From: William Lallemand <wlallemand@haproxy.com>
Date: Mon, 3 Aug 2026 10:01:22 +0000 (+0200)
Subject: CI: github: add USE_ECH=1 in OpenSSL and AWS-LC jobs
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=bd71ed53b403a244e97709cc174ee2dce9b7df60;p=thirdparty%2Fhaproxy.git

CI: github: add USE_ECH=1 in OpenSSL and AWS-LC jobs

Add USE_ECH=1 in standard jobs when supported.

AWS-LC and OpenSSL > 4.0 supports ECH.

Remove the specific openssl-ech job.
---

diff --git a/.github/matrix.py b/.github/matrix.py
index cc1fcb011..c84d87f2a 100755
--- a/.github/matrix.py
+++ b/.github/matrix.py
@@ -283,6 +283,15 @@ def main(ref_name):
             if ssl == "BORINGSSL=yes" or "QUICTLS" in ssl or "LIBRESSL" in ssl or "WOLFSSL" in ssl or "AWS_LC" in ssl or openssl_supports_quic:
                 flags.append("USE_QUIC=1")
 
+            supports_ech = False
+            try:
+              supports_ech = "AWS_LC" in ssl or version.Version(ssl.split("OPENSSL_VERSION=",1)[1]) >= version.Version("4.0")
+            except:
+              pass
+
+            if supports_ech:
+                flags.append("USE_ECH=1")
+
             matrix.append(
                 {
                     "name": "{}, {}, ssl={}".format(os, CC, clean_ssl(ssl)),
diff --git a/.github/workflows/aws-lc.yml b/.github/workflows/aws-lc.yml
index e239fa94f..90b2b91c1 100644
--- a/.github/workflows/aws-lc.yml
+++ b/.github/workflows/aws-lc.yml
@@ -44,7 +44,7 @@ jobs:
       - name: Compile HAProxy
         run: |
           make -j$(nproc) ERR=1 CC=gcc TARGET=linux-glibc \
-            USE_OPENSSL_AWSLC=1 USE_QUIC=1 \
+            USE_OPENSSL_AWSLC=1 USE_QUIC=1 USE_ECH=1 \
             SSL_LIB=${HOME}/opt/lib SSL_INC=${HOME}/opt/include \
             DEBUG="-DDEBUG_POOL_INTEGRITY -DDEBUG_UNIT" \
             ADDLIB="-Wl,-rpath,/usr/local/lib/ -Wl,-rpath,$HOME/opt/lib/"
diff --git a/.github/workflows/openssl-ech.yml b/.github/workflows/openssl-ech.yml
deleted file mode 100644
index 0ee3a2273..000000000
--- a/.github/workflows/openssl-ech.yml
+++ /dev/null
@@ -1,80 +0,0 @@
-name: openssl ECH
-
-on:
-  schedule:
-  - cron: "0 3 * * *"
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'haproxy' || github.event_name == 'workflow_dispatch' }}
-    steps:
-      - uses: actions/checkout@v6
-      - name: Install apt dependencies
-        run: |
-          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
-          sudo apt-get --no-install-recommends -y install socat gdb
-          sudo apt-get --no-install-recommends -y install libpsl-dev
-      - uses: ./.github/actions/setup-vtest
-      - name: Install OpenSSL+ECH
-        run: env OPENSSL_VERSION="git-feature/ech" GIT_TYPE="branch" scripts/build-ssl.sh
-      - name: Install curl+ECH
-        run: env SSL_LIB=${HOME}/opt/ scripts/build-curl.sh
-      - name: Compile HAProxy
-        run: |
-          make -j$(nproc) CC=gcc TARGET=linux-glibc \
-            USE_QUIC=1 USE_OPENSSL=1 USE_ECH=1 \
-            SSL_LIB=${HOME}/opt/lib SSL_INC=${HOME}/opt/include \
-            DEBUG="-DDEBUG_POOL_INTEGRITY -DDEBUG_UNIT" \
-            ADDLIB="-Wl,-rpath,/usr/local/lib/ -Wl,-rpath,$HOME/opt/lib/" \
-            ARCH_FLAGS="-ggdb3 -fsanitize=address"
-          sudo make install
-      - name: Show HAProxy version
-        id: show-version
-        run: |
-          ldd $(which haproxy)
-          haproxy -vv
-          echo "version=$(haproxy -vq)" >> $GITHUB_OUTPUT
-      - name: Install problem matcher for VTest
-        run: echo "::add-matcher::.github/vtest.json"
-      - name: Run VTest for HAProxy
-        id: vtest
-        run: |
-          # This is required for macOS which does not actually allow to increase
-          # the '-n' soft limit to the hard limit, thus failing to run.
-          ulimit -n 65536
-          # allow to catch coredumps
-          ulimit -c unlimited
-          make reg-tests VTEST_PROGRAM=${{ github.workspace }}/vtest/vtest REGTESTS_TYPES=default,bug,devel
-      - name: Show VTest results
-        if: ${{ failure() && steps.vtest.outcome == 'failure' }}
-        run: |
-          for folder in ${TMPDIR:-/tmp}/haregtests-*/vtc.*; do
-            printf "::group::"
-            cat $folder/INFO
-            cat $folder/LOG
-            echo "::endgroup::"
-          done
-          exit 1
-      - name: Run Unit tests
-        id: unittests
-        run: |
-          make unit-tests
-      - name: Show coredumps
-        if: ${{ failure() && steps.vtest.outcome == 'failure' }}
-        run: |
-          failed=false
-          shopt -s nullglob
-          for file in /tmp/core.*; do
-            failed=true
-            printf "::group::"
-            gdb -ex 'thread apply all bt full' ./haproxy $file
-            echo "::endgroup::"
-          done
-          if [ "$failed" = true ]; then
-            exit 1;
-          fi
diff --git a/.github/workflows/openssl-master.yml b/.github/workflows/openssl-master.yml
index ab9d1ca38..054f8c1ba 100644
--- a/.github/workflows/openssl-master.yml
+++ b/.github/workflows/openssl-master.yml
@@ -25,7 +25,7 @@ jobs:
       - name: Compile HAProxy
         run: |
           make -j$(nproc) ERR=1 CC=gcc TARGET=linux-glibc \
-            USE_QUIC=1 USE_OPENSSL=1 \
+            USE_QUIC=1 USE_OPENSSL=1 USE_ECH=1 \
             SSL_LIB=${HOME}/opt/lib SSL_INC=${HOME}/opt/include \
             DEBUG="-DDEBUG_POOL_INTEGRITY -DDEBUG_UNIT" \
             ADDLIB="-Wl,-rpath,/usr/local/lib/ -Wl,-rpath,$HOME/opt/lib/"