From 0eb2400b563061d47fbb97a3dd4dcb73b39ce57b Mon Sep 17 00:00:00 2001 From: Lucas McDonald Date: Thu, 8 Oct 2026 00:17:42 +0000 Subject: [PATCH 1/4] ci: run Linux CI on CodeBuild-hosted runners --- .github/workflows/ci_codebuild-tests.yml | 2 +- .github/workflows/ci_codebuild_batch.yml | 146 +++++++++--------- .github/workflows/ci_decrypt-oracle.yaml | 4 +- .github/workflows/ci_static-analysis.yaml | 2 +- .github/workflows/ci_test-vector-handler.yaml | 13 +- .github/workflows/ci_tests.yaml | 11 +- .github/workflows/dependabot-auto-merge.yml | 2 +- .github/workflows/pull.yml | 2 +- .github/workflows/repo-sync.yml | 1 + 9 files changed, 100 insertions(+), 83 deletions(-) diff --git a/.github/workflows/ci_codebuild-tests.yml b/.github/workflows/ci_codebuild-tests.yml index 323a8ca48..5b11e8205 100644 --- a/.github/workflows/ci_codebuild-tests.yml +++ b/.github/workflows/ci_codebuild-tests.yml @@ -19,7 +19,7 @@ permissions: jobs: codebuild-tests: name: AWS CodeBuild CI - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} strategy: matrix: python: diff --git a/.github/workflows/ci_codebuild_batch.yml b/.github/workflows/ci_codebuild_batch.yml index 243638f65..ab89bddfe 100644 --- a/.github/workflows/ci_codebuild_batch.yml +++ b/.github/workflows/ci_codebuild_batch.yml @@ -15,7 +15,7 @@ jobs: # Python 3.8 jobs py38_integ: name: Python 3.8 Integration Tests - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -33,7 +33,7 @@ jobs: py38_examples: name: Python 3.8 Examples - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -51,7 +51,7 @@ jobs: py38_decrypt_dafny_esdk_vectors: name: Python 3.8 Decrypt Dafny ESDK Vectors - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -69,7 +69,7 @@ jobs: py38_decrypt_net_401_vectors: name: Python 3.8 Decrypt .NET 4.0.1 Vectors - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -87,7 +87,7 @@ jobs: py38_encrypt_masterkey: name: Python 3.8 Encrypt Masterkey - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -105,7 +105,7 @@ jobs: py38_generate_decrypt_vectors_masterkey: name: Python 3.8 Generate Decrypt Vectors Masterkey - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -124,7 +124,7 @@ jobs: py38_decrypt_masterkey_with_masterkey: name: Python 3.8 Decrypt Masterkey with Masterkey needs: py38_generate_decrypt_vectors_masterkey - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -143,7 +143,7 @@ jobs: py38_decrypt_masterkey_with_js: name: Python 3.8 Decrypt Masterkey with JS needs: py38_generate_decrypt_vectors_masterkey - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -162,7 +162,7 @@ jobs: # Python 3.9 jobs py39_integ: name: Python 3.9 Integration Tests - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -180,7 +180,7 @@ jobs: py39_examples: name: Python 3.9 Examples - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -198,7 +198,7 @@ jobs: py39_decrypt_dafny_esdk_vectors: name: Python 3.9 Decrypt Dafny ESDK Vectors - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -216,7 +216,7 @@ jobs: py39_decrypt_net_401_vectors: name: Python 3.9 Decrypt .NET 4.0.1 Vectors - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -234,7 +234,7 @@ jobs: py39_encrypt_masterkey: name: Python 3.9 Encrypt Masterkey - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -252,7 +252,7 @@ jobs: py39_generate_decrypt_vectors_masterkey: name: Python 3.9 Generate Decrypt Vectors Masterkey - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -271,7 +271,7 @@ jobs: py39_decrypt_masterkey_with_masterkey: name: Python 3.9 Decrypt Masterkey with Masterkey needs: py39_generate_decrypt_vectors_masterkey - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -290,7 +290,7 @@ jobs: py39_decrypt_masterkey_with_js: name: Python 3.9 Decrypt Masterkey with JS needs: py39_generate_decrypt_vectors_masterkey - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -309,7 +309,7 @@ jobs: # Python 3.10 jobs py310_integ: name: Python 3.10 Integration Tests - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -327,7 +327,7 @@ jobs: py310_examples: name: Python 3.10 Examples - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -345,7 +345,7 @@ jobs: py310_decrypt_dafny_esdk_vectors: name: Python 3.10 Decrypt Dafny ESDK Vectors - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -363,7 +363,7 @@ jobs: py310_decrypt_net_401_vectors: name: Python 3.10 Decrypt .NET 4.0.1 Vectors - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -381,7 +381,7 @@ jobs: py310_encrypt_masterkey: name: Python 3.10 Encrypt Masterkey - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -399,7 +399,7 @@ jobs: py310_generate_decrypt_vectors_masterkey: name: Python 3.10 Generate Decrypt Vectors Masterkey - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -418,7 +418,7 @@ jobs: py310_decrypt_masterkey_with_masterkey: name: Python 3.10 Decrypt Masterkey with Masterkey needs: py310_generate_decrypt_vectors_masterkey - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -437,7 +437,7 @@ jobs: py310_decrypt_masterkey_with_js: name: Python 3.10 Decrypt Masterkey with JS needs: py310_generate_decrypt_vectors_masterkey - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -456,7 +456,7 @@ jobs: # Python 3.11 jobs py311_integ: name: Python 3.11 Integration Tests - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -474,7 +474,7 @@ jobs: py311_integ_mpl: name: Python 3.11 Integration MPL - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -492,7 +492,7 @@ jobs: py311_performance_tests_mpl: name: Python 3.11 Performance Tests MPL - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -510,7 +510,7 @@ jobs: py311_examples: name: Python 3.11 Examples - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -528,7 +528,7 @@ jobs: py311_examples_mpl: name: Python 3.11 Examples MPL - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -546,7 +546,7 @@ jobs: py311_decrypt_dafny_esdk_vectors_masterkey: name: Python 3.11 Decrypt Dafny ESDK Vectors Masterkey - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -564,7 +564,7 @@ jobs: py311_decrypt_dafny_esdk_vectors_keyrings: name: Python 3.11 Decrypt Dafny ESDK Vectors Keyrings - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -582,7 +582,7 @@ jobs: py311_decrypt_net_401_vectors_masterkey: name: Python 3.11 Decrypt .NET 4.0.1 Vectors Masterkey - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -600,7 +600,7 @@ jobs: py311_decrypt_net_401_vectors_keyrings: name: Python 3.11 Decrypt .NET 4.0.1 Vectors Keyrings - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -618,7 +618,7 @@ jobs: py311_encrypt_masterkey: name: Python 3.11 Encrypt Masterkey - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -636,7 +636,7 @@ jobs: py311_encrypt_keyrings: name: Python 3.11 Encrypt Keyrings - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -654,7 +654,7 @@ jobs: py311_generate_decrypt_vectors_masterkey: name: Python 3.11 Generate Decrypt Vectors Masterkey - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -673,7 +673,7 @@ jobs: py311_decrypt_masterkey_with_masterkey: name: Python 3.11 Decrypt Masterkey with Masterkey needs: py311_generate_decrypt_vectors_masterkey - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -692,7 +692,7 @@ jobs: py311_decrypt_masterkey_with_keyrings: name: Python 3.11 Decrypt Masterkey with Keyrings needs: py311_generate_decrypt_vectors_masterkey - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -711,7 +711,7 @@ jobs: py311_decrypt_masterkey_with_js: name: Python 3.11 Decrypt Masterkey with JS needs: py311_generate_decrypt_vectors_masterkey - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -729,7 +729,7 @@ jobs: py311_generate_decrypt_vectors_keyrings: name: Python 3.11 Generate Decrypt Vectors Keyrings - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -748,7 +748,7 @@ jobs: py311_decrypt_keyrings_with_masterkey: name: Python 3.11 Decrypt Keyrings with Masterkey needs: py311_generate_decrypt_vectors_keyrings - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -767,7 +767,7 @@ jobs: py311_decrypt_keyrings_with_keyrings: name: Python 3.11 Decrypt Keyrings with Keyrings needs: py311_generate_decrypt_vectors_keyrings - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -786,7 +786,7 @@ jobs: py311_decrypt_keyrings_with_js: name: Python 3.11 Decrypt Keyrings with JS needs: py311_generate_decrypt_vectors_keyrings - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -804,7 +804,7 @@ jobs: py311_decrypt_golden_manifest_with_keyrings: name: Python 3.11 Decrypt Golden Manifest with Keyrings - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -822,7 +822,7 @@ jobs: py311_decrypt_golden_manifest_with_masterkey: name: Python 3.11 Decrypt Golden Manifest with Masterkey - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -841,7 +841,7 @@ jobs: # Python 3.12 jobs py312_integ: name: Python 3.12 Integration Tests - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -859,7 +859,7 @@ jobs: py312_integ_mpl: name: Python 3.12 Integration MPL - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -877,7 +877,7 @@ jobs: py312_performance_tests_mpl: name: Python 3.12 Performance Tests MPL - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -895,7 +895,7 @@ jobs: py312_examples: name: Python 3.12 Examples - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -913,7 +913,7 @@ jobs: py312_examples_mpl: name: Python 3.12 Examples MPL - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -931,7 +931,7 @@ jobs: py312_decrypt_dafny_esdk_vectors_masterkey: name: Python 3.12 Decrypt Dafny ESDK Vectors Masterkey - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -949,7 +949,7 @@ jobs: py312_decrypt_dafny_esdk_vectors_keyrings: name: Python 3.12 Decrypt Dafny ESDK Vectors Keyrings - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -967,7 +967,7 @@ jobs: py312_decrypt_net_401_vectors_masterkey: name: Python 3.12 Decrypt .NET 4.0.1 Vectors Masterkey - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -985,7 +985,7 @@ jobs: py312_decrypt_net_401_vectors_keyrings: name: Python 3.12 Decrypt .NET 4.0.1 Vectors Keyrings - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -1003,7 +1003,7 @@ jobs: py312_encrypt_masterkey: name: Python 3.12 Encrypt Masterkey - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -1021,7 +1021,7 @@ jobs: py312_encrypt_keyrings: name: Python 3.12 Encrypt Keyrings - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -1039,7 +1039,7 @@ jobs: py312_generate_decrypt_vectors_masterkey: name: Python 3.12 Generate Decrypt Vectors Masterkey - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -1058,7 +1058,7 @@ jobs: py312_decrypt_masterkey_with_masterkey: name: Python 3.12 Decrypt Masterkey with Masterkey needs: py312_generate_decrypt_vectors_masterkey - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -1077,7 +1077,7 @@ jobs: py312_decrypt_masterkey_with_keyrings: name: Python 3.12 Decrypt Masterkey with Keyrings needs: py312_generate_decrypt_vectors_masterkey - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -1096,7 +1096,7 @@ jobs: py312_decrypt_masterkey_with_js: name: Python 3.12 Decrypt Masterkey with JS needs: py312_generate_decrypt_vectors_masterkey - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -1114,7 +1114,7 @@ jobs: py312_generate_decrypt_vectors_keyrings: name: Python 3.12 Generate Decrypt Vectors Keyrings - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -1133,7 +1133,7 @@ jobs: py312_decrypt_keyrings_with_masterkey: name: Python 3.12 Decrypt Keyrings with Masterkey needs: py312_generate_decrypt_vectors_keyrings - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -1152,7 +1152,7 @@ jobs: py312_decrypt_keyrings_with_keyrings: name: Python 3.12 Decrypt Keyrings with Keyrings needs: py312_generate_decrypt_vectors_keyrings - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -1171,7 +1171,7 @@ jobs: py312_decrypt_keyrings_with_js: name: Python 3.12 Decrypt Keyrings with JS needs: py312_generate_decrypt_vectors_keyrings - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -1189,7 +1189,7 @@ jobs: py312_generate_hkeyring_decrypt_vectors: name: Python 3.12 Generate HKeyring Decrypt Vectors - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -1208,7 +1208,7 @@ jobs: py312_decrypt_hkeyring_with_masterkey: name: Python 3.12 Decrypt HKeyring with Masterkey needs: py312_generate_hkeyring_decrypt_vectors - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -1227,7 +1227,7 @@ jobs: py312_decrypt_hkeyring_with_keyrings: name: Python 3.12 Decrypt HKeyring with Keyrings needs: py312_generate_hkeyring_decrypt_vectors - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -1246,7 +1246,7 @@ jobs: py312_decrypt_hkeyring_with_net: name: Python 3.12 Decrypt HKeyring with .NET needs: py312_generate_hkeyring_decrypt_vectors - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -1264,7 +1264,7 @@ jobs: py312_decrypt_golden_manifest_with_keyrings: name: Python 3.12 Decrypt Golden Manifest with Keyrings - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -1282,7 +1282,7 @@ jobs: py312_decrypt_golden_manifest_with_masterkey: name: Python 3.12 Decrypt Golden Manifest with Masterkey - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -1301,7 +1301,7 @@ jobs: # Code Coverage and Compliance jobs code_coverage: name: Code Coverage - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -1318,7 +1318,7 @@ jobs: code_coverage_mpl: name: Code Coverage MPL - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 @@ -1336,7 +1336,7 @@ jobs: compliance: name: Compliance - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 diff --git a/.github/workflows/ci_decrypt-oracle.yaml b/.github/workflows/ci_decrypt-oracle.yaml index c56e43a63..e09fd9d06 100644 --- a/.github/workflows/ci_decrypt-oracle.yaml +++ b/.github/workflows/ci_decrypt-oracle.yaml @@ -8,7 +8,7 @@ permissions: jobs: tests: - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - uses: actions/checkout@v4 - uses: actions/setup-python@v4 @@ -25,7 +25,7 @@ jobs: cd decrypt_oracle tox -- -vv static-analysis: - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} strategy: fail-fast: false matrix: diff --git a/.github/workflows/ci_static-analysis.yaml b/.github/workflows/ci_static-analysis.yaml index d8175396e..9b7dc1460 100644 --- a/.github/workflows/ci_static-analysis.yaml +++ b/.github/workflows/ci_static-analysis.yaml @@ -8,7 +8,7 @@ permissions: jobs: analysis: - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} strategy: fail-fast: false matrix: diff --git a/.github/workflows/ci_test-vector-handler.yaml b/.github/workflows/ci_test-vector-handler.yaml index 340d4d5a9..ff6f15850 100644 --- a/.github/workflows/ci_test-vector-handler.yaml +++ b/.github/workflows/ci_test-vector-handler.yaml @@ -17,7 +17,7 @@ jobs: # Leaving this defined but disabled # until we address the credentials problem. if: 1 == 0 - runs-on: ${{ matrix.os }} + runs-on: ${{ matrix.runner }} strategy: fail-fast: true matrix: @@ -43,6 +43,15 @@ jobs: architecture: x86 - os: macos-latest architecture: x86 + include: + - os: ubuntu-latest + runner: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} + - os: windows-latest + runner: windows-latest + - os: macos-latest + runner: macos-latest + - os: macos-15-intel + runner: macos-15-intel steps: - uses: aws-actions/configure-aws-credentials@v4 with: @@ -64,7 +73,7 @@ jobs: cd test_vector_handlers tox -- -vv static-analysis: - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} strategy: fail-fast: false matrix: diff --git a/.github/workflows/ci_tests.yaml b/.github/workflows/ci_tests.yaml index 607b5c9e1..ada4aa394 100644 --- a/.github/workflows/ci_tests.yaml +++ b/.github/workflows/ci_tests.yaml @@ -18,7 +18,7 @@ permissions: jobs: tests: - runs-on: ${{ matrix.os }} + runs-on: ${{ matrix.runner }} strategy: fail-fast: true matrix: @@ -92,6 +92,13 @@ jobs: # mpllocal requires the MPL to be installed - category: mpllocal optional_mpl_dependency: "" + include: + - os: ubuntu-latest + runner: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} + - os: windows-latest + runner: windows-latest + - os: macos-latest + runner: macos-latest steps: # Support long Dafny filenames (used in MPL and DBESDK repos) - name: Support longpaths @@ -112,7 +119,7 @@ jobs: TOXENV: ${{ matrix.category }}${{ matrix.optional_mpl_dependency }} run: tox -- -vv upstream-py311: - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} strategy: fail-fast: true matrix: diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 308bfbda2..e8bc3b093 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -10,7 +10,7 @@ permissions: jobs: dependabot: - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} if: ${{ github.actor == 'dependabot[bot]' }} steps: - name: Dependabot metadata diff --git a/.github/workflows/pull.yml b/.github/workflows/pull.yml index 01caa4904..8254efca9 100644 --- a/.github/workflows/pull.yml +++ b/.github/workflows/pull.yml @@ -43,7 +43,7 @@ jobs: - static_analysis - test_vector_handler - tests - runs-on: ubuntu-22.04 + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Verify all required jobs passed uses: re-actors/alls-green@release/v1 diff --git a/.github/workflows/repo-sync.yml b/.github/workflows/repo-sync.yml index cf250b944..5fa084280 100644 --- a/.github/workflows/repo-sync.yml +++ b/.github/workflows/repo-sync.yml @@ -11,6 +11,7 @@ jobs: repo-sync: name: Repo Sync environment: repo-sync + # Docker container actions; CodeBuild runners have no Docker. runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 From 8302afd3d952efd7c4d897f60c7351ec80260d99 Mon Sep 17 00:00:00 2001 From: Lucas McDonald Date: Thu, 8 Oct 2026 16:25:42 +0000 Subject: [PATCH 2/4] ci: keep release, benchmark, and maintenance workflows on GitHub-hosted runners --- .github/workflows/dependabot-auto-merge.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index e8bc3b093..308bfbda2 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -10,7 +10,7 @@ permissions: jobs: dependabot: - runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} + runs-on: ubuntu-latest if: ${{ github.actor == 'dependabot[bot]' }} steps: - name: Dependabot metadata From ff41a320232b051b699e693a14c4300df0534b7b Mon Sep 17 00:00:00 2001 From: Lucas McDonald Date: Thu, 8 Oct 2026 16:30:56 +0000 Subject: [PATCH 3/4] ci: run benchmark and maintenance workflows on CodeBuild-hosted runners --- .github/workflows/dependabot-auto-merge.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 308bfbda2..e8bc3b093 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -10,7 +10,7 @@ permissions: jobs: dependabot: - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }} if: ${{ github.actor == 'dependabot[bot]' }} steps: - name: Dependabot metadata From 0bdf32efcb22104c00339358f32d7bff93bc5566 Mon Sep 17 00:00:00 2001 From: Lucas McDonald Date: Thu, 8 Oct 2026 18:43:10 +0000 Subject: [PATCH 4/4] ci: run the Docker-based CI jobs on CodeBuild-hosted runners --- .github/workflows/repo-sync.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/repo-sync.yml b/.github/workflows/repo-sync.yml index 5fa084280..cf250b944 100644 --- a/.github/workflows/repo-sync.yml +++ b/.github/workflows/repo-sync.yml @@ -11,7 +11,6 @@ jobs: repo-sync: name: Repo Sync environment: repo-sync - # Docker container actions; CodeBuild runners have no Docker. runs-on: ubuntu-latest steps: - uses: actions/checkout@v4