wolfSSL · padelsbach · Jul 24, 2026 · Jul 27, 2026
diff --git a/.github/workflows/build-and-run-examples.yml b/.github/workflows/build-and-run-examples.yml
@@ -18,12 +18,8 @@ jobs:
     strategy:
         matrix:
             transport: [ 'tcp', 'shm', 'dma', 'tls', 'psk' ]
-            asan: [ 'ASAN=1', 'ASAN=0' ]
-            debug: [ '', 'DEBUG_VERBOSE=1' ]
-            test: [ '', '--test' ]
-            auth: [ '', 'AUTH=1' ]
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    timeout-minutes: 15
 
     steps:
     - uses: actions/checkout@v4
@@ -35,56 +31,61 @@ jobs:
         repository: wolfssl/wolfssl
         path: wolfssl
 
-    - name: Set TLS Environment Variable
+    # One job per transport; the flag combos run as a loop because a
+    # matrix job per combo spends about half its time on runner setup.
+    # The --test variants reuse the same binaries, so each of the 8
+    # flag builds serves two client runs.
+    - name: Build and run examples (all flag combos)
       run: |
-        if [ "${{ matrix.transport }}" = "tls" ] || [ "${{ matrix.transport }}" = "psk" ]; then
-          echo "TLS=1" >> $GITHUB_ENV
+        WS="$(pwd)"
+        SERVER_DIR="$WS/examples/posix/wh_posix_server"
+        CLIENT_DIR="$WS/examples/posix/wh_posix_client"
+        TRANSPORT="${{ matrix.transport }}"
+        if [ "$TRANSPORT" = "tls" ] || [ "$TRANSPORT" = "psk" ]; then
+          TLS=1
         else
-          echo "TLS=0" >> $GITHUB_ENV
+          TLS=0
         fi
-
-    # Build examples
-    - name: Build POSIX server
-      run: |
-        if [ "${{ matrix.transport }}" = "dma" ]; then
-          cd examples/posix/wh_posix_server && ${{ matrix.asan }} ${{ matrix.debug }} ${{ matrix.auth }} DMA=1 DEMO_KEK=1 make -j WOLFSSL_DIR=../../../wolfssl
-        else
-          cd examples/posix/wh_posix_server && ${{ matrix.asan }} ${{ matrix.debug }} ${{ matrix.auth }} TLS=${{ env.TLS }} DEMO_KEK=1 make -j WOLFSSL_DIR=../../../wolfssl
-        fi
-
-    - name: Build POSIX client
-      run: |
-        if [ "${{ matrix.transport }}" = "dma" ]; then
-          cd examples/posix/wh_posix_client && ${{ matrix.asan }} ${{ matrix.debug }} ${{ matrix.auth }} DMA=1 make -j WOLFSSL_DIR=../../../wolfssl
-        else
-          cd examples/posix/wh_posix_client && ${{ matrix.asan }} ${{ matrix.debug }} ${{ matrix.auth }} TLS=${{ env.TLS }} make -j WOLFSSL_DIR=../../../wolfssl
-        fi
-
-    # Start the server in the background
-    - name: Run POSIX server
-      run: |
-        cd examples/posix/wh_posix_server
-        if [ "${{ matrix.transport }}" = "psk" ]; then
-          echo "test_password" | ./Build/wh_posix_server.elf --type ${{ matrix.transport }} &
-        else
-          ./Build/wh_posix_server.elf --type ${{ matrix.transport }} &
-        fi
-        POSIX_SERVER_PID=$!
-        echo "POSIX_SERVER_PID=$POSIX_SERVER_PID" >> $GITHUB_ENV
-
-    # Run the client that connects to the server
-    - name: Run POSIX client
-      run: |
-        cd examples/posix/wh_posix_client
-        if [ "${{ matrix.transport }}" = "psk" ]; then
-          echo "test_password" | ./Build/wh_posix_client.elf --type ${{ matrix.transport }} ${{ matrix.test }}
-        else
-          ./Build/wh_posix_client.elf --type ${{ matrix.transport }} ${{ matrix.test }}
-        fi
-
-    # Optional: Kill the server process if it doesn't exit on its own
-    - name: Cleanup POSIX server
-      if: always()
-      run: kill $POSIX_SERVER_PID || true
-
-
+        for ASAN in ASAN=1 ASAN=0; do
+        for DEBUG in "" DEBUG_VERBOSE=1; do
+        for AUTH in "" AUTH=1; do
+          echo "::group::build $TRANSPORT $ASAN $DEBUG $AUTH"
+          make -C "$SERVER_DIR" clean
+          make -C "$CLIENT_DIR" clean
+          if [ "$TRANSPORT" = "dma" ]; then
+            env $ASAN $DEBUG $AUTH DMA=1 DEMO_KEK=1 \
+              make -C "$SERVER_DIR" -j WOLFSSL_DIR=../../../wolfssl
+            env $ASAN $DEBUG $AUTH DMA=1 \
+              make -C "$CLIENT_DIR" -j WOLFSSL_DIR=../../../wolfssl
+          else
+            env $ASAN $DEBUG $AUTH TLS=$TLS DEMO_KEK=1 \
+              make -C "$SERVER_DIR" -j WOLFSSL_DIR=../../../wolfssl
+            env $ASAN $DEBUG $AUTH TLS=$TLS \
+              make -C "$CLIENT_DIR" -j WOLFSSL_DIR=../../../wolfssl
+          fi
+          echo "::endgroup::"
+          for TEST in "" --test; do
+            echo "::group::run $TRANSPORT $ASAN $DEBUG $AUTH test='$TEST'"
+            rm -f "$SERVER_DIR"/*.bin
+            cd "$SERVER_DIR"
+            if [ "$TRANSPORT" = "psk" ]; then
+              echo "test_password" | ./Build/wh_posix_server.elf --type "$TRANSPORT" &
+            else
+              ./Build/wh_posix_server.elf --type "$TRANSPORT" &
+            fi
+            SERVER_PID=$!
+            sleep 1
+            cd "$CLIENT_DIR"
+            if [ "$TRANSPORT" = "psk" ]; then
+              echo "test_password" | ./Build/wh_posix_client.elf --type "$TRANSPORT" $TEST
+            else
+              ./Build/wh_posix_client.elf --type "$TRANSPORT" $TEST
+            fi
+            kill $SERVER_PID 2>/dev/null || true
+            wait $SERVER_PID 2>/dev/null || true
+            cd "$WS"
+            echo "::endgroup::"
+          done
+        done
+        done
+        done
diff --git a/.github/workflows/build-and-test-refactor.yml b/.github/workflows/build-and-test-refactor.yml
@@ -22,7 +22,20 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest]
+        # ubuntu runs the configs as parallel groups to shorten the
+        # critical path; macos stays a single job running everything
+        # because its org-wide runner pool is much smaller
+        include:
+          - os: ubuntu-latest
+            group: pq-dma
+          - os: ubuntu-latest
+            group: wolfcrypt
+          - os: ubuntu-latest
+            group: threadsafe
+          - os: ubuntu-latest
+            group: light
+          - os: macos-latest
+            group: all
 
     runs-on: ${{ matrix.os }}
     timeout-minutes: 45
@@ -54,100 +67,123 @@ jobs:
 
     # Build and test standard build
     - name: Build and test refactor
+      if: matrix.group == 'light' || matrix.group == 'all'
       run: cd test-refactor/posix && make clean && make -j WOLFSSL_DIR=../../wolfssl && make run
 
     # Build and test standard build, with DMA and ASAN enabled
     - name: Build and test refactor DMA ASAN
+      if: matrix.group == 'pq-dma' || matrix.group == 'all'
       run: cd test-refactor/posix && make clean && make -j DMA=1 ASAN=1 WOLFSSL_DIR=../../wolfssl && make run
 
     # Build and test with LMS and XMSS both in verify-only mode
     - name: Build and test refactor DMA ASAN LMS/XMSS verify-only
+      if: matrix.group == 'pq-dma' || matrix.group == 'all'
       run: cd test-refactor/posix && make clean && make -j DMA=1 ASAN=1 LMS_VERIFY_ONLY=1 XMSS_VERIFY_ONLY=1 WOLFSSL_DIR=../../wolfssl && make run
 
     # Build and test mixed: LMS verify-only, XMSS full (exercises shared gating)
     - name: Build and test refactor DMA ASAN LMS verify-only XMSS full
+      if: matrix.group == 'pq-dma' || matrix.group == 'all'
       run: cd test-refactor/posix && make clean && make -j DMA=1 ASAN=1 LMS_VERIFY_ONLY=1 WOLFSSL_DIR=../../wolfssl && make run
 
     # Build and test with ML-DSA in verify-only mode
     - name: Build and test refactor DMA ASAN MLDSA verify-only
+      if: matrix.group == 'pq-dma' || matrix.group == 'all'
       run: cd test-refactor/posix && make clean && make -j DMA=1 ASAN=1 MLDSA_VERIFY_ONLY=1 WOLFSSL_DIR=../../wolfssl && make run
 
     # Build and test ASAN build, with wolfCrypt tests enabled.
     - name: Build and test refactor ASAN TESTWOLFCRYPT
+      if: matrix.group == 'wolfcrypt' || matrix.group == 'all'
       run: cd test-refactor/posix && make clean && make -j ASAN=1 TESTWOLFCRYPT=1 WOLFSSL_DIR=../../wolfssl && make run
 
     # Build and test ASAN build, with wolfCrypt tests enabled and using the DMA devId.
     # LMS/XMSS verify-only; full PQ runs in DMA ASAN and THREADSAFE everything
     - name: Build and test refactor ASAN TESTWOLFCRYPT TESTWOLFCRYPT_DMA
+      if: matrix.group == 'wolfcrypt' || matrix.group == 'all'
       run: cd test-refactor/posix && make clean && make -j ASAN=1 TESTWOLFCRYPT=1 TESTWOLFCRYPT_DMA=1 DMA=1 LMS_VERIFY_ONLY=1 XMSS_VERIFY_ONLY=1 WOLFSSL_DIR=../../wolfssl && make run
 
     # Build and test debug build with ASAN and NOCRYPTO
     - name: Build and test refactor ASAN DEBUG NOCRYPTO
+      if: matrix.group == 'light' || matrix.group == 'all'
       run: cd test-refactor/posix && make clean && make -j DEBUG=1 ASAN=1 NOCRYPTO=1 WOLFSSL_DIR=../../wolfssl && make run
 
     # Build and test debug build with ASAN and DMA
     # LMS/XMSS verify-only; full PQ runs in DMA ASAN and THREADSAFE everything
     - name: Build and test refactor ASAN DEBUG DMA
+      if: matrix.group == 'wolfcrypt' || matrix.group == 'all'
       run: cd test-refactor/posix && make clean && make -j DEBUG=1 ASAN=1 DMA=1 LMS_VERIFY_ONLY=1 XMSS_VERIFY_ONLY=1 WOLFSSL_DIR=../../wolfssl && make run
 
     # Build and test with SHE and ASAN
     - name: Build and test refactor ASAN SHE
+      if: matrix.group == 'wolfcrypt' || matrix.group == 'all'
       run: cd test-refactor/posix && make clean && make -j SHE=1 ASAN=1 WOLFSSL_DIR=../../wolfssl && make run
 
     # Build and test with per-client crypto affinity enabled (runs the crypto
     # affinity unit test, gated behind WOLFHSM_CFG_CRYPTO_AFFINITY)
     - name: Build and test refactor CRYPTO_AFFINITY ASAN
+      if: matrix.group == 'wolfcrypt' || matrix.group == 'all'
       run: cd test-refactor/posix && make clean && make -j CRYPTO_AFFINITY=1 ASAN=1 WOLFSSL_DIR=../../wolfssl && make run
 
     # Build and test crypto affinity alongside DMA (exercises HW-devId path)
     # LMS/XMSS verify-only; full PQ runs in DMA ASAN and THREADSAFE everything
     - name: Build and test refactor CRYPTO_AFFINITY DMA ASAN
+      if: matrix.group == 'wolfcrypt' || matrix.group == 'all'
       run: cd test-refactor/posix && make clean && make -j CRYPTO_AFFINITY=1 DMA=1 ASAN=1 LMS_VERIFY_ONLY=1 XMSS_VERIFY_ONLY=1 WOLFSSL_DIR=../../wolfssl && make run
 
     # Build and test with global SHE keys (all SHE slots shared across clients)
     - name: Build and test refactor ASAN SHE_GLOBAL
+      if: matrix.group == 'wolfcrypt' || matrix.group == 'all'
       run: cd test-refactor/posix && make clean && make -j SHE_GLOBAL=1 ASAN=1 WOLFSSL_DIR=../../wolfssl && make run
 
     # Build and test with DEBUG=1
     - name: Build and test refactor with DEBUG
+      if: matrix.group == 'light' || matrix.group == 'all'
       run: cd test-refactor/posix && make clean && make -j DEBUG=1 WOLFSSL_DIR=../../wolfssl && make run
 
     # Build and test with DEBUG_VERBOSE=1 (includes DEBUG)
     - name: Build and test refactor with DEBUG_VERBOSE
+      if: matrix.group == 'light' || matrix.group == 'all'
       run: cd test-refactor/posix && make clean && make -j DEBUG_VERBOSE=1 WOLFSSL_DIR=../../wolfssl && make run
 
     # Build and test in multithreaded mode with everything enabled
     - name: Build and test refactor with THREADSAFE and everything
+      if: matrix.group == 'threadsafe' || matrix.group == 'all'
       run: cd test-refactor/posix && make clean && make -j THREADSAFE=1 DMA=1 SHE=1 ASAN=1 WOLFSSL_DIR=../../wolfssl && make run
 
     # Same, with global SHE keys
     - name: Build and test refactor with THREADSAFE and everything and SHE_GLOBAL
+      if: matrix.group == 'threadsafe' || matrix.group == 'all'
       run: cd test-refactor/posix && make clean && make -j THREADSAFE=1 DMA=1 SHE_GLOBAL=1 ASAN=1 WOLFSSL_DIR=../../wolfssl && make run
 
     # Build and test in multithreaded mode with everything enabled and wolfCrypt tests
     # LMS/XMSS verify-only; full PQ runs in DMA ASAN and THREADSAFE everything
     - name: Build and test refactor with THREADSAFE and TESTWOLFCRYPT and everything
+      if: matrix.group == 'threadsafe' || matrix.group == 'all'
       run: cd test-refactor/posix && make clean && make -j THREADSAFE=1 TESTWOLFCRYPT=1 DMA=1 SHE=1 ASAN=1 LMS_VERIFY_ONLY=1 XMSS_VERIFY_ONLY=1 WOLFSSL_DIR=../../wolfssl && make run
 
     # Build and test in multithreaded mode with everything enabled and wolfCrypt tests with dma
     # LMS/XMSS verify-only; full PQ runs in DMA ASAN and THREADSAFE everything
     - name: Build and test refactor with THREADSAFE and TESTWOLFCRYPT with DMA
+      if: matrix.group == 'threadsafe' || matrix.group == 'all'
       run: cd test-refactor/posix && make clean && make -j THREADSAFE=1 TESTWOLFCRYPT=1 TESTWOLFCRYPT_DMA=1 DMA=1 SHE=1 ASAN=1 LMS_VERIFY_ONLY=1 XMSS_VERIFY_ONLY=1 WOLFSSL_DIR=../../wolfssl && make run
 
     # Build and test with AUTH=1
     - name: Build and test refactor with AUTH
+      if: matrix.group == 'light' || matrix.group == 'all'
       run: cd test-refactor/posix && make clean && make -j AUTH=1 WOLFSSL_DIR=../../wolfssl && make run
 
     # Build and test with AUTH=1 and ASAN
     - name: Build and test refactor with AUTH ASAN
+      if: matrix.group == 'light' || matrix.group == 'all'
       run: cd test-refactor/posix && make clean && make -j AUTH=1 ASAN=1 WOLFSSL_DIR=../../wolfssl && make run
 
     # Build and test with AUTH=1 and THREADSAFE
     - name: Build and test refactor with AUTH THREADSAFE ASAN
+      if: matrix.group == 'light' || matrix.group == 'all'
       run: cd test-refactor/posix && make clean && make -j AUTH=1 THREADSAFE=1 ASAN=1 WOLFSSL_DIR=../../wolfssl && make run
 
     # Build and test with AUTH=1 and NOCRYPTO=1 (auth on, crypto off)
     - name: Build and test refactor with AUTH NOCRYPTO
+      if: matrix.group == 'light' || matrix.group == 'all'
       run: cd test-refactor/posix && make clean && make -j AUTH=1 NOCRYPTO=1 WOLFSSL_DIR=../../wolfssl && make run
 
     - name: Show ccache stats