GHA/linux: add BoringSSL job, with runtests, pytests and cache

Ref: cff4c16b83b1cc57469b2f729d1d06c7828f9f0f #18385
Cherry-picked from #18384
Closes #18386

diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index b479b46e4ce6faf6707371462d8c2d4f2a4a962c..8b1c37ba069f0f75817684c9b752d6c3372e9ce9 100644 (file)
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -51,6 +51,8 @@ env:
   MBEDTLS_VERSION: 3.6.4
   # renovate: datasource=github-tags depName=awslabs/aws-lc versioning=semver registryUrl=https://github.com
   AWSLC_VERSION: 1.58.0
+  # renovate: datasource=github-tags depName=google/boringssl versioning=semver registryUrl=https://github.com
+  BORINGSSL_VERSION: 0.20250818.0
   # handled in renovate.json
   OPENSSL_VERSION: 3.5.2
   # handled in renovate.json
@@ -144,6 +146,11 @@ jobs:
             install_steps: awslc
             generate: -DOPENSSL_ROOT_DIR=/home/runner/awslc -DUSE_ECH=ON -DCMAKE_UNITY_BUILD=OFF
 
+          - name: 'boringssl'
+            install_packages: zlib1g-dev
+            install_steps: boringssl pytest
+            generate: -DOPENSSL_ROOT_DIR=/home/runner/boringssl -DUSE_ECH=ON
+
           - name: 'openssl default'
             install_steps: pytest
             configure: --with-openssl --enable-debug --disable-unity
@@ -518,6 +525,27 @@ jobs:
           cmake --build .
           cmake --install .
 
+      - name: 'cache boringssl'
+        if: ${{ contains(matrix.build.install_steps, 'boringssl') }}
+        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4
+        id: cache-boringssl
+        env:
+          cache-name: cache-boringssl
+        with:
+          path: ~/boringssl
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.BORINGSSL_VERSION }}
+
+      - name: 'build boringssl'
+        if: ${{ contains(matrix.build.install_steps, 'boringssl') && steps.cache-boringssl.outputs.cache-hit != 'true' }}
+        run: |
+          mkdir boringssl-src
+          cd boringssl-src
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
+            "https://boringssl.googlesource.com/boringssl/+archive/${BORINGSSL_VERSION}.tar.gz" | tar -xz
+          cmake -B . -G Ninja -DCMAKE_INSTALL_PREFIX=/home/runner/boringssl -DBUILD_TESTING=OFF -DBUILD_SHARED_LIBS=ON
+          cmake --build .
+          cmake --install .
+
       - name: 'cache rustls'
         if: ${{ contains(matrix.build.install_steps, 'rustls') }}
         uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4