Run the API tests in the TPM CI job

[yosuke-wolfssl]

Problem

No CI job compiles a wolfSSH test binary with WOLFSSH_TPM defined, so any test guarded on it silently compiles out everywhere and cannot gate a merge.

Workflow	--enable-tpm	runs make check
tpm-ssh.yml	yes	no — only make + make install
sanitizer.yml	no (--enable-all excludes TPM)	yes
all others	no	mostly no

The intersection is empty. Found while writing #1164, whose regression test is unreachable by CI for exactly this reason.

Fix (.github/workflows/tpm-ssh.yml)

Adds a make check TESTS=tests/api.test step after Build wolfSSH:

• All five check_PROGRAMs still compile — check-am builds them regardless of the TESTS override. That is the point: this is the only job compiling wolfSSH's tests with TPM support.
• Only api.test runs. It holds the only TPM-specific tests in the tree: grep -i tpm finds 28 hits in tests/api.c and zero in the other five test sources.
• Gated to one matrix cell (ecc / ibmswtpm2 / raw). The 2×2×2 matrix varies the simulator and the host key, neither of which these tests touch.
• A build-config assertion precedes the run. A build without -DWOLFSSH_TPM compiles the guarded tests out and still exits 0, a hollow pass. The step greps AM_CPPFLAGS for the define, prints what it found, and aborts if absent.
• tests/api.log is dumped on failure and added to the archived artifacts.

Verification

Against a scratch prefix reproducing CI's library layout (wolfSSL with this job's exact flags, wolfTPM rebuilt against it):

• PASS: tests/api.test, and all five test binaries compile under --enable-tpm --enable-certs.
• Negative control: reconfigured without --enable-tpm, the guard fails and the step aborts.
• Why the others are not run:unit.test and regress.test give byte-identical output with and without the define (diffed); testsuite.test exits 0 having executed nothing, its body being entirely #ifdef WOLFSSH_SHELL/WOLFSSH_SFTP; kex.test fails; auth.test is not built.
• Workflow-YAML only, no C touched, so no sanitizer or preflight run.

Not in this PR

kex.test fails because the example client aborts with "You must specify a password for the TPM key". Two separate defects sit behind that:

• The -K guard is too broad. The client aborts whenever tpmKeyAuth == NULL in a TPM build, but kex.test passes no -i, so ClientSetPrivateKey() takes the built-in key-buffer path where tpmKeyAuth is unused. Fixing only this would let kex.test run on a software key, adding no TPM coverage.
• A key file is unusable in a TPM build. The #elif in ClientSetPrivateKey() routes every -i through wolfSSH_TPM_InitKey(), leaving no path to wolfSSH_ReadKey_file().

Both point at the same gap: nothing anywhere exercises a client user-auth key held in the TPM. That deserves a purpose-built test rather than a retrofit of the KEX sweep, so it is left for a follow-up.

[Copilot]

Pull request overview

This PR updates the TPM CI workflow to actually compile and run wolfSSH’s API test suite (tests/api.test) under a --enable-tpm build, ensuring TPM-guarded tests can gate merges.

Changes:

• Add a gated make check TESTS=tests/api.test step to run API tests in a single selected matrix cell.
• Add a failure-only step to print tests/api.log.
• Archive wolfssh/tests/api.log as a workflow artifact.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #1165

No scan targets match the changed files in this PR. Review skipped.

[ejohnstown]

Also, going forward, please be more descriptive in your commit messages. The commit messages are the real history that moves around. This commit is doing something non-obvious enough (why TESTS= is overridden, why one matrix cell, why the grep guard exists) that the reasoning belongs in the commit body, not only on the PR page.