linux.yml

name: Linux

on:
  push:
    branches: [ "*" ]
    paths-ignore:
      - 'docs/**'
      - STATUS
      - CHANGES
      - README*
      - '**.md'
      - changes-entries/*
    tags:
      - 2.*
  pull_request:
    branches: [ "trunk", "2.4.x" ]
    paths-ignore:
      - 'docs/**'
      - STATUS
      - CHANGES
      - README*
      - '**.md'
      - changes-entries/*

permissions:
  contents: read

env:
  CFLAGS: "-g"
  # This will need updating as the ubuntu-latest image changes:
  PHP_FPM: "/usr/sbin/php-fpm8.3"

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  build:
    strategy:
      fail-fast: false
      # https://infra.apache.org/github-actions-policy.html requires a
      # job concurrency level of 20 or less.
      max-parallel: 20
      matrix:
        include:
          # -------------------------------------------------------------------------
          - name: Shared MPMs (event), pool-debug, SSL/TLS variants
            config: --enable-mods-shared=reallyall --enable-mpms-shared=all --with-mpm=event
            env: |
              APR_VERSION=1.7.x
              APR_CONFIG="--enable-pool-debug"
              APU_VERSION=1.7.x
              APU_CONFIG="--with-crypto --with-ldap"
              TEST_MALLOC=1
              TEST_SSL=1
          # -------------------------------------------------------------------------
          - name: Shared MPMs (worker), pool-debug, SSL/TLS variants
            config: --enable-mods-shared=reallyall --enable-mpms-shared=all --with-mpm=worker
            env: |
              APR_VERSION=1.7.x
              APR_CONFIG="--enable-pool-debug"
              APU_VERSION=1.7.x
              APU_CONFIG="--with-crypto --with-ldap"
              TEST_MALLOC=1
              TEST_SSL=1
          # -------------------------------------------------------------------------
          - name: Shared MPMs (prefork), pool-debug, SSL/TLS variants
            config: --enable-mods-shared=reallyall --enable-mpms-shared=all --with-mpm=prefork
            env: |
              APR_VERSION=1.7.x
              APR_CONFIG="--enable-pool-debug"
              APU_VERSION=1.7.x
              APU_CONFIG="--with-crypto --with-ldap"
              TEST_MALLOC=1
              TEST_SSL=1
          # -------------------------------------------------------------------------
          - name: UBSan
            notest-cflags: -fsanitize=undefined -fno-sanitize-recover=undefined
            config: --enable-mods-shared=reallyall --disable-http2
            env: |
              NOTEST_LIBS=-lubsan
              TEST_UBSAN=1
              TEST_PYTEST=1
          # -------------------------------------------------------------------------
          # The ASan jobs are the slowest in the matrix and so set the
          # wall-clock time for the whole workflow; running the Perl
          # framework and the pytest suites in separate jobs halves that.
          # Both halves build the same dependencies, so they share one
          # ~/root cache entry.
          - name: ASan
            notest-cflags: -ggdb -fsanitize=address -fno-sanitize-recover=address -fno-omit-frame-pointer
            config: --enable-mods-shared=reallyall
            env: |
              APR_VERSION=1.7.x
              APU_VERSION=1.7.x
              APU_CONFIG="--with-crypto --with-ldap"
              TEST_ASAN=1
          # -------------------------------------------------------------------------
          - name: ASan, pytest
            notest-cflags: -ggdb -fsanitize=address -fno-sanitize-recover=address -fno-omit-frame-pointer
            config: --enable-mods-shared=reallyall
            pkgs: nghttp2-client
            env: |
              APR_VERSION=1.7.x
              APU_VERSION=1.7.x
              APU_CONFIG="--with-crypto --with-ldap"
              TEST_ASAN=1
              NO_TEST_FRAMEWORK=1
              TEST_PYTEST=1
          # -------------------------------------------------------------------------
          - name: ASan, pool-debug
            notest-cflags: -ggdb -fsanitize=address -fno-sanitize-recover=address -fno-omit-frame-pointer -O2
            config: --enable-mods-shared=reallyall --enable-maintainer-mode
            env: |
              APR_VERSION=1.7.x
              APR_CONFIG="--enable-pool-debug"
              APU_VERSION=1.7.x
              APU_CONFIG="--with-crypto --with-ldap"
              TEST_ASAN=1
          # -------------------------------------------------------------------------
          - name: ASan, pool-debug, pytest
            notest-cflags: -ggdb -fsanitize=address -fno-sanitize-recover=address -fno-omit-frame-pointer -O2
            config: --enable-mods-shared=reallyall --enable-maintainer-mode
            pkgs: nghttp2-client
            env: |
              APR_VERSION=1.7.x
              APR_CONFIG="--enable-pool-debug"
              APU_VERSION=1.7.x
              APU_CONFIG="--with-crypto --with-ldap"
              TEST_ASAN=1
              NO_TEST_FRAMEWORK=1
              TEST_PYTEST=1
          # -------------------------------------------------------------------------
          # Runs every pytest-based test suite via `make check-all-pytest`.
          # See TEST_PYTEST/TEST_MD in test/travis_run_linux.sh.
          - name: Python pytest test suites
            config: --enable-mods-shared=reallyall --with-mpm=event --enable-mpms-shared=all
            pkgs: nghttp2-client
            env: |
              APR_VERSION=1.7.6
              APU_VERSION=1.6.5
              APU_CONFIG="--with-crypto"
              NO_TEST_FRAMEWORK=1
              TEST_PYTEST=1
              TEST_MD=1
          # -------------------------------------------------------------------------
          # Test against a newer nghttp2 than in the Ubuntu images.
          - name: mod_http2 w/nghttp2 1.68.0
            config: --enable-mods-shared=reallyall --enable-maintainer-mode --with-mpm=event
            pkgs: nghttp2-client
            env: |
              TEST_NGHTTP2=1.68.0
              NO_TEST_FRAMEWORK=1
              TEST_PYTEST=1
              PYHTTPD_TARGETS=modules/http2
              PYTEST_ARGS=--only=pyhttpd
          # -------------------------------------------------------------------------
          - name: Default
            # Check the defaults expected for a default build on Linux.
            config-output: >-
              SINGLE_LISTEN_UNSERIALIZED_ACCEPT AP_NONBLOCK_WHEN_MULTI_LISTEN
              AP_ENABLE_V4_MAPPED HAVE_GMTOFF HAVE_FDPASSING HAVE_CRYPT_SHA2
              HAVE_PCRE2 HAVE_EPOLL_CREATE HAVE_GETTID HAVE_PRCTL HAVE_TIMEGM
              HAVE_GETLOADAVG HAVE_FOPEN64 HAVE_SETSID HAVE_KILLPG HAVE_INITGROUPS
              AP_FORCE_EXPORTS HAVE_NGHTTP2 HAVE_CURL
            # buildconf strips these from the generated header.
            config-no-output: >-
              PACKAGE_NAME PACKAGE_TARNAME PACKAGE_VERSION PACKAGE_STRING
              PACKAGE_BUGREPORT PACKAGE_URL
          # -------------------------------------------------------------------------
          - name: All-static modules
            config: --enable-mods-static=reallyall
          # -------------------------------------------------------------------------
          - name: Prefork MPM, all-modules (except cgid)
            config: --enable-mods-shared=reallyall --with-mpm=prefork --disable-cgid
          # -------------------------------------------------------------------------
          - name: Worker MPM, all-modules
            config: --enable-mods-shared=reallyall --with-mpm=worker
          # -------------------------------------------------------------------------
          - name: Shared MPMs, all-modules
            config: --enable-mods-shared=reallyall --enable-mpms-shared=all
          # -------------------------------------------------------------------------
          - name: Shared MPMs, all-modules, 64-bit ARM
            config: --enable-mods-shared=reallyall --enable-mpms-shared=all
            os: ubuntu-24.04-arm
          # -------------------------------------------------------------------------
          - name: Event MPM, all-modules, mod_cgid only
            config: --enable-mods-shared=reallyall --with-mpm=event --disable-cgi
          # -------------------------------------------------------------------------
          - name: Event MPM, all-modules, no CMSG_DATA
            config: --enable-mods-shared=reallyall --with-mpm=event ac_cv_have_decl_CMSG_DATA=no
          # -------------------------------------------------------------------------
          - name: Default, all-modules + install
            config: --enable-mods-shared=reallyall
            env: |
              TEST_INSTALL=1
              APACHE_TEST_EXTRA_ARGS=-v
          # -------------------------------------------------------------------------
          - name: Default, all-modules, random test order
            config: --enable-mods-shared=reallyall
            env: |
              TEST_ARGS=-order=random
          # -------------------------------------------------------------------------
          - name: GCC 12 maintainer-mode w/-Werror, install + VPATH
            config: --enable-mods-shared=reallyall --enable-maintainer-mode
            notest-cflags: -Werror -O2
            env: |
              CC=gcc-12
              TEST_VPATH=1
              TEST_INSTALL=1
              SKIP_TESTING=1
          # -------------------------------------------------------------------------
          - name: All-modules, APR 1.7.6, APR-util 1.6.5
            config: --enable-mods-shared=reallyall
            env: |
              APR_VERSION=1.7.6
              APU_VERSION=1.6.5
              APU_CONFIG="--with-crypto --with-ldap"
          # -------------------------------------------------------------------------
          - name: APR 1.7.6, APR-util 1.6.5, LDAP
            config: --enable-mods-shared=reallyall
            pkgs: ldap-utils
            env: |
              APR_VERSION=1.7.6
              APU_VERSION=1.6.5
              APU_CONFIG="--with-crypto --with-ldap"
              TEST_MALLOC=1
              TEST_LDAP=1
              TEST_ARGS="-defines LDAP"
              TESTS="t/modules/"
              TEST_PYTEST=1
          # -------------------------------------------------------------------------
          - name: APR 1.7.x, APR-util 1.6.x
            config: --enable-mods-shared=reallyall
            env: |
              APR_VERSION=1.7.x
              APU_VERSION=1.6.x
              APU_CONFIG="--with-crypto --with-ldap"
          # -------------------------------------------------------------------------
          - name: APR 1.8.x, APR-util 1.7.x
            config: --enable-mods-shared=reallyall
            env: |
              APR_VERSION=1.8.x
              APU_VERSION=1.7.x
              APU_CONFIG="--with-crypto --with-ldap"
          # -------------------------------------------------------------------------
          - name: APR 1.7.x, APR-util 1.7.x, LDAP
            config: --enable-mods-shared=reallyall
            pkgs: ldap-utils
            env: |
              APR_VERSION=1.7.x
              APU_VERSION=1.7.x
              APU_CONFIG="--with-crypto --with-ldap"
              TEST_MALLOC=1
              TEST_LDAP=1
              TEST_ARGS="-defines LDAP"
              TESTS="t/modules/"
              TEST_PYTEST=1
          # -------------------------------------------------------------------------
          - name: APR trunk thread debugging
            config: --enable-mods-shared=reallyall --with-mpm=event
            env: |
              APR_VERSION=trunk
              APR_CONFIG="--with-crypto --enable-thread-debug"
          # -------------------------------------------------------------------------
          - name: Pool-debug
            config: --enable-mods-shared=reallyall
            env: |
              APR_VERSION=1.7.x
              APR_CONFIG="--enable-pool-debug"
              APU_VERSION=1.7.x
              APU_CONFIG="--with-crypto --with-ldap"
              TEST_MALLOC=1
          # -------------------------------------------------------------------------
          - name: litmus WebDAV tests
            config: --enable-dav --enable-dav-fs
            env: |
              LITMUS=1
              TESTS="t/modules/dav.t"
            pkgs: litmus
          # -------------------------------------------------------------------------
          - name: litmus WebDAV tests, APR trunk, LMDB
            config: --enable-dav --enable-dav-fs
            pkgs: litmus liblmdb-dev
            env: |
              APR_VERSION=trunk
              APR_CONFIG="--with-lmdb --with-dbm=lmdb"
              LITMUS=1
              TESTS="t/modules/dav.t"
          # -------------------------------------------------------------------------
          # MFLAGS= works around https://bz.apache.org/bugzilla/show_bug.cgi?id=63942
          ## TODO if: *condition_not_24x
          - name: Regenerate ap_expr
            config: --enable-mods-shared=reallyall --enable-maintainer-mode
            notest-cflags: -Werror -Wno-deprecated-declarations
            env: |
              BUILDCONFIG="--with-regen-expr"
              MFLAGS=
          # -------------------------------------------------------------------------
          - name: mod_systemd, reduced exports
            config: --enable-reduced-exports --enable-maintainer-mode --enable-systemd=shared
            pkgs: libsystemd-dev
            config-output: HAVE_SYSTEMD
            config-no-output: AP_FORCE_EXPORTS
            env: |
              TEST_INSTALL=1
              NO_TEST_FRAMEWORK=1
              TEST_PYTEST=1
              PYHTTPD_TARGETS=modules/arch
              PYTEST_ARGS=--only=pyhttpd
          # -------------------------------------------------------------------------
          ### TODO if: *condition_not_24x
          ### TODO: Fails because :i386 packages are not being found.
          # - name: i386 Shared MPMs, most modules, maintainer-mode w/-Werror
          #   config: --enable-mods-shared=reallyall --disable-xml2enc --disable-proxy-html --enable-mpms-shared=all --enable-maintainer-mode
          #   pkgs: >-
          #     cpanminus libc6-dev-i386 gcc-multilib libexpat1-dev:i386 libssl-dev:i386
          #     lib32z1-dev libbrotli-dev:i386 libpcre2-dev:i386 libldap2-dev:i386 libtool-bin
          #     perl-doc libapr1-dev libbrotli-dev:i386
          #   env: |
          #     PKG_CONFIG_PATH="/usr/lib/i386-linux-gnu/pkgconfig"
          #     NOTEST_CFLAGS="-Werror"
          #     CC="gcc -m32"
          #     APR_VERSION=1.7.0
          #     APU_VERSION=1.6.5
          # APU_CONFIG="--with-crypto --with-ldap"
          # -------------------------------------------------------------------------
          - name: OpenSSL 3.0 LTS
            config: --enable-mods-shared=most --enable-maintainer-mode --disable-md --disable-http2 --disable-ldap --disable-crypto
            config-no-output: HAVE_NGHTTP2 HAVE_CURL
            env: |
              TEST_OPENSSL3=3.0.22
              APR_VERSION=1.7.6
              APU_VERSION=1.6.5
              APU_CONFIG="--without-crypto"
          # -------------------------------------------------------------------------
          - name: OpenSSL 3.4 -Werror
            config: --enable-mods-shared=most --enable-maintainer-mode --disable-md --disable-http2 --disable-ldap --disable-crypto
            notest-cflags: -Werror -O2
            env: |
              TEST_OPENSSL3=3.4.7
              APR_VERSION=1.7.6
              APU_VERSION=1.6.5
              APU_CONFIG="--without-crypto"
          # -------------------------------------------------------------------------
          - name: OpenSSL 3.4 no-engine
            config: --enable-mods-shared=most --enable-maintainer-mode --disable-md --disable-http2 --disable-ldap --disable-crypto
            env: |
              TEST_OPENSSL3=3.4.7
              OPENSSL_CONFIG=no-engine
              APR_VERSION=1.7.6
              APU_VERSION=1.6.5
              APU_CONFIG="--without-crypto"
          # -------------------------------------------------------------------------
          - name: OpenSSL 3.5 no-engine -Werror
            config: --enable-mods-shared=most --enable-maintainer-mode --disable-md --disable-http2 --disable-ldap --disable-crypto
            notest-cflags: -Werror -O2
            env: |
              TEST_OPENSSL3=3.5.8
              OPENSSL_CONFIG=no-engine
              APR_VERSION=1.7.6
              APU_VERSION=1.6.5
              APU_CONFIG="--without-crypto"
          # -------------------------------------------------------------------------
          - name: OpenSSL 4.0
            config: --enable-mods-shared=most --enable-maintainer-mode --disable-md --disable-http2 --disable-ldap --disable-crypto
            notest-cflags: -Werror -O2
            env: |
              TEST_OPENSSL3=4.0.2
              OPENSSL_CONFIG=
              APR_VERSION=1.7.6
              APU_VERSION=1.6.5
              APU_CONFIG="--without-crypto"
          # -------------------------------------------------------------------------
    runs-on: ${{ matrix.os == '' && 'ubuntu-latest' || matrix.os }}
    timeout-minutes: 30
    env:
      NOTEST_CFLAGS: ${{ matrix.notest-cflags }}
      CONFIG: ${{ matrix.config }}
    name: ${{ matrix.name }}
    steps:
    # JOBID names the artifacts uploaded on failure; see "Artifacts" in
    # README.ci.  IMAGEOS is exported so that it is visible to the env
    # context, which does not see the runner's own $ImageOS.
    - name: Set environment variables
      env:
        MATRIX_NAME: ${{ matrix.name }}
      run: |
        echo "${{ matrix.env }}" >> $GITHUB_ENV
        echo "IMAGEOS=$ImageOS" >> $GITHUB_ENV
        # The scripts run "make $MFLAGS"; default it to the number of
        # CPUs the runner has, unless the matrix entry set it already
        # (the ap_expr job sets it empty on purpose).
        grep -q '^MFLAGS=' $GITHUB_ENV || echo "MFLAGS=-j`nproc`" >> $GITHUB_ENV
        echo JOBID=`printf '%s-%s' "${{ strategy.job-index }}" "$MATRIX_NAME" \
           | tr -cs '[:alnum:]._-' '-'` >> $GITHUB_ENV
    - name: apt refresh
      run: sudo apt-get -o Acquire::Retries=5 update
    # cpanminus and perl-doc are only used to build the CPAN modules for
    # the Perl test framework, and perl-doc drags in around a hundred
    # packages.  gdb is only used to extract a backtrace from any core
    # dumped during testing, which includes the pytest suites.
    - name: Install prerequisites
      run: sudo apt-get install -o Acquire::Retries=5
                    libtool-bin libapr1-dev libaprutil1-dev
                    liblua5.3-dev libbrotli-dev libcurl4-openssl-dev
                    libnghttp2-dev libjansson-dev libmagic-dev libpcre2-dev
                    ${{ ! ( env.SKIP_TESTING || env.NO_TEST_FRAMEWORK ) && 'cpanminus perl-doc' || '' }}
                    ${{ ! env.SKIP_TESTING && 'gdb' || '' }}
                    libsasl2-dev curl pipx ${{ matrix.pkgs }} check
    - uses: actions/checkout@v6
    - uses: actions/checkout@v6
      with:
        repository: apache/httpd-tests
        path: test/perl-framework
        submodules: true
      if: ${{ ! ( env.SKIP_TESTING || env.NO_TEST_FRAMEWORK ) }}
    # Sets $ROOTID, identifying the contents of ~/root - left unset for
    # a job which builds no dependencies from source - and $PERLID,
    # identifying the perl which the ~/perl5 modules are built against.
    - name: Resolve dependency versions
      run: ./test/gha-resolve-deps.sh
    # Restored here but saved only once the dependencies have been built
    # successfully, below: a job which fails part-way through building
    # them would otherwise save a half-built tree under a key which can
    # never be updated.  Bump the serial in the key to discard the cached
    # builds and start afresh.
    - name: Restore installed libraries
      uses: actions/cache/restore@v5
      id: cache-libs
      if: env.ROOTID != ''
      with:
        path: ~/root
        key: cache-libs-1-${{ env.IMAGEOS }}-${{ runner.arch }}-${{ env.ROOTID }}
    # ~/perl5 does not vary by job: the module list is fixed and the
    # modules are always built with CC=gcc.  It varies only by the perl
    # ABI, which $PERLID identifies, and by the module list itself, so
    # one cache is shared by every job.  Bump the serial in the key to
    # force a rebuild against current CPAN.
    - name: Cache CPAN modules
      uses: actions/cache@v5
      if: ${{ ! ( env.SKIP_TESTING || env.NO_TEST_FRAMEWORK ) }}
      with:
        path: ~/perl5
        key: cache-cpan-1-${{ env.PERLID }}-${{ runner.arch }}-${{ hashFiles('test/travis_before_linux.sh') }}
    - name: Configure environment
      run: ./test/travis_before_linux.sh
      timeout-minutes: 15
    - name: Save installed libraries
      uses: actions/cache/save@v5
      if: success() && env.ROOTID != '' && steps.cache-libs.outputs.cache-hit != 'true'
      with:
        path: ~/root
        key: ${{ steps.cache-libs.outputs.cache-primary-key }}
    - uses: actions/upload-artifact@v7
      if: failure()
      with:
        name: config.log-${{ env.JOBID }}
        path: |
          /home/runner/build/**/config.log
    - name: Install uv
      if: env.TEST_PYTEST == '1'
      run: |
        pipx install uv
        echo "$HOME/.local/bin" >> $GITHUB_PATH
    - name: Install pebble
      if: env.TEST_MD == '1'
      run: |
        go install github.com/letsencrypt/pebble/v2/cmd/pebble@latest \
          && go install github.com/letsencrypt/pebble/v2/cmd/pebble-challtestsrv@latest \
          && echo "$(go env GOPATH)/bin" >> $GITHUB_PATH \
          || echo "::warning::pebble install failed; modules/md tests will be skipped"
    - name: Build and test
      run: ./test/travis_run_linux.sh
    # Checks the config header in the build tree, so this must follow
    # the build, and is only useful for a non-VPATH job.
    - if: ${{ matrix.config-output != '' }}
      name: Check for expected ap_config_auto.h definitions
      run: for var in ${{ matrix.config-output }}; do
             grep --color=always "^#define *${var} *1" include/ap_config_auto.h;
           done
    - if: ${{ matrix.config-no-output != '' }}
      name: Check for unexpected ap_config_auto.h definitions
      run: for var in ${{ matrix.config-no-output }}; do
             ! grep --color=always "^#define *${var}" include/ap_config_auto.h;
           done
    - uses: actions/upload-artifact@v7
      if: failure()
      with:
        name: error_log-${{ env.JOBID }}
        path: |
          **/config.log
          test/perl-framework/t/logs/error_log
          test/pytest_suite/t/logs/error_log
          test/gen/apache/logs/error_log