Add AWS-LC integration test

.github/actions/setup-aws-lc/action.yml

@@ -0,0 +1,34 @@
+# SPDX-License-Identifier: Apache-2.0
+
+name: Setup AWS-LC
+description: Setup AWS-LC
+
+inputs:
+  dir:
+    description: Directory to fetch AWS-LC into
+    default: 'AWS-LC'
+  repository:
+    description: Repository to fetch from
+    default: 'aws/AWS-LC'
+  commit:
+    description: Commit to fetch
+    default: 'HEAD'
+  gh_token:
+    description: Github access token to use
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Fetch AWS-LC
+      shell: bash
+      run: |
+        mkdir ${{ inputs.dir }} && cd ${{ inputs.dir }}
+        git config --global --add safe.directory $GITHUB_WORKSPACE/${{ inputs.dir }}
+        git init
+        git remote add origin $GITHUB_SERVER_URL/${{ inputs.repository }}
+        git fetch origin --depth 1 ${{ inputs.commit }}
+        git checkout FETCH_HEAD
+
+        # Remember AWS-LC directory
+        echo AWSLC_DIR="$GITHUB_WORKSPACE/${{ inputs.dir }}" >> $GITHUB_ENV

.github/workflows/aws_lc.yml

@@ -0,0 +1,132 @@
+# SPDX-License-Identifier: Apache-2.0
+
+name: AWS-LC
+permissions:
+  contents: read
+on:
+  workflow_dispatch:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["main"]
+    types: [ "opened", "synchronize" ]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  aws_lc_integration_fips:
+    strategy:
+      fail-fast: false
+      matrix:
+        system: [ubuntu-latest, pqcp-arm64]
+        fips: [0,1]
+    name: AWS-LC FIPS test (${{ matrix.system }}, FIPS=${{ matrix.fips }})
+    runs-on: ${{ matrix.system }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: ./.github/actions/setup-os
+        with:
+          packages: 'cmake'
+      - uses: ./.github/actions/setup-aws-lc
+        with:
+          repository: 'hanno-becker/aws-lc'
+          commit: 'mlkem_native'
+      - name: Run importer
+        run: |
+          cd $AWSLC_DIR/crypto/fipsmodule/ml_kem
+          rm -rf mlkem
+          GITHUB_REPOSITORY=$GITHUB_REPOSITORY GITHUB_SHA=$GITHUB_SHA ./importer.sh
+      - name: Build+Test AWS-LC (FIPS=${{ matrix.fips }})
+        run: |
+          cd $AWSLC_DIR
+          mkdir build
+          cd build
+          cmake -DFIPS=${{ matrix.fips }} ..
+          cd ..
+
+          cmake --build ./build --target all
+          cmake --build ./build --target run_tests
+  posix:
+    # This is a partial parallelization of the run_posix_tests.sh script
+    strategy:
+      max-parallel: 16
+      fail-fast: false
+      matrix:
+        system: [ubuntu-latest, pqcp-arm64]
+        test:
+          - name: Debug mode
+            flags: -DENABLE_DILITHIUM=ON
+          - name: Release mode
+            flags: -DCMAKE_BUILD_TYPE=Release -DENABLE_DILITHIUM=ON
+          - name: Dilithium disabled
+            flags: -DENABLE_DILITHIUM=OFF
+          - name: Small compilation
+            flags: -DOPENSSL_SMALL=1 -DCMAKE_BUILD_TYPE=Release -DENABLE_DILITHIUM=ON
+          - name: LibSSL off.
+            flags: -DBUILD_LIBSSL=OFF -DCMAKE_BUILD_TYPE=Release -DENABLE_DILITHIUM=ON
+          - name: No-ASM
+            flags: -DOPENSSL_NO_ASM=1 -DCMAKE_BUILD_TYPE=Release -DENABLE_DILITHIUM=ON
+          - name: Shared
+            flags: -DBUILD_SHARED_LIBS=1 -DCMAKE_BUILD_TYPE=Release -DENABLE_DILITHIUM=ON
+          - name: Pre-Gen ASM
+            flags: -DDISABLE_PERL=ON -DENABLE_DILITHIUM=ON
+          - name: DIT
+            flags: -DENABLE_DATA_INDEPENDENT_TIMING=ON -DCMAKE_BUILD_TYPE=Release -DENABLE_DILITHIUM=ON
+    name: Posix test (${{ matrix.test.name }}, ${{ matrix.system }})
+    runs-on: ${{ matrix.system }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: ./.github/actions/setup-os
+        with:
+          packages: 'cmake golang'
+      - uses: ./.github/actions/setup-aws-lc
+        with:
+          repository: 'hanno-becker/aws-lc'
+          commit: 'mlkem_native'
+      - name: Run importer
+        run: |
+          cd $AWSLC_DIR/crypto/fipsmodule/ml_kem
+          GITHUB_REPOSITORY=$GITHUB_REPOSITORY GITHUB_SHA=$GITHUB_SHA ./importer.sh
+      - name: Run test
+        run: |
+          cd $AWSLC_DIR
+          source tests/ci/common_posix_setup.sh
+          build_and_test ${{ matrix.test.flags }}
+  prefix:
+    # This is a parallelization of the run_prefix_tests.sh script
+    strategy:
+      max-parallel: 8
+      fail-fast: false
+      matrix:
+        system: [ubuntu-latest, pqcp-arm64, macos-latest, macos-13]
+        test:
+          - name: Testing a prefix build of AWS-LC in debug mode.
+            flags:
+          - name: Testing a prefix build of AWS-LC in release mode.
+            flags: -DCMAKE_BUILD_TYPE=Release
+          - name: Testing a prefix build of AWS-LC small compilation.
+            flags: -DOPENSSL_SMALL=1 -DCMAKE_BUILD_TYPE=Release
+          - name: Testing a prefix build of AWS-LC in no asm mode.
+            flags: -DOPENSSL_NO_ASM=1 -DCMAKE_BUILD_TYPE=Release
+    name: Prefix test (${{ matrix.test.name }}, ${{ matrix.system }})
+    runs-on: ${{ matrix.system }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: ./.github/actions/setup-os
+        with:
+          packages: 'cmake golang'
+      - uses: ./.github/actions/setup-aws-lc
+        with:
+          repository: 'hanno-becker/aws-lc'
+          commit: 'mlkem_native'
+      - name: Run importer
+        run: |
+          cd $AWSLC_DIR/crypto/fipsmodule/ml_kem
+          GITHUB_REPOSITORY=$GITHUB_REPOSITORY GITHUB_SHA=$GITHUB_SHA ./importer.sh
+      - name: Run test
+        run: |
+          cd $AWSLC_DIR
+          source tests/ci/common_posix_setup.sh
+          build_prefix_and_test ${{ matrix.flags }}