Add basic AWS-LC integration test

This commit extends the CI with an integration test for AWS-LC.

The CI checks that mlkem-native successfully integrates into
AWS-LC by building and running basic tests of AWS-LC in FIPS
and non-FIPS mode.

Signed-off-by: Hanno Becker <beckphan@amazon.co.uk>

Author: hanno-becker

.github/actions/setup-aws-lc/action.yml

@@ -0,0 +1,34 @@
+# SPDX-License-Identifier: Apache-2.0
+
+name: Setup AWS-LC
+description: Setup AWS-LC
+
+inputs:
+  dir:
+    description: Directory to fetch AWS-LC into
+    default: 'AWS-LC'
+  repository:
+    description: Repository to fetch from
+    default: 'aws/AWS-LC'
+  commit:
+    description: Commit to fetch
+    default: 'HEAD'
+  gh_token:
+    description: Github access token to use
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Fetch AWS-LC
+      shell: bash
+      run: |
+        mkdir ${{ inputs.dir }} && cd ${{ inputs.dir }}
+        git config --global --add safe.directory $GITHUB_WORKSPACE/${{ inputs.dir }}
+        git init
+        git remote add origin $GITHUB_SERVER_URL/${{ inputs.repository }}
+        git fetch origin --depth 1 ${{ inputs.commit }}
+        git checkout FETCH_HEAD
+
+        # Remember AWS-LC directory
+        echo AWSLC_DIR="$GITHUB_WORKSPACE/${{ inputs.dir }}" >> $GITHUB_ENV

.github/workflows/all.yml

@@ -47,6 +47,14 @@ jobs:
     needs: [ base ]
     uses: ./.github/workflows/integration-liboqs.yml
     secrets: inherit
+  awslc_integration:
+    name: Integration
+    permissions:
+      contents: 'read'
+      id-token: 'write'
+    needs: [ base ]
+    uses: ./.github/workflows/integration-awslc.yml
+    secrets: inherit
   ct-test:
     name: Constant-time
     permissions:

.github/workflows/integration-awslc.yml

@@ -0,0 +1,66 @@
+# SPDX-License-Identifier: Apache-2.0
+
+name: Test AWS-LC integration
+permissions:
+  contents: read
+on:
+  workflow_call:
+  workflow_dispatch:
+
+jobs:
+  aws_lc_integration_fips:
+    strategy:
+      fail-fast: false
+      matrix:
+        system: [ubuntu-latest, pqcp-arm64]
+        fips: [0,1]
+    name: AWS-LC FIPS test (${{ matrix.system }}, FIPS=${{ matrix.fips }})
+    runs-on: ${{ matrix.system }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: ./.github/actions/setup-os
+        with:
+          packages: 'cmake'
+      - uses: ./.github/actions/setup-aws-lc
+        with:
+          repository: 'aws/aws-lc'
+          commit: 'main`
+      - name: Run importer
+        run: |
+          cd $AWSLC_DIR/crypto/fipsmodule/ml_kem
+          rm -rf mlkem
+          GITHUB_REPOSITORY=$GITHUB_REPOSITORY GITHUB_SHA=$GITHUB_SHA ./importer.sh
+      - name: Build+Test AWS-LC (FIPS=${{ matrix.fips }})
+        run: |
+          cd $AWSLC_DIR
+          mkdir build
+          cd build
+          cmake -DFIPS=${{ matrix.fips }} ..
+          cd ..
+
+          cmake --build ./build --target all
+          cmake --build ./build --target run_tests
+  aws_lc_integration_posix:
+    strategy:
+      fail-fast: false
+      matrix:
+        system: [ubuntu-latest, pqcp-arm64, macos-latest]
+    name: AWS-LC Posix test (${{ matrix.system }})
+    runs-on: ${{ matrix.system }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: ./.github/actions/setup-os
+        with:
+          packages: 'cmake golang'
+      - uses: ./.github/actions/setup-aws-lc
+        with:
+          repository: 'aws/aws-lc'
+          commit: 'main'
+      - name: Run importer
+        run: |
+          cd $AWSLC_DIR/crypto/fipsmodule/ml_kem
+          GITHUB_REPOSITORY=$GITHUB_REPOSITORY GITHUB_SHA=$GITHUB_SHA ./importer.sh
+      - name: Run POSIX tests
+        run: |
+          cd $AWSLC_DIR
+          ./tests/ci/run_posix_tests.sh