.github/workflows/linux.yml

name: Linux

on:
  push:
    branches: [ "*" ]
    paths-ignore:
      - 'docs/**'
      - STATUS
      - CHANGES
      - README*
      - '**.md'
      - changes-entries/*
      - .asf.yaml
    tags:
      - 2.*
  pull_request:
    branches: [ "trunk", "2.4.x" ]
    paths-ignore:
      - 'docs/**'
      - STATUS
      - CHANGES
      - README*
      - '**.md'
      - changes-entries/*

permissions:
  contents: read

env:
  CFLAGS: "-g"

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  build:
    strategy:
      fail-fast: false
      # https://infra.apache.org/github-actions-policy.html requires a
      # job concurrency level of 20 or less.
      max-parallel: 20
      matrix:
        include:
          # -------------------------------------------------------------------------
          - name: Default
          # -------------------------------------------------------------------------
          - name: All-static modules
            config: --enable-mods-static=reallyall
          # -------------------------------------------------------------------------
          - name: Prefork MPM, all-modules (except cgid)
            config: --enable-mods-shared=reallyall --with-mpm=prefork --disable-cgid
          # -------------------------------------------------------------------------
          - name: Worker MPM, all-modules
            config: --enable-mods-shared=reallyall --with-mpm=worker
          # -------------------------------------------------------------------------
          - name: Shared MPMs, all-modules
            config: --enable-mods-shared=reallyall --enable-mpms-shared=all
          # -------------------------------------------------------------------------
          - name: Event MPM, all-modules, mod_cgid fdpassing
            config: --enable-mods-shared=reallyall --with-mpm=event --disable-cgi --enable-cgid-fdpassing
          # -------------------------------------------------------------------------
          - name: Shared MPMs, all-modules, 64-bit ARM
            config: --enable-mods-shared=reallyall --enable-mpms-shared=all
            os: ubuntu-24.04-arm
          # -------------------------------------------------------------------------
          - name: Event MPM, all-modules, mod_cgid w/o fdpassing
            config: --enable-mods-shared=reallyall --with-mpm=event --disable-cgi
          # -------------------------------------------------------------------------
          - name: Default, all-modules + install
            config: --enable-mods-shared=reallyall
            env: |
              TEST_INSTALL=1
              APACHE_TEST_EXTRA_ARGS=-v
          # -------------------------------------------------------------------------
          - name: Default, all-modules, random test order
            config: --enable-mods-shared=reallyall
            env: |
              TEST_ARGS=-order=random
          # -------------------------------------------------------------------------
          - name: GCC 14 maintainer-mode w/-Werror, install + VPATH
            os: ubuntu-24.04
            config: --enable-mods-shared=reallyall --enable-maintainer-mode
            notest-cflags: -Werror -O2
            pkgs: gcc-14
            env: |
              CC=gcc-14
              TEST_VPATH=1
              TEST_INSTALL=1
              SKIP_TESTING=1
          # -------------------------------------------------------------------------
          - name: All-modules, APR 1.7.6, APR-util 1.6.5
            config: --enable-mods-shared=reallyall
            env: |
              APR_VERSION=1.7.6
              APU_VERSION=1.6.5
              APU_CONFIG="--with-crypto --with-ldap"
          # -------------------------------------------------------------------------
          - name: APR 1.7.6, APR-util 1.6.5 (no APU crypto/LDAP)
            config: --enable-mods-shared=reallyall
            env: |
              APR_VERSION=1.7.6
              APU_VERSION=1.6.5
              APU_CONFIG="--without-crypto --without-ldap"
          # -------------------------------------------------------------------------
          - name: APR 1.7.x, APR-util 1.6.x
            config: --enable-mods-shared=reallyall
            env: |
              APR_VERSION=1.7.x
              APU_VERSION=1.6.x
              APU_CONFIG="--with-crypto --with-ldap"
          # -------------------------------------------------------------------------
          - name: APR 1.8.x, APR-util 1.7.x
            config: --enable-mods-shared=reallyall
            env: |
              APR_VERSION=1.8.x
              APU_VERSION=1.7.x
              APU_CONFIG="--with-crypto --with-ldap"
          # -------------------------------------------------------------------------
          # Oldest supported APR/APR-util branches.  Their configure
          # tests fail to compile with GCC 14 or later.
          - name: APR 1.4.8, APR-util 1.3.12
            os: ubuntu-24.04
            config: --enable-mods-shared=reallyall
            env: |
              TEST_APR_TARBALL=yes
              APR_VERSION=1.4.8
              APU_VERSION=1.3.12
              APU_CONFIG="--with-crypto --with-ldap"
          # -------------------------------------------------------------------------
          - name: Pool-debug
            config: --enable-mods-shared=reallyall
            env: |
              APR_VERSION=1.7.x
              APR_CONFIG="--enable-pool-debug"
              APU_VERSION=1.7.x
              APU_CONFIG="--with-crypto --with-ldap"
              TEST_MALLOC=1
          # -------------------------------------------------------------------------
          - name: Shared MPMs (event), pool-debug, SSL/TLS variants
            config: --enable-mods-shared=reallyall --enable-mpms-shared=all --with-mpm=event
            env: |
              APR_VERSION=1.7.x
              APR_CONFIG="--enable-pool-debug"
              APU_VERSION=1.7.x
              APU_CONFIG="--with-crypto --with-ldap"
              TEST_MALLOC=1
              TEST_SSL=1
          # -------------------------------------------------------------------------
          - name: Shared MPMs (worker), pool-debug, SSL/TLS variants
            config: --enable-mods-shared=reallyall --enable-mpms-shared=all --with-mpm=worker
            env: |
              APR_VERSION=1.7.x
              APR_CONFIG="--enable-pool-debug"
              APU_VERSION=1.7.x
              APU_CONFIG="--with-crypto --with-ldap"
              TEST_MALLOC=1
              TEST_SSL=1
          # -------------------------------------------------------------------------
          - name: Shared MPMs (prefork), pool-debug, SSL/TLS variants
            config: --enable-mods-shared=reallyall --enable-mpms-shared=all --with-mpm=prefork
            env: |
              APR_VERSION=1.7.x
              APR_CONFIG="--enable-pool-debug"
              APU_VERSION=1.7.x
              APU_CONFIG="--with-crypto --with-ldap"
              TEST_MALLOC=1
              TEST_SSL=1
          # -------------------------------------------------------------------------
          - name: litmus WebDAV tests
            config: --enable-dav --enable-dav-fs
            env: |
              LITMUS=1
              TESTS="t/modules/dav.t"
            pkgs: litmus
          # -------------------------------------------------------------------------
          - name: APR 1.7.6, APR-util 1.6.3, LDAP
            config: --enable-mods-shared=reallyall
            pkgs: ldap-utils
            env: |
              APR_VERSION=1.7.6
              APU_VERSION=1.6.3
              APU_CONFIG="--with-crypto --with-ldap"
              TEST_MALLOC=1
              TEST_LDAP=1
              TEST_ARGS="-defines LDAP"
              TESTS="t/modules/"
          # -------------------------------------------------------------------------
          - name: APR 1.7.x, APR-util 1.7.x, LDAP
            config: --enable-mods-shared=reallyall
            pkgs: ldap-utils
            env: |
              APR_VERSION=1.7.x
              APU_VERSION=1.7.x
              APU_CONFIG="--with-crypto --with-ldap"
              TEST_MALLOC=1
              TEST_LDAP=1
              TEST_ARGS="-defines LDAP"
              TESTS="t/modules/"
          # -------------------------------------------------------------------------
          ### TODO: if: *condition_not_24x
          - name: APR trunk thread debugging
            config: --enable-mods-shared=reallyall --with-mpm=event
            env: |
              APR_VERSION=trunk
              APR_CONFIG="--with-crypto --enable-thread-debug"
          # -------------------------------------------------------------------------
          - name: ASan
            notest-cflags: -ggdb -fsanitize=address -fno-sanitize-recover=address -fno-omit-frame-pointer
            config: --enable-mods-shared=reallyall
            env: |
              APR_VERSION=1.7.x
              APU_VERSION=1.7.x
              APU_CONFIG="--with-crypto --with-ldap"
              TEST_ASAN=1
          # -------------------------------------------------------------------------
          - name: ASan, pool-debug
            notest-cflags: -ggdb -fsanitize=address -fno-sanitize-recover=address -fno-omit-frame-pointer
            config: --enable-mods-shared=reallyall
            env: |
              APR_VERSION=1.7.x
              APR_CONFIG="--enable-pool-debug"
              APU_VERSION=1.7.x
              APU_CONFIG="--with-crypto --with-ldap"
              TEST_ASAN=1
          # -------------------------------------------------------------------------
          # Runs every pytest-based test suite via `make check-all-pytest`.
          # See TEST_PYTEST in test/travis_run_linux.sh.
          - name: Python pytest test suites
            config: --enable-mods-shared=reallyall --with-mpm=event --enable-mpms-shared=all
            pkgs: nghttp2-client
            env: |
              APR_VERSION=1.7.6
              APU_VERSION=1.6.5
              APU_CONFIG="--with-crypto"
              NO_TEST_FRAMEWORK=1
              TEST_PYTEST=1
          # -------------------------------------------------------------------------
          ### TODO: if: *condition_not_24x
          ### TODO: pebble install is broken.
          # - name: ACME test suite
          #   config: --enable-mods-shared=reallyall --with-mpm=event --enable-mpms-shared=event
          #   pkgs: >-
          #     python3-pytest nghttp2-client python3-cryptography python3-requests python3-filelock
          #     golang-1.17 curl
          #   env: |
          #     APR_VERSION=1.7.6
          #     APU_VERSION=1.6.3
          #     APU_CONFIG="--with-crypto"
          #     GOROOT=/usr/lib/go-1.17
          #     NO_TEST_FRAMEWORK=1
          #     TEST_INSTALL=1
          #     TEST_MD=1
          # -------------------------------------------------------------------------
          ### TODO: if: *condition_not_24x
          # -------------------------------------------------------------------------
          ### TODO if: *condition_not_24x
          ### TODO: Fails because :i386 packages are not being found.
          # - name: i386 Shared MPMs, most modules, maintainer-mode w/-Werror
          #   config: --enable-mods-shared=reallyall --disable-xml2enc --disable-proxy-html --enable-mpms-shared=all --enable-maintainer-mode
          #   pkgs: >-
          #     cpanminus libc6-dev-i386 gcc-multilib libexpat1-dev:i386 libssl-dev:i386
          #     lib32z1-dev libbrotli-dev:i386 libpcre2-dev:i386 libldap2-dev:i386 libtool-bin
          #     perl-doc libapr1-dev libbrotli-dev:i386
          #   env: |
          #     PKG_CONFIG_PATH="/usr/lib/i386-linux-gnu/pkgconfig"
          #     NOTEST_CFLAGS="-Werror"
          #     CC="gcc -m32"
          #     APR_VERSION=1.7.3
          #     APU_VERSION=1.6.5
          # APU_CONFIG="--with-crypto --with-ldap"
          # -------------------------------------------------------------------------
          - name: OpenSSL 3.0 LTS
            config: --enable-mods-shared=most --enable-maintainer-mode --disable-md --disable-http2 --disable-ldap --disable-crypto
            env: |
              TEST_OPENSSL3=3.0.22
              APR_VERSION=1.7.6
              APU_VERSION=1.6.5
              APU_CONFIG="--without-crypto"
          # -------------------------------------------------------------------------
          - name: OpenSSL 3.4 -Werror
            config: --enable-mods-shared=most --enable-maintainer-mode --disable-md --disable-http2 --disable-ldap --disable-crypto
            notest-cflags: -Werror -O2
            env: |
              TEST_OPENSSL3=3.4.8
              APR_VERSION=1.7.6
              APU_VERSION=1.6.5
              APU_CONFIG="--without-crypto"
          # -------------------------------------------------------------------------
          - name: OpenSSL 3.4 no-engine
            config: --enable-mods-shared=most --enable-maintainer-mode --disable-md --disable-http2 --disable-ldap --disable-crypto
            env: |
              TEST_OPENSSL3=3.4.8
              OPENSSL_CONFIG=no-engine
              APR_VERSION=1.7.6
              APU_VERSION=1.6.5
              APU_CONFIG="--without-crypto"
          # -------------------------------------------------------------------------
          - name: OpenSSL 3.5 no-engine -Werror
            config: --enable-mods-shared=most --enable-maintainer-mode --disable-md --disable-http2 --disable-ldap --disable-crypto
            notest-cflags: -Werror -O2
            env: |
              TEST_OPENSSL3=3.5.9
              OPENSSL_CONFIG=no-engine
              APR_VERSION=1.7.6
              APU_VERSION=1.6.5
              APU_CONFIG="--without-crypto"
          # -------------------------------------------------------------------------
          - name: OpenSSL 4.0
            config: --enable-mods-shared=most --enable-maintainer-mode --disable-md --disable-http2 --disable-ldap --disable-crypto
            notest-cflags: -Werror -O2
            env: |
              TEST_OPENSSL3=4.0.3
              OPENSSL_CONFIG=
              APR_VERSION=1.7.6
              APU_VERSION=1.6.5
              APU_CONFIG="--without-crypto"
          # -------------------------------------------------------------------------
    runs-on: ${{ matrix.os == '' && 'ubuntu-latest' || matrix.os }}
    timeout-minutes: 30
    env:
      NOTEST_CFLAGS: ${{ matrix.notest-cflags }}
      CONFIG: ${{ matrix.config }}
    name: ${{ matrix.name }}
    steps:
    # JOBID names the artifacts uploaded on failure; see "Artifacts" in
    # README.ci.  IMAGEOS is exported so that it is visible to the env
    # context, which does not see the runner's own $ImageOS.
    - name: Set environment variables
      env:
        MATRIX_NAME: ${{ matrix.name }}
      run: |
        echo "${{ matrix.env }}" >> $GITHUB_ENV
        echo "IMAGEOS=$ImageOS" >> $GITHUB_ENV
        # The scripts run "make $MFLAGS"; default it to the number of
        # CPUs the runner has, unless the matrix entry set it already.
        grep -q '^MFLAGS=' $GITHUB_ENV || echo "MFLAGS=-j`nproc`" >> $GITHUB_ENV
        # Use whichever php-fpm the runner image ships, so this doesn't
        # break when the image moves to a new PHP version, unless the
        # matrix entry set PHP_FPM already.
        if ! grep -q '^PHP_FPM=' $GITHUB_ENV; then
          PHP_FPM=`ls -1 /usr/sbin/php-fpm* 2>/dev/null | sort -V | tail -n1`
          if test -z "$PHP_FPM"; then
            echo "::error::No php-fpm found in /usr/sbin"
            exit 1
          fi
          echo "PHP_FPM=$PHP_FPM" >> $GITHUB_ENV
        fi
        echo JOBID=`printf '%s-%s' "${{ strategy.job-index }}" "$MATRIX_NAME" \
           | tr -cs '[:alnum:]._-' '-'` >> $GITHUB_ENV
    - name: apt refresh
      run: sudo apt-get -o Acquire::Retries=5 update
    # cpanminus and perl-doc are only used to build the CPAN modules for
    # the Perl test framework, and perl-doc drags in around a hundred
    # packages.  gdb is only used to extract a backtrace from any core
    # dumped during testing, which includes the pytest suites.
    - name: Install prerequisites
      run: sudo apt-get install -o Acquire::Retries=5
                    libtool-bin libapr1-dev libaprutil1-dev
                    liblua5.3-dev libbrotli-dev libcurl4-openssl-dev
                    libnghttp2-dev libjansson-dev libpcre2-dev
                    ${{ ! ( env.SKIP_TESTING || env.NO_TEST_FRAMEWORK ) && 'cpanminus perl-doc' || '' }}
                    ${{ ! env.SKIP_TESTING && 'gdb' || '' }}
                    libsasl2-dev ${{ matrix.pkgs }}
    - uses: actions/checkout@v6
    - uses: actions/checkout@v6
      with:
        repository: apache/httpd-tests
        path: test/perl-framework
        submodules: true
      if: ${{ ! ( env.SKIP_TESTING || env.NO_TEST_FRAMEWORK ) }}
    # Sets $ROOTID, identifying the contents of ~/root - left unset for
    # a job which builds no dependencies from source - and $PERLID,
    # identifying the perl which the ~/perl5 modules are built against.
    - name: Resolve dependency versions
      run: ./test/gha-resolve-deps.sh
    # Restored here but saved only once the dependencies have been built
    # successfully, below: a job which fails part-way through building
    # them would otherwise save a half-built tree under a key which can
    # never be updated.  Bump the serial in the key to discard the cached
    # builds and start afresh.
    - name: Restore installed libraries
      uses: actions/cache/restore@v5
      id: cache-libs
      if: env.ROOTID != ''
      with:
        path: ~/root
        key: cache-libs-1-${{ env.IMAGEOS }}-${{ runner.arch }}-${{ env.ROOTID }}
    # ~/perl5 does not vary by job: the module list is fixed and the
    # modules are always built with CC=gcc.  It varies only by the perl
    # ABI, which $PERLID identifies, and by the module list itself, so
    # one cache is shared by every job.  Bump the serial in the key to
    # force a rebuild against current CPAN.
    - name: Cache CPAN modules
      uses: actions/cache@v5
      if: ${{ ! ( env.SKIP_TESTING || env.NO_TEST_FRAMEWORK ) }}
      with:
        path: ~/perl5
        key: cache-cpan-1-${{ env.PERLID }}-${{ runner.arch }}-${{ hashFiles('test/travis_before_linux.sh') }}
    - name: Configure environment
      run: ./test/travis_before_linux.sh
      timeout-minutes: 15
    - name: Save installed libraries
      uses: actions/cache/save@v5
      if: success() && env.ROOTID != '' && steps.cache-libs.outputs.cache-hit != 'true'
      with:
        path: ~/root
        key: ${{ steps.cache-libs.outputs.cache-primary-key }}
    - uses: actions/upload-artifact@v7
      if: failure()
      with:
        name: config.log-${{ env.JOBID }}
        path: |
          /home/runner/build/**/config.log
    - name: Install uv
      if: env.TEST_PYTEST == '1'
      run: |
        pipx install uv
        echo "$HOME/.local/bin" >> $GITHUB_PATH
    - name: Build and test
      run: ./test/travis_run_linux.sh
    - uses: actions/upload-artifact@v7
      if: failure()
      with:
        name: error_log-${{ env.JOBID }}
        path: |
          **/config.log
          test/perl-framework/t/logs/error_log