-cross-compile == 'true'
|
||||
|
||||
build-alpine-linux-x64:
|
||||
name: alpine-linux-x64
|
||||
needs: prepare
|
||||
uses: ./.github/workflows/build-alpine-linux.yml
|
||||
with:
|
||||
platform: alpine-linux-x64
|
||||
configure-arguments: ${{ github.event.inputs.configure-arguments }}
|
||||
make-arguments: ${{ github.event.inputs.make-arguments }}
|
||||
dry-run: ${{ needs.prepare.outputs.dry-run == 'true' }}
|
||||
if: needs.prepare.outputs.alpine-linux-x64 == 'true'
|
||||
|
||||
build-macos-x64:
|
||||
name: macos-x64
|
||||
needs: prepare
|
||||
uses: ./.github/workflows/build-macos.yml
|
||||
with:
|
||||
platform: macos-x64
|
||||
runs-on: 'macos-15-intel'
|
||||
xcode-toolset-version: '16.4'
|
||||
configure-arguments: ${{ github.event.inputs.configure-arguments }}
|
||||
make-arguments: ${{ github.event.inputs.make-arguments }}
|
||||
dry-run: ${{ needs.prepare.outputs.dry-run == 'true' }}
|
||||
if: needs.prepare.outputs.macos-x64 == 'true'
|
||||
|
||||
build-macos-aarch64:
|
||||
name: macos-aarch64
|
||||
needs: prepare
|
||||
uses: ./.github/workflows/build-macos.yml
|
||||
with:
|
||||
platform: macos-aarch64
|
||||
runs-on: 'macos-15'
|
||||
xcode-toolset-version: '16.4'
|
||||
configure-arguments: ${{ github.event.inputs.configure-arguments }}
|
||||
make-arguments: ${{ github.event.inputs.make-arguments }}
|
||||
dry-run: ${{ needs.prepare.outputs.dry-run == 'true' }}
|
||||
if: needs.prepare.outputs.macos-aarch64 == 'true'
|
||||
|
||||
build-windows-x64:
|
||||
name: windows-x64
|
||||
needs: prepare
|
||||
uses: ./.github/workflows/build-windows.yml
|
||||
with:
|
||||
platform: windows-x64
|
||||
msvc-toolset-version: '14.44'
|
||||
msvc-toolset-architecture: 'x86.x64'
|
||||
configure-arguments: ${{ github.event.inputs.configure-arguments }}
|
||||
make-arguments: ${{ github.event.inputs.make-arguments }}
|
||||
dry-run: ${{ needs.prepare.outputs.dry-run == 'true' }}
|
||||
if: needs.prepare.outputs.windows-x64 == 'true'
|
||||
|
||||
build-windows-aarch64:
|
||||
name: windows-aarch64
|
||||
needs: prepare
|
||||
uses: ./.github/workflows/build-windows.yml
|
||||
with:
|
||||
platform: windows-aarch64
|
||||
msvc-toolset-version: '14.44'
|
||||
msvc-toolset-architecture: 'arm64'
|
||||
make-target: 'hotspot'
|
||||
extra-conf-options: '--openjdk-target=aarch64-unknown-cygwin'
|
||||
configure-arguments: ${{ github.event.inputs.configure-arguments }}
|
||||
make-arguments: ${{ github.event.inputs.make-arguments }}
|
||||
dry-run: ${{ needs.prepare.outputs.dry-run == 'true' }}
|
||||
if: needs.prepare.outputs.windows-aarch64 == 'true'
|
||||
|
||||
build-docs:
|
||||
name: docs
|
||||
needs: prepare
|
||||
uses: ./.github/workflows/build-linux.yml
|
||||
with:
|
||||
platform: linux-x64
|
||||
debug-levels: '[ "debug" ]'
|
||||
make-target: 'docs-jdk-bundles'
|
||||
# Make sure we never try to make full docs, since that would require a
|
||||
# build JDK, and we do not need the additional testing of the graphs.
|
||||
extra-conf-options: '--disable-full-docs'
|
||||
gcc-major-version: '10'
|
||||
configure-arguments: ${{ github.event.inputs.configure-arguments }}
|
||||
make-arguments: ${{ github.event.inputs.make-arguments }}
|
||||
dry-run: ${{ needs.prepare.outputs.dry-run == 'true' }}
|
||||
if: needs.prepare.outputs.docs == 'true'
|
||||
|
||||
###
|
||||
### Test jobs
|
||||
###
|
||||
|
||||
test-linux-x64:
|
||||
name: linux-x64
|
||||
needs:
|
||||
- prepare
|
||||
- build-linux-x64
|
||||
uses: ./.github/workflows/test.yml
|
||||
with:
|
||||
platform: linux-x64
|
||||
bootjdk-platform: linux-x64
|
||||
runs-on: ubuntu-24.04
|
||||
dry-run: ${{ needs.prepare.outputs.dry-run == 'true' }}
|
||||
debug-suffix: -debug
|
||||
|
||||
test-linux-x64-static:
|
||||
name: linux-x64-static
|
||||
needs:
|
||||
- prepare
|
||||
- build-linux-x64
|
||||
- build-linux-x64-static
|
||||
uses: ./.github/workflows/test.yml
|
||||
with:
|
||||
platform: linux-x64
|
||||
bootjdk-platform: linux-x64
|
||||
runs-on: ubuntu-24.04
|
||||
dry-run: ${{ needs.prepare.outputs.dry-run == 'true' }}
|
||||
static-suffix: "-static"
|
||||
|
||||
test-macos-aarch64:
|
||||
name: macos-aarch64
|
||||
needs:
|
||||
- prepare
|
||||
- build-macos-aarch64
|
||||
uses: ./.github/workflows/test.yml
|
||||
with:
|
||||
platform: macos-aarch64
|
||||
bootjdk-platform: macos-aarch64
|
||||
runs-on: macos-15
|
||||
dry-run: ${{ needs.prepare.outputs.dry-run == 'true' }}
|
||||
xcode-toolset-version: '16.4'
|
||||
debug-suffix: -debug
|
||||
|
||||
test-windows-x64:
|
||||
name: windows-x64
|
||||
needs:
|
||||
- prepare
|
||||
- build-windows-x64
|
||||
uses: ./.github/workflows/test.yml
|
||||
with:
|
||||
platform: windows-x64
|
||||
bootjdk-platform: windows-x64
|
||||
runs-on: windows-2025
|
||||
dry-run: ${{ needs.prepare.outputs.dry-run == 'true' }}
|
||||
debug-suffix: -debug
|
||||
Loading…
Add table
Add a link
Reference in a new issue