From cc89f23c85be5e0138af322768823216d4da555e Mon Sep 17 00:00:00 2001
From: Hanno Becker <beckphan@amazon.co.uk>
Date: Mon, 13 Jan 2025 06:13:58 +0000
Subject: [PATCH] Add basic AWS-LC integration test

This commit extends the CI with an integration test for AWS-LC.

The integration test currently works with the `mlkem_native`
branch from the fork `hanno-becker/aws-lc`, which
- Removes the reference implementation
- Provides an importer.sh for importing mlkem-native
- Provides the glue code between mlkem-native's own API
  and the API expected by AWS-LC.
- As a temporary change, it disables `-Werror=redundant-decls`,
  because mlkem-native does not yet support it.

The CI checks that mlkem-native successfully integrated to this
fork, by building and running basic tests of AWS-LC in FIPS
and non-FIPS mode.

Signed-off-by: Hanno Becker <beckphan@amazon.co.uk>
---
 .github/actions/setup-aws-lc/action.yml | 34 +++++++++++++++++++++
 .github/workflows/ci.yml                | 39 +++++++++++++++++++++++++
 2 files changed, 73 insertions(+)
 create mode 100644 .github/actions/setup-aws-lc/action.yml

diff --git a/.github/actions/setup-aws-lc/action.yml b/.github/actions/setup-aws-lc/action.yml
new file mode 100644
index 000000000..3af25a9a7
--- /dev/null
+++ b/.github/actions/setup-aws-lc/action.yml
@@ -0,0 +1,34 @@
+# SPDX-License-Identifier: Apache-2.0
+
+name: Setup AWS-LC
+description: Setup AWS-LC
+
+inputs:
+  dir:
+    description: Directory to fetch AWS-LC into
+    default: 'AWS-LC'
+  repository:
+    description: Repository to fetch from
+    default: 'aws/AWS-LC'
+  commit:
+    description: Commit to fetch
+    default: 'HEAD'
+  gh_token:
+    description: Github access token to use
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Fetch AWS-LC
+      shell: bash
+      run: |
+        mkdir ${{ inputs.dir }} && cd ${{ inputs.dir }}
+        git config --global --add safe.directory $GITHUB_WORKSPACE/${{ inputs.dir }}
+        git init
+        git remote add origin $GITHUB_SERVER_URL/${{ inputs.repository }}
+        git fetch origin --depth 1 ${{ inputs.commit }}
+        git checkout FETCH_HEAD
+
+        # Remember AWS-LC directory
+        echo AWSLC_DIR="$GITHUB_WORKSPACE/${{ inputs.dir }}" >> $GITHUB_ENV
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f7932a544..80203f4c9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -158,6 +158,45 @@ jobs:
       - name: monolithic_build_multilevel
         run: |
           make run -C examples/monolithic_build_multilevel
+  aws_lc_integration:
+    strategy:
+      matrix:
+        system: [Ubuntu-latest]
+    name: AWS-LC integration test
+    runs-on: ${{ matrix.system }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: ./.github/actions/setup-os
+        with:
+          packages: 'cmake'
+      - uses: ./.github/actions/setup-aws-lc
+        with:
+          repository: 'hanno-becker/aws-lc'
+          commit: 'mlkem_native'
+      - name: Run importer
+        run: |
+          cd $AWSLC_DIR/crypto/fipsmodule/ml_kem
+          GITHUB_REPOSITORY=$GITHUB_REPOSITORY GITHUB_SHA=$GITHUB_SHA ./importer.sh
+      - name: Build AWS-LC (FIPS=1)
+        run: |
+          cd $AWSLC_DIR
+          mkdir build_fips
+          cd build_fips
+          cmake -DFIPS=1 ..
+          cd ..
+
+          cmake --build ./build_fips --target all
+          cmake --build ./build_fips --target run_tests
+      - name: Build AWS-LC (FIPS=0)
+        run: |
+          cd $AWSLC_DIR
+          mkdir build_no_fips
+          cd build_no_fips
+          cmake ..
+          cd ..
+
+          cmake --build ./build_no_fips --target all
+          cmake --build ./build_no_fips --target run_tests
   build_kat:
     needs: [quickcheck, quickcheck-windows, quickcheck-c90, quickcheck-lib, examples, lint, lint-markdown-link]
     strategy: