fips.yml

name: fips

on:
  push:
    branches:
      - '*'
      - '!generate/aws-lc-*'
  pull_request:
    branches:
      - '*'
concurrency:
  group: ${{ github.workflow }}-${{ github.ref_name }}
  cancel-in-progress: true

env:
  RUST_BACKTRACE: 1
  # We can pin the version if nightly is too unstable.
  # Otherwise, we test against the latest version.
  RUST_NIGHTLY_TOOLCHAIN: nightly

jobs:
  fips-test:
    if: github.repository_owner == 'aws'
    name: aws-lc-rs fips-tests
    runs-on: ${{ matrix.os }}
    env:
      CC: clang
      CXX: clang++
    strategy:
      fail-fast: false
      matrix:
        rust: [ stable ]
        os: [ ubuntu-latest, macos-13, macos-14-xlarge ]
        args:
          - --release --all-targets --features fips,unstable
          - --profile release-lto --all-targets --features fips,unstable
          - --no-default-features --features fips,unstable
          - --no-default-features --features fips,ring-io,unstable
          - --no-default-features --features fips,ring-sig-verify,unstable
          - --no-default-features --features fips,alloc,unstable
    steps:
      - uses: actions/checkout@v3
        with:
          submodules: 'recursive'
      - uses: dtolnay/rust-toolchain@master
        id: toolchain
        with:
          toolchain: ${{ matrix.rust }}
      - name: Set Rust toolchain override
        run: rustup override set ${{ steps.toolchain.outputs.name }}
      - uses: actions/setup-go@v4
        with:
          go-version: '>=1.18'
      - name: Run cargo test
        working-directory: ./aws-lc-rs
        # Doc-tests fail to link with dynamic build
        # See: https://github.com/rust-lang/cargo/issues/8531
        run: cargo test --tests ${{ matrix.args }}
  windows-fips-test:
    if: github.repository_owner == 'aws'
    name: aws-lc-rs windows-fips-tests
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ windows-2019, windows-latest ]
        args:
          - --all-targets --features fips,unstable
          - --all-targets --features fips,bindgen,unstable
          - --release --all-targets --features fips,unstable
          - --no-default-features --features fips,unstable
          - --no-default-features --features fips,ring-io,unstable
          - --no-default-features --features fips,ring-sig-verify,unstable
          - --no-default-features --features fips,alloc,unstable
    steps:
      - uses: ilammy/setup-nasm@v1
      - uses: actions/checkout@v3
        with:
          submodules: 'recursive'
      - uses: dtolnay/rust-toolchain@master
        id: toolchain
        with:
          toolchain: stable
      - name: Set Rust toolchain override
        run: rustup override set ${{ steps.toolchain.outputs.name }}
      - name: Install ninja-build tool
        uses: seanmiddleditch/gha-setup-ninja@v4
      - name: Run cargo test
        working-directory: ./aws-lc-rs
        # Doc-tests fail to link with dynamic build
        # See: https://github.com/rust-lang/cargo/issues/8531
        run: cargo test --tests ${{ matrix.args }}