From f05e78d8fbce0e7fab3f09ef4efb964ca6f37489 Mon Sep 17 00:00:00 2001
From: Jun Aruga <jaruga@redhat.com>
Date: Mon, 7 Sep 2026 12:29:18 +0100
Subject: [PATCH] CI: Cache compiled AWS-LC by resolving the latest stable
 version

Resolve the AWS-LC latest stable version tag before the cache step
using `git ls-remote`, enabling the cache to use a version-specific key
(e.g., aws-lc-5.8.0).

Run `git clone` with the resolved AWS-LC stable version.

Assisted-by: Claude:Opus 4.6
---
 .github/workflows/test.yml | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index a2531d41f..ca98f1e91 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -119,12 +119,20 @@ jobs:
       - name: repo checkout
         uses: actions/checkout@v7
 
+      # Resolve the AWS-LC latest stable version as aws-lc-x.x.x for caching
+      - name: Resolve aws-lc version
+        id: resolve-aws-lc
+        if: matrix.openssl == 'aws-lc-latest'
+        run: |
+          AWS_LC_VERSION=$(git ls-remote --tags --sort=-version:refname https://github.com/aws/aws-lc.git 'v*' | head -1 | cut -f 2 | sed -e 's|refs/tags/v|aws-lc-|')
+          echo "version=$AWS_LC_VERSION" >> "$GITHUB_OUTPUT"
+
       - id: cache-openssl
         uses: actions/cache@v6
         with:
           path: ~/openssl
-          key: openssl-${{ runner.os }}-${{ matrix.openssl }}-${{ matrix.append-configure || 'default' }}
-        if: matrix.openssl != 'openssl-master' && matrix.openssl != 'libressl-master' && matrix.openssl != 'aws-lc-latest'
+          key: openssl-${{ runner.os }}-${{ steps.resolve-aws-lc.outputs.version || matrix.openssl }}-${{ matrix.append-configure || 'default' }}
+        if: matrix.openssl != 'openssl-master' && matrix.openssl != 'libressl-master'
 
       - name: Compile OpenSSL library
         if: steps.cache-openssl.outputs.cache-hit != 'true'
@@ -155,9 +163,8 @@ jobs:
             make -j4 && make install
             ;;
           aws-lc-*)
-            git clone https://github.com/aws/aws-lc.git .
-            AWS_LC_RELEASE=$(git tag --sort=-creatordate --list "v*"  | head -1)
-            git checkout $AWS_LC_RELEASE
+            AWS_LC_RELEASE=$(echo "${{ steps.resolve-aws-lc.outputs.version }}" | sed -e 's/aws-lc-/v/')
+            git clone -b $AWS_LC_RELEASE --depth 1 https://github.com/aws/aws-lc.git .
             cmake -DCMAKE_INSTALL_PREFIX=$HOME/openssl -DCMAKE_INSTALL_LIBDIR=lib
             make -j4 && make install
             ;;