From 3a6ecab0984745f0cefe3ca3c6dfee1eec7470d8 Mon Sep 17 00:00:00 2001
From: Lukas Sismis <lsismis@oisf.net>
Date: Tue, 6 Oct 2026 11:17:52 +0200
Subject: [PATCH] github-ci: add OpenBSD 7.9 build

Ticket: 8975
---
 .github/workflows/builds.yml | 22 ++++++++++++
 qa/ci/Makefile.am            |  1 +
 qa/ci/openbsd.sh             | 66 ++++++++++++++++++++++++++++++++++++
 3 files changed, 89 insertions(+)
 create mode 100755 qa/ci/openbsd.sh

diff --git a/.github/workflows/builds.yml b/.github/workflows/builds.yml
index 45f28b4554..40cb826d2f 100644
--- a/.github/workflows/builds.yml
+++ b/.github/workflows/builds.yml
@@ -3529,6 +3529,28 @@ jobs:
           prepare: ./qa/ci/freebsd.sh prepare
           run: ./qa/ci/freebsd.sh run
 
+  openbsd-7-9:
+    name: OpenBSD 7.9
+    runs-on: ubuntu-latest
+    needs: [prepare-deps]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - name: Downloading prep archive
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          name: prep
+          path: prep
+      - uses: vmactions/openbsd-vm@5f7b2c933b8846a138361d6843c52af4bef5d945
+        with:
+          release: "7.9"
+          arch: x86_64
+          usesh: true
+          sync: rsync
+          copyback: false
+          envs: "DEFAULT_CFLAGS"
+          prepare: ./qa/ci/openbsd.sh prepare
+          run: ./qa/ci/openbsd.sh run
+
   windows-msys2-mingw64-npcap:
     name: Windows MSYS2 MINGW64 (NPcap)
     runs-on: windows-latest
diff --git a/qa/ci/Makefile.am b/qa/ci/Makefile.am
index eb9b88c3f1..5b544f2ab5 100644
--- a/qa/ci/Makefile.am
+++ b/qa/ci/Makefile.am
@@ -1,3 +1,4 @@
 EXTRA_DIST =	freebsd.sh \
+		openbsd.sh \
 		rust-asan.sh \
 		scan-build.sh
diff --git a/qa/ci/openbsd.sh b/qa/ci/openbsd.sh
new file mode 100755
index 0000000000..9006a61437
--- /dev/null
+++ b/qa/ci/openbsd.sh
@@ -0,0 +1,66 @@
+#!/bin/sh
+#
+# Build and test on OpenBSD.
+
+set -eux
+
+if [ "$(uname -s)" != "OpenBSD" ]; then
+    echo "ERROR: this script is only supported on OpenBSD" >&2
+    exit 1
+fi
+
+: "${DEFAULT_CFLAGS:=-Wall -Wextra -Werror -Wno-unused-parameter -Wno-unused-function}"
+: "${CPUS:=$(sysctl -n hw.ncpuonline)}"
+# the autotools wrappers refuse to run without a version selected
+: "${AUTOCONF_VERSION:=2.72}"
+: "${AUTOMAKE_VERSION:=1.18}"
+export AUTOCONF_VERSION AUTOMAKE_VERSION
+
+prepare()
+{
+    pkg_add -I \
+        "autoconf%${AUTOCONF_VERSION}" \
+        "automake%${AUTOMAKE_VERSION}" \
+        cbindgen \
+        gmake \
+        jansson \
+        jq \
+        libmagic \
+        libtool \
+        libyaml \
+        lz4 \
+        pcre2 \
+        py3-yaml \
+        python%3 \
+        rust
+}
+
+run()
+{
+    if [ -f prep/suricata-verify.tar.gz ]; then
+        tar xzf prep/suricata-verify.tar.gz
+    fi
+
+    if [ ! -d suricata-verify ]; then
+        echo "ERROR: suricata-verify is required" >&2
+        exit 1
+    fi
+
+    ./autogen.sh
+    CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-warnings --enable-unittests
+    gmake -j "${CPUS}"
+    ./src/suricata -u -l /tmp/
+    python3 ./suricata-verify/run.py -q --debug-failed
+}
+
+if [ "$#" -eq 0 ]; then
+    prepare
+    run
+elif [ "$#" -eq 1 ] && [ "$1" = "prepare" ]; then
+    prepare
+elif [ "$#" -eq 1 ] && [ "$1" = "run" ]; then
+    run
+else
+    echo "Usage: $0 [prepare|run]" >&2
+    exit 1
+fi