Overhead Regression #63
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Overhead Regression | |
| on: | |
| schedule: | |
| - cron: '0 7 * * *' | |
| workflow_dispatch: | |
| workflow_call: | |
| # No concurrency group: github.workflow is the caller's here, so any group collides with sibling calls. | |
| jobs: | |
| discover_versions: | |
| uses: ./.github/workflows/_discover-versions.yml | |
| with: | |
| resolve_fips: true | |
| perf_nonfips: | |
| needs: discover_versions | |
| name: Overhead regression (non-FIPS) | |
| runs-on: ubuntu-22.04 | |
| timeout-minutes: 30 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| openssl_ref: | |
| - master | |
| - ${{ needs.discover_versions.outputs.openssl_latest_ref }} | |
| wolfssl_ref: ${{ fromJson(needs.discover_versions.outputs.wolfssl_latest_ref_array) }} | |
| steps: | |
| - name: Checkout wolfProvider | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 1 | |
| - name: Build wolfProvider | |
| run: | | |
| OPENSSL_TAG=${{ matrix.openssl_ref }} WOLFSSL_TAG=${{ matrix.wolfssl_ref }} ./scripts/build-wolfprovider.sh | |
| - name: Run overhead regression | |
| run: | | |
| source scripts/env-setup | |
| OPENSSL_TAG=${{ matrix.openssl_ref }} WOLFSSL_TAG=${{ matrix.wolfssl_ref }} ./scripts/perf_test/do-perf-tests.sh | |
| - name: Upload results | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: perf-results-nonfips-${{ matrix.wolfssl_ref }}-${{ matrix.openssl_ref }} | |
| path: perf_outputs/results.json | |
| retention-days: 7 | |
| # Without this gate, a discovery failure (falling back to the 5.8.2 floor) | |
| # would let perf_fips silently benchmark a stale bundle labeled "latest". | |
| # See fips-ready.yml for the fuller rationale. | |
| require_fips_resolved: | |
| needs: discover_versions | |
| name: Require FIPS Ready bundle discovery succeeded | |
| runs-on: ubuntu-22.04 | |
| timeout-minutes: 2 | |
| steps: | |
| - name: Fail if discovery fell back to the floor | |
| if: needs.discover_versions.outputs.fips_ready_resolved != 'true' | |
| run: | | |
| echo "::error::FIPS Ready bundle discovery failed and fell back to a single floor version; refusing to benchmark a stale bundle under the 'latest' label." | |
| exit 1 | |
| perf_fips: | |
| needs: [discover_versions, require_fips_resolved] | |
| name: Overhead regression (FIPS Ready ${{ needs.discover_versions.outputs.fips_ready_latest }}) | |
| runs-on: ubuntu-22.04 | |
| timeout-minutes: 30 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # Newest bundle only: perf-baseline.fips.json is a single calibrated | |
| # baseline, so fanning it across versions makes the numbers meaningless. | |
| wolfssl_bundle_ref: [ '${{ needs.discover_versions.outputs.fips_ready_latest }}' ] | |
| openssl_ref: ${{ fromJson(needs.discover_versions.outputs.openssl_latest_ref_array) }} | |
| steps: | |
| - name: Checkout wolfProvider | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 1 | |
| - name: Download FIPS Ready Bundle | |
| uses: ./.github/actions/fetch-fips-bundle | |
| with: | |
| version: ${{ matrix.wolfssl_bundle_ref }} | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build wolfProvider with FIPS Ready Bundle | |
| run: | | |
| OPENSSL_TAG=${{ matrix.openssl_ref }} ./scripts/build-wolfprovider.sh --fips-bundle="$FIPS_BUNDLE_PATH" \ | |
| --fips-check=ready --wolfssl-ver=v${{ matrix.wolfssl_bundle_ref }}-stable | |
| - name: Report resolved FIPS module version | |
| run: | | |
| # Authoritative source: the FIPS version wolfSSL's own build resolved | |
| # `ready` to, read from HAVE_FIPS_VERSION_MAJOR rather than guessed | |
| # from the bundle version. A missing file or macro means the FIPS | |
| # build did not install as expected, so fail rather than report | |
| # "unknown". | |
| OPTS="wolfssl-install/include/wolfssl/options.h" | |
| if [ ! -f "$OPTS" ]; then | |
| echo "::error::wolfSSL options.h not found at $OPTS; FIPS build did not install as expected" | |
| exit 1 | |
| fi | |
| MAJ=$(grep -oE '#define +HAVE_FIPS_VERSION_MAJOR +[0-9]+' "$OPTS" | awk '{print $3}') | |
| if [ -z "$MAJ" ]; then | |
| echo "::error::HAVE_FIPS_VERSION_MAJOR not found in $OPTS" | |
| exit 1 | |
| fi | |
| echo "Bundle ${{ matrix.wolfssl_bundle_ref }} builds FIPS module v$MAJ" | |
| echo "FIPS module v$MAJ from bundle ${{ matrix.wolfssl_bundle_ref }}" >> "$GITHUB_STEP_SUMMARY" | |
| - name: Run overhead regression | |
| run: | | |
| export WOLFSSL_ISFIPS=1 | |
| source scripts/env-setup | |
| WOLFSSL_TAG=v${{ matrix.wolfssl_bundle_ref }}-stable OPENSSL_TAG=${{ matrix.openssl_ref }} ./scripts/perf_test/do-perf-tests.sh | |
| - name: Upload results | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: perf-results-fips-${{ matrix.wolfssl_bundle_ref }}-${{ matrix.openssl_ref }} | |
| path: perf_outputs/results.json | |
| retention-days: 7 |