ci: update workflows (checkout v6, recursive submodules), mbedTLS v4 compatibility, Windows fix by Easton97-Jens · Pull Request #3529 · owasp-modsecurity/ModSecurity

Easton97-Jens · 2026-03-29T13:09:19Z

what

Integrated ci_new.yml from PR fix(ci): pin Lua version on 5.4 #3524
Updated ci.yml and aligned it with the new workflow structure
Removed GeoIP-related steps from CI
Unified workflows so that all jobs run consistently
Updated actions/checkout from v4 to v6
Changed submodules: true to recursive
Adjusted configuration for better compatibility with mbedTLS v4
Fixed Windows workflow so tests now pass successfully

why

PR fix(ci): pin Lua version on 5.4 #3524 introduces important Lua version pinning changes that must be reflected in CI
The previous ci.yml was not fully compatible with these updates
Removing GeoIP reduces CI complexity and potential failure points
Unified workflows improve maintainability and consistency
actions/checkout@v6 is the newer and recommended version
Using recursive ensures all submodules are properly fetched
Adjustments were required for compatibility with mbedTLS v4
Windows tests were previously failing and are now fixed

references

fix(ci): pin Lua version on 5.4 #3524

airween · 2026-03-29T13:53:53Z

.github/workflows/ci.yml

  pull_request:
+
+env:
+  LUA_VERSION: "5.4"


Please remove all hardcoded Lua versions from all workflow. Let the system to choose the right version. I think it's a good feedback if we need to align that in the code (and the build system).

Note here, we already fixed the Lua version issue in #3525.

Should the Lua version be selected dynamically by the system going forward, or do we want to keep a fixed version (at least for certain environments like Linux)?

I think we should let the system to choose the right version. Usually, macOS uses the recent releases, which is good, because we can get notification about that.

If we use a fixed version, then we can forget to update the code.

macOS now follows the previous behavior (using the default system setup), while Linux has been updated to dynamically detect and use the currently available Lua version.

This should give us more flexibility on Linux while keeping macOS stable and aligned with its typical environment.

Updated CI workflow to dynamically detect and install the latest Lua development package instead of using a fixed version.

Copilot

Pull request overview

Updates the GitHub Actions CI workflows to align job structure/behavior across OSes, adjust dependency installation (notably Lua), and fetch submodules recursively.

Changes:

Added Lua package auto-detection on Linux and adjusted dependency install lists (including Python tooling).
Updated checkout configuration to use recursive submodules and changed the referenced actions/checkout major version.
Tweaked workflow matrices/strategy settings (e.g., fail-fast: false) and removed GeoIP-related CI steps.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 9 comments.

File	Description
.github/workflows/ci_new.yml	Updates the “new” CI workflow: Linux/macOS/Windows jobs, Lua detection, dependency installs, recursive submodules, and cppcheck jobs.
.github/workflows/ci.yml	Aligns the primary CI workflow with the new structure: Lua detection, dependency updates, recursive submodules, and fail-fast behavior.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-30T07:03:35Z

.github/workflows/ci_new.yml

@@ -56,8 +81,9 @@ jobs:
            libpcre3-dev \


libpcre3-dev is installed on the Ubuntu 24.04 runner, but Ubuntu 24.04 no longer ships PCRE1 development packages by default (CI will fail during apt-get install). Consider dropping the --with-pcre variant on 24.04, building PCRE1 from source, or switching the matrix to PCRE2-only on 24.04.

Suggested change

libpcre3-dev \

Copilot · 2026-03-30T07:03:36Z

.github/workflows/ci_new.yml

                       bison \
-                       flex
+                       flex \
+                       python3 


PR description references integrating #3524 (pin Lua to 5.4 on macOS), but this job installs whatever brew install lua currently resolves to. If Lua 5.5+ is still incompatible, please pin the formula/version explicitly (or add a setup step that selects Lua 5.4) to keep macOS CI deterministic.

Copilot · 2026-03-30T07:03:36Z

.github/workflows/ci.yml

          brew install autoconf \
                       automake \
                       libtool \
-                       cppcheck
-      - uses: actions/checkout@v4
+                       cppcheck \
+                       python3


Homebrew generally provides the python formula (which installs the python3 binary) rather than a python3 formula. brew install python3 is likely to fail; use brew install python (or omit this if the runner image already includes a suitable Python).

Copilot · 2026-03-30T07:03:36Z

.github/workflows/ci_new.yml

      - name: Install cppcheck
        run: |
-          brew install autoconf automake libtool cppcheck libmaxminddb yajl lua lmdb ssdeep
+          brew install autoconf automake libtool cppcheck libmaxminddb yajl lua lmdb ssdeep python3 


Homebrew generally provides the python formula (which installs the python3 binary) rather than a python3 formula. brew install python3 is likely to fail; use brew install python (or omit this if the runner image already includes a suitable Python).

Suggested change

brew install autoconf automake libtool cppcheck libmaxminddb yajl lua lmdb ssdeep python3

brew install autoconf automake libtool cppcheck libmaxminddb yajl lua lmdb ssdeep python

Copilot · 2026-03-30T07:03:36Z

.github/workflows/ci_new.yml

                       bison \
-                       flex
+                       flex \
+                       python3 


Homebrew generally provides the python formula (which installs the python3 binary) rather than a python3 formula. brew install python3 is likely to fail; use brew install python (or omit this if the runner image already includes a suitable Python).

Suggested change

python3

python

Copilot · 2026-03-30T07:03:37Z

.github/workflows/ci.yml

+          CANDIDATES="$(apt-cache pkgnames | grep -E '^liblua[0-9]+\.[0-9]+-dev$' || true)"
+
+          if [ -z "$CANDIDATES" ]; then
+            echo "No libluaX.Y-dev package found"
+            exit 1


This step selects the highest available libluaX.Y-dev at runtime, which makes CI non-reproducible across time and can silently jump to an unsupported Lua version. Consider pinning to the known-supported Lua version(s) (especially since #3524 was introduced to avoid unexpected Lua upgrades on macOS).

Copilot · 2026-03-30T07:03:37Z

.github/workflows/ci.yml

-                       flex
-      - uses: actions/checkout@v4
+                       flex \
+                       python3


Homebrew generally provides the python formula (which installs the python3 binary) rather than a python3 formula. brew install python3 is likely to fail; use brew install python (or omit this if the runner image already includes a suitable Python).

Suggested change

python3

python

Copilot · 2026-03-30T07:03:37Z

.github/workflows/ci.yml

                       ssdeep \
                       pcre \
                       bison \
-                       flex
-      - uses: actions/checkout@v4
+                       flex \
+                       python3


PR description references integrating #3524 (pin Lua to 5.4 on macOS), but this job installs whatever brew install lua currently resolves to. If Lua 5.5+ is still incompatible, please pin the formula/version explicitly (or add a setup step that selects Lua 5.4) to keep macOS CI deterministic.

Copilot · 2026-03-30T07:03:37Z

.github/workflows/ci.yml


 on:
  push:
  pull_request:
-
+  


PR title/description mention mbedTLS v4 compatibility changes, but this PR appears to only modify CI workflows. If mbedTLS-related build/config changes are expected, they may be missing from this PR (or the title/description should be adjusted to match the actual scope).

airween · 2026-03-30T07:35:36Z

@Easton97-Jens,

please consider to approve Copilot suggestions'.

I think none of them are exactly true (especially this one: brew install python3 is likely to fail; use brew install python), because all tests were passed, but I think those are useful, and you should accept them. But let's discuss, if you have any question.

Removed python3 from the installation steps in the CI workflow.

Removed python3 from the installation list in CI workflow.

sonarqubecloud · 2026-03-30T08:14:56Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Easton97-Jens · 2026-03-30T08:20:01Z

Thanks for the suggestion! This is not strictly required, as Python 3 is already available in the environment, so no additional installation is needed. Therefore, I have removed the installation entirely.

Easton97-Jens added 5 commits March 29, 2026 11:59

Update ci_new.yml

8b082fb

Update ci.yml

8214a34

Update ci.yml

a65df3f

Update ci.yml

8b9659c

Update ci_new.yml

9d9986e

airween requested changes Mar 29, 2026

View reviewed changes

Easton97-Jens added 3 commits March 29, 2026 18:07

Update ci.yml lua dynamisch

814e88f

Enhance CI to detect latest Lua dev package

e68f6b1

Updated CI workflow to dynamically detect and install the latest Lua development package instead of using a fixed version.

Update ci.yml

b50a48d

Easton97-Jens requested a review from airween March 29, 2026 16:20

Update Lua package detection in CI workflow

6708f71

airween requested a review from Copilot March 30, 2026 06:58

Copilot started reviewing on behalf of airween March 30, 2026 06:58 View session

Copilot AI reviewed Mar 30, 2026

View reviewed changes

Easton97-Jens added 2 commits March 30, 2026 10:13

Remove python3 from CI workflow installation

9823d8e

Removed python3 from the installation steps in the CI workflow.

Update CI workflow to remove python3 installation

e68ad1c

Removed python3 from the installation list in CI workflow.

	brew install autoconf automake libtool cppcheck libmaxminddb yajl lua lmdb ssdeep python3
	brew install autoconf automake libtool cppcheck libmaxminddb yajl lua lmdb ssdeep python

Conversation

Easton97-Jens commented Mar 29, 2026

what

why

references

Uh oh!

airween Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

airween Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

Easton97-Jens Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

airween Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

Easton97-Jens Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

airween commented Mar 30, 2026

Uh oh!

sonarqubecloud bot commented Mar 30, 2026

Quality Gate passed

Uh oh!

Easton97-Jens commented Mar 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants