.github/workflows/backport.yml

# Copyright 2021-2026 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License").  You may not use
# this file except in compliance with the License.  You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html

name: Backports CI

on: [pull_request]

permissions:
  contents: read

jobs:
  check_backports:
    strategy:
      fail-fast: false
      matrix:
        release: [
          {
            branch: '4.0',
            cppflags: ''
          }, {
            branch: '3.6',
            cppflags: ''
          }, {
            branch: '3.5',
            cppflags: 'CPPFLAGS=-ansi'
          }, {
            branch: '3.4',
            cppflags: 'CPPFLAGS=-ansi'
          }, {
            branch: '3.3',
            cppflags: 'CPPFLAGS=-ansi',
          }, {
            branch: '3.2',
            cppflags: 'CPPFLAGS=-ansi'
          }, {
            branch: '3.0',
            cppflags: 'CPPFLAGS=-ansi'
          }
        ]
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v6
      if: ${{ contains(join(github.event.pull_request.labels.*.name,','),matrix.release.branch) }}
      with:
        ref: ${{ github.event.pull_request.head.sha }}
        fetch-depth: 0
        persist-credentials: false
    - name: cherry-pick
      if: ${{ contains(join(github.event.pull_request.labels.*.name,','),matrix.release.branch) }}
      run: |
           REFEND=$(git rev-parse HEAD)
           REFSTART=$(git rev-parse $REFEND~${{ github.event.pull_request.commits }})
           git checkout ${{ format('openssl-{0}', matrix.release.branch) }}
           git config user.name "OpenSSL Machine"
           git config user.email "openssl-machine@openssl.org"
           echo Cherry-picking $REFSTART..$REFEND
           git cherry-pick $REFSTART..$REFEND
    - name: config
      if: ${{ contains(join(github.event.pull_request.labels.*.name,','),matrix.release.branch) }}
      run: ${{ matrix.release.cppflags }} ./config --strict-warnings --banner=Configured no-asm enable-fips --strict-warnings -D_DEFAULT_SOURCE && perl configdata.pm --dump
    - name: make
      if: ${{ contains(join(github.event.pull_request.labels.*.name,','),matrix.release.branch) }}
      run: make -s -j4
    - name: make test
      if: ${{ contains(join(github.event.pull_request.labels.*.name,','),matrix.release.branch) }}
      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}