Migrate CI to Github Actions

We are hitting the 1 hour time limit of Circle CI (Issue open-quantum-safe#166). This migrates the existing CircleCI job completely to Github Actions which has a 5 hour time limit.

For the most part, this is pretty much a one-to-one migration. The one oddity I noticed is a regression in one of the unit tests. I've root-caused it to a change in how Github's Ubuntu host + OQS' CI container handles zombie processes. In this configuration, they don't seem to reap zombies as aggressively as it did in CircleCI. This causes the test to "fail" because it counts a zombie as "alive". The creation of a zombie is by design due to how ssh-agent's subprocess mode works (ssh-agent forks into a child process to allow an arbitrary parent to take over, the child then becomes a zombie when it recognizes its orphaned status). To work around this, I added a check to the assertion to count zombies as "not alive" and this allows the test to pass on Github Actions.

Since upstream OpenSSH provided its own set of Github Actions, I simply moved those to the `upstream-github` directory to avoid conflicts and preserve the source.

Signed-off-by: gcr <[email protected]>

.github/workflows/ubuntu.yaml

@@ -0,0 +1,24 @@
+name: CI Checks
+on: [ push, pull_request ]
+jobs:
+  ubuntu_build:
+    runs-on: ubuntu-latest
+    container:
+      image: openquantumsafe/ci-ubuntu-focal-x86_64:latest
+    steps:
+    - uses: actions/checkout@v4
+    - name: Set up SSH environment
+      run: |
+        mkdir -p -m 0755 /var/empty
+        groupadd sshd
+        useradd -g sshd -c 'sshd privsep' -d /var/empty -s /bin/false sshd
+    - name: Clone liboqs
+      run: ./oqs-scripts/clone_liboqs.sh
+    - name: Build liboqs
+      run: ./oqs-scripts/build_liboqs.sh
+    - name: Build OpenSSH
+      run: env WITH_OPENSSL=true ./oqs-scripts/build_openssh.sh
+    - name: Run tests documented to pass
+      run: ./oqs-test/run_tests.sh
+    - name: Ensure we have the ssh and sshd syntax right once for each algorithm
+      run: python3 oqs-test/try_connection.py doone

regress/agent-subprocess.sh

@@ -3,14 +3,18 @@
 
 tid="agent subprocess"
 
+is_alive() {
+	kill -0 ${1} >/dev/null 2>&1 && [ `ps -p ${1} -o state=` != "Z" ]
+}
+
 trace "ensure agent exits when run as subprocess"
 ${SSHAGENT} sh -c "echo \$SSH_AGENT_PID >$OBJ/pidfile; sleep 1"
 
 pid=`cat $OBJ/pidfile`
 
 # Currently ssh-agent polls every 10s so we need to wait at least that long.
 n=12
-while kill -0 $pid >/dev/null 2>&1 && test "$n" -gt "0"; do
+while is_alive ${pid} && test "$n" -gt "0"; do
 	n=$(($n - 1))
 	sleep 1
 done