gh-136728: Refactor build.yml CI config and multissltests.py by hugovk · Pull Request #143940 · python/cpython

hugovk · 2026-01-16T21:50:05Z

Continuation of #136729.

Original description:

Notes

Please see #136728. Changes to build.yml are directly adapted from @hugovk's proof-of-concept here.

Testing

this PR's CI
PR CI on my fork.

Issue: Refactor build.yml CI ssltests config and multissltests.py #136728

@hugovk

Suggested by @hugovk [1]. [1]: a3f2ba9

This reverts commit 1fcb49f.

…ests

Co-authored-by: Adam Turner <9087854+AA-Turner@users.noreply.github.com>

…ests

webknjaz · 2026-01-16T23:41:52Z

+ CMD=(./configure CFLAGS="-fdiagnostics-format=json" --config-cache --enable-slower-safety --with-pydebug --with-openssl="$SSL_DIR")
+ if [ "${{ matrix.ssl }}" = "openssl" ]; then
+ "${CMD[@]}"
+ else
+ "${CMD[@]}" --with-builtin-hashlib-hashes=blake2 --with-ssl-default-suites=openssl
+ fi


Suggested change
CMD=(./configure CFLAGS="-fdiagnostics-format=json" --config-cache --enable-slower-safety --with-pydebug --with-openssl="$SSL_DIR")
if [ "${{ matrix.ssl }}" = "openssl" ]; then
"${CMD[@]}"
else
"${CMD[@]}"--with-builtin-hashlib-hashes=blake2 --with-ssl-default-suites=openssl
fi
./configure
CFLAGS="-fdiagnostics-format=json"
--config-cache
--enable-slower-safety
--with-pydebug
--with-openssl="$SSL_DIR"
${CONFIGURE_TRAILING_ARGS}

I prefer the if/else approach. I do not like the notion of 'trailing' args.

Then the steps would need to be separate so the logs are usable/inspectable and it's surfaced.

picnixz · 2026-01-17T05:49:19Z


+ @property
+ @abstractmethod
+ def library(self=None):


So as I said previously, we should just have annotated properties. It will complain at runtime if we are missing one.

Please could you make GH suggestions here, or a PR to my branch?

I am sorry I am on mobile only (I am travelling) so I cannot do it easily :(

No rush, it can wait!

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

Following python#143961

ned-deily · 2026-02-02T22:32:43Z

There was a new round of OpenSSL updates on 2026-01-27.

hugovk · 2026-02-06T18:52:09Z

I've opened #144551 to track updates to the January 2026 OpenSSL releases.

hugovk · 2026-02-13T22:27:37Z

Bumped patch versions following #144794.

webknjaz · 2026-02-17T15:42:46Z

 - name: Install OpenSSL
 if: steps.cache-openssl.outputs.cache-hit != 'true'
- run: python3 Tools/ssl/multissltests.py --steps=library --base-directory "$MULTISSL_DIR" --openssl "$OPENSSL_VER" --system Linux
+ run: python3 Tools/ssl/multissltests.py --steps=library --base-directory "$MULTISSL_DIR" --ssl openssl --ssl-versions "$OPENSSL_VER" --system Linux


I think a better UX would be something like
Suggested change
run: python3 Tools/ssl/multissltests.py --steps=library --base-directory "$MULTISSL_DIR" --ssl openssl --ssl-versions "$OPENSSL_VER" --system Linux
run: python3 Tools/ssl/multissltests.py --steps=library --base-directory "$MULTISSL_DIR" --ssl-targets='openssl:${OPENSSL_VER}" --system Linux
since the project and its version are coupled (maybe use == instead of :, I suppose)

webknjaz · 2026-02-17T15:45:07Z

- --with-builtin-hashlib-hashes=blake2 \
- --with-ssl-default-suites=openssl
+ CMD=(./configure CFLAGS="-fdiagnostics-format=json" --config-cache --enable-slower-safety --with-pydebug --with-openssl="$SSL_DIR")
+ if [ "${{ matrix.ssl }}" = "openssl" ]; then


Remember that interpolation in GHA is dangerous and Zizmor will be unhappy — such things must go into env vars.

Hmm, Zizmor was happy with this: https://github.com/python/cpython/actions/runs/22004982988/job/63586538110?pr=143940#step:3:151
Perhaps this is a feature request for Zizmor?

hugovk · 2026-03-01T09:18:58Z

Closed in favour of #144805.

WillChilds-Kleinand others added 16 commits July 14, 2025 21:19

Adapt@hugovk's proof-of-concept CI definition refactor
a104f8a
Suggested by @hugovk [1]. [1]: a3f2ba9

Preliminary refactor of multissltests.py, TODO migrate to classes
3fcbe0d

Fix aws-lc/awslc lib name discrepancy
5d8ec9a

Migrate AbstractBuilder to abc
991c6b2

Fix imports
7b51499

Complete ABC refactor
6638127

Colorize parser
4e0a8ca

Adjust compatibility comment
1a90e0c

📜🤖 Added by blurb_it.
1fcb49f

Revert "📜🤖 Added by blurb_it."
dd969fb
This reverts commit 1fcb49f.

Merge branch 'main' into refactor-ssl-tests
1edce1c

Include old versions when using default versions
3343120

Merge remote-tracking branch 'upstream/main' into 3.15-refactor-ssl-t…
82f1154
…ests

Apply suggestions from code review
0560203
Co-authored-by: Adam Turner <9087854+AA-Turner@users.noreply.github.com>

Bump GitHub Actions
08be1f2

Merge remote-tracking branch 'upstream/main' into 3.15-refactor-ssl-t…
b2f353c
…ests

bedevere-appBot mentioned this pull request Jan 16, 2026
Refactor build.yml CI ssltests config and multissltests.py #136728
Open

hugovk mentioned this pull request Jan 16, 2026
gh-136728: Refactor build.yml CI config and multissltests.py #136729
Closed

hugovk added skip news infra CI, GitHub Actions, buildbots, Dependabot, etc. labels Jan 16, 2026

hugovk added 3 commits January 16, 2026 23:58

Retain multiline
31325c5

Use extend instead of += [...]
94a826d

Remove 3.3 block, use long options
9113833

webknjaz reviewed Jan 16, 2026
View reviewed changes

Comment thread.github/workflows/build.yml Outdated

webknjaz reviewed Jan 16, 2026
View reviewed changes

Comment thread.github/workflows/build.yml

webknjaz reviewed Jan 16, 2026
View reviewed changes

webknjaz added this to 📅 Procrastinating in public 😵‍💫Jan 16, 2026

webknjaz moved this to 🧐 @webknjaz's review queue 📋 in 📅 Procrastinating in public 😵‍💫Jan 16, 2026

picnixz reviewed Jan 17, 2026
View reviewed changes

Apply suggestions from code review
942434a
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

hugovk commented Jan 20, 2026
View reviewed changes

Comment thread.github/workflows/build.yml Outdated
Comment thread.github/workflows/build.yml Outdated
Comment threadTools/ssl/multissltests.py Outdated
Comment threadTools/ssl/multissltests.py

hugovk added 2 commits January 20, 2026 17:29

Add support for OpenSSL 3.6, drop EOL 3.2
f3f0824
Following python#143961

Merge branch 'main' into 3.15-refactor-ssl-tests
181e676

zware mentioned this pull request Feb 13, 2026
gh-136728: Combine OpenSSL and AWS-LC CI configurations #144805
Merged

Merge branch 'main' into 3.15-refactor-ssl-tests
85baf65

webknjaz reviewed Feb 17, 2026
View reviewed changes

hugovk closed this Mar 1, 2026

hugovk deleted the 3.15-refactor-ssl-tests branch March 1, 2026 09:19

	run: python3 Tools/ssl/multissltests.py --steps=library --base-directory "$MULTISSL_DIR" --ssl openssl --ssl-versions "$OPENSSL_VER" --system Linux
	run: python3 Tools/ssl/multissltests.py --steps=library --base-directory "$MULTISSL_DIR" --ssl-targets='openssl:${OPENSSL_VER}" --system Linux

Uh oh!

Uh oh!

Conversation

hugovk commented Jan 16, 2026• edited by bedevere-app BotLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Notes

Testing

Uh oh!

Uh oh!

Uh oh!

webknjazJan 16, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

picnixzJan 17, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ned-deily commented Feb 2, 2026

Uh oh!

hugovk commented Feb 6, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hugovk commented Feb 13, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hugovk commented Mar 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

hugovk commented Jan 16, 2026•
edited by bedevere-app Bot
Loading

webknjazJan 16, 2026•
edited
Loading

picnixzJan 17, 2026•
edited
Loading

hugovk commented Feb 6, 2026•
edited
Loading