hardware-rust-crypto 1.0.1

name: CI

# Core cross-platform gate: build, format, clippy, the full test suite (incl.
# differential vectors: NIST CAVP, Wycheproof, OpenSSL, RustCrypto), plus
# dependency audit/deny. Each verification *framework* (Kani, SAW, F*, crux-mir,
# constant-time, Miri, Valgrind, sanitizers, fuzz, randomness, mutation) lives in
# its own individually-runnable workflow - see .github/workflows/README.md.
on:
  workflow_dispatch:
  pull_request:
  push:
    branches:
      - main

jobs:
  test:
    name: ${{ matrix.name }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: linux-x64
            os: ubuntu-latest
            expected_arch: x86_64
          - name: linux-arm64
            os: ubuntu-24.04-arm
            expected_arch: aarch64
          - name: macos-aarch64
            os: macos-14
            expected_arch: arm64

    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Verify runner architecture
        run: |
          actual="$(uname -m)"
          if [ "$actual" != "${{ matrix.expected_arch }}" ]; then
            echo "expected ${{ matrix.expected_arch }}, got $actual" >&2
            exit 1
          fi

      - name: Install Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable as of 2026-06-11
        with:
          toolchain: stable

      - name: Cache cargo
        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2

      - name: Assert crypto hardware is available
        run: cargo run --example assert_hardware

      - name: Forbid software ciphers and third-party crypto in production graph
        run: |
          for pkg in hardware-rust-crypto; do
            hits="$(cargo tree -p "$pkg" -e normal --prefix none \
              | grep -ciE '^(rand|rand_core|rand_chacha|chacha20|salsa20|ring|aes|aes-gcm|ctr|cipher|ghash|polyval|universal-hash|sha1|sha2|md-5) ' || true)"
            if [ "$hits" != "0" ]; then
              echo "forbidden crypto dependency in $pkg production graph:" >&2
              cargo tree -p "$pkg" -e normal >&2
              exit 1
            fi
          done

      - name: Format
        run: cargo fmt --all --check

      - name: Clippy
        run: cargo clippy --workspace --all-targets -- -D warnings

      - name: Test
        run: cargo test --workspace --all-targets

      - name: Release crypto tests
        run: |
          cargo test --release -p hardware-rust-crypto
          cargo test --release --test aes_gcm_interop
          cargo test --release --test aes_gcm_siv_interop
          cargo test --release --test nist_cavp_gcm
          cargo test --release --test wycheproof_aes_gcm
          cargo test --release --test wycheproof_aes_gcm_siv
          cargo test --release --test proptest_aead

      # Exercise the explicit-nonce entry points and the byte-exact encrypt
      # known-answer checks gated behind them.
      - name: Hazmat explicit-nonce tests
        run: cargo test --features hazmat-explicit-nonce --test nist_cavp_gcm --test aes_gcm_interop --test aes_gcm_siv_interop --test openssl_interop

      - name: Docs
        run: cargo doc --workspace --no-deps

  audit:
    name: cargo-audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable as of 2026-06-11
        with:
          toolchain: stable

      - name: Cache cargo
        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2

      - name: Install cargo-audit
        run: cargo install cargo-audit --locked

      - name: Audit dependencies
        run: cargo audit

  deny:
    name: cargo-deny
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable as of 2026-06-11
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
      - name: Install cargo-deny
        run: cargo install cargo-deny --locked
      - name: Check advisories, licenses, sources, bans
        run: cargo deny check

  windows:
    # Platform/portability test of the intrinsic backends on the MSVC ABI + PE
    # codegen, on both Windows architectures: x86_64 (AES-NI/PCLMULQDQ) and arm64
    # (ARMv8 AES/PMULL). This is the only coverage of the aarch64 intrinsics on
    # Windows - Linux arm64 is ELF/GNU, macOS arm64 is Mach-O/Apple.
    name: ${{ matrix.name }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: windows-x64 (AES-NI path)
            os: windows-latest
          - name: windows-arm64 (ARMv8 AES path)
            os: windows-11-arm
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable as of 2026-06-11
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
      - name: Assert crypto hardware is available
        run: cargo run --example assert_hardware
      - name: Test (debug + release)
        run: |
          cargo test --workspace --all-targets
          cargo test --release --test aes_gcm_interop --test aes_gcm_siv_interop --test nist_cavp_gcm --test wycheproof_aes_gcm --test wycheproof_aes_gcm_siv