aes.yml

name: aes

on:
  pull_request:
    paths:
      - ".github/workflows/aes.yml"
      - "aes/**"
      - "Cargo.*"
  push:
    branches: master

defaults:
  run:
    working-directory: aes

env:
  CARGO_INCREMENTAL: 0
  RUSTFLAGS: "-Dwarnings"
  # NOTE: The mirror number changes with each version so keep these in sync
  SDE_FULL_VERSION_MIRROR: "859732"
  SDE_FULL_VERSION: "9.58.0-2025-06-16"

# Cancels CI jobs when new commits are pushed to a PR branch
concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  # Builds for no_std platforms
  build:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        rust:
          - 1.85.0 # MSRV
          - stable
        target:
          - thumbv7em-none-eabi
          - wasm32-unknown-unknown
    steps:
      - uses: actions/checkout@v6
      - uses: RustCrypto/actions/cargo-cache@master
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ matrix.rust }}
          targets: ${{ matrix.target }}
      - run: cargo check
      - run: |
          cargo build --target ${{ matrix.target }}
          cargo build --target ${{ matrix.target }} --features hazmat
      - env:
          RUSTFLAGS: '-Dwarnings --cfg aes_backend="soft"'
        run: |
          cargo build --target ${{ matrix.target }}
          cargo build --target ${{ matrix.target }} --features hazmat
      - env:
          RUSTFLAGS: '-Dwarnings --cfg aes_backend_soft="compact"'
        run: |
          cargo build --target ${{ matrix.target }}
          cargo build --target ${{ matrix.target }} --features hazmat
      - env:
          RUSTFLAGS: '-Dwarnings --cfg aes_backend="soft" --cfg aes_backend_soft="compact"'
        run: |
          cargo build --target ${{ matrix.target }}
          cargo build --target ${{ matrix.target }} --features hazmat

  minimal-versions:
    uses: RustCrypto/actions/.github/workflows/minimal-versions.yml@master
    with:
      working-directory: ${{ github.workflow }}

  # Tests for the AES-NI backend
  aesni:
    runs-on: ubuntu-latest
    env:
      CARGO_INCREMENTAL: 0
      RUSTDOCFLAGS: "-C target-feature=+aes,+ssse3"
      RUSTFLAGS: "-Dwarnings -C target-feature=+aes,+ssse3"
    strategy:
      matrix:
        include:
          # 32-bit Linux
          - target: i686-unknown-linux-gnu
            rust: 1.85.0 # MSRV
            deps: sudo apt update && sudo apt install gcc-multilib
          - target: i686-unknown-linux-gnu
            rust: stable
            deps: sudo apt update && sudo apt install gcc-multilib

          # 64-bit Linux
          - target: x86_64-unknown-linux-gnu
            rust: 1.85.0 # MSRV
          - target: x86_64-unknown-linux-gnu
            rust: stable
    steps:
      - uses: actions/checkout@v6
      - uses: RustCrypto/actions/cargo-cache@master
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ matrix.rust }}
          targets: ${{ matrix.target }}
      - run: ${{ matrix.deps }}
      - run: cargo test --target ${{ matrix.target }}
      - run: cargo test --target ${{ matrix.target }} --features hazmat
      - run: cargo test --target ${{ matrix.target }} --all-features

  # Tests for the VAES AVX backend
  vaes256:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            rust: stable
            RUSTFLAGS: '-Dwarnings --cfg aes_backend="avx256"'
    env:
      CARGO_INCREMENTAL: 0
      RUSTFLAGS: ${{ matrix.RUSTFLAGS }}
    steps:
      - uses: actions/checkout@v6
      - name: Install Intel SDE
        run: |
          curl -JLO "https://downloadmirror.intel.com/${{ env.SDE_FULL_VERSION_MIRROR }}/sde-external-${{ env.SDE_FULL_VERSION }}-lin.tar.xz"
          tar xvf sde-external-${{ env.SDE_FULL_VERSION }}-lin.tar.xz -C /opt
          echo "/opt/sde-external-${{ env.SDE_FULL_VERSION }}-lin" >> $GITHUB_PATH
      - uses: RustCrypto/actions/cargo-cache@master
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ matrix.rust }}
          targets: ${{ matrix.target }}
      # NOTE: Write a `.cargo/config.toml` to configure the target for VAES
      # NOTE: We use intel-sde as the runner since not all GitHub CI hosts support AVX512
      - name: write .cargo/config.toml
        shell: bash
        run: |
          cd ../aes/..
          mkdir -p .cargo
          echo '[target.${{ matrix.target }}]'  > .cargo/config.toml
          echo 'runner = "sde64 -future --"'   >> .cargo/config.toml
      - run: ${{ matrix.deps }}
      - run: cargo test --target ${{ matrix.target }}
      - run: cargo test --target ${{ matrix.target }} --features hazmat
      - run: cargo test --target ${{ matrix.target }} --all-features

  # Tests for the VAES AVX512 backend
  vaes512:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            rust: stable
            RUSTFLAGS: '-Dwarnings --cfg aes_backend="avx512"'
    env:
      CARGO_INCREMENTAL: 0
      RUSTFLAGS: ${{ matrix.RUSTFLAGS }}
    steps:
      - uses: actions/checkout@v6
      - name: Install Intel SDE
        run: |
          curl -JLO "https://downloadmirror.intel.com/${{ env.SDE_FULL_VERSION_MIRROR }}/sde-external-${{ env.SDE_FULL_VERSION }}-lin.tar.xz"
          tar xvf sde-external-${{ env.SDE_FULL_VERSION }}-lin.tar.xz -C /opt
          echo "/opt/sde-external-${{ env.SDE_FULL_VERSION }}-lin" >> $GITHUB_PATH
      - uses: RustCrypto/actions/cargo-cache@master
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ matrix.rust }}
          targets: ${{ matrix.target }}
      # NOTE: Write a `.cargo/config.toml` to configure the target for VAES
      # NOTE: We use intel-sde as the runner since not all GitHub CI hosts support AVX512
      - name: write .cargo/config.toml
        shell: bash
        run: |
          cd ../aes/..
          mkdir -p .cargo
          echo '[target.${{ matrix.target }}]'  > .cargo/config.toml
          echo 'runner = "sde64 -future --"'   >> .cargo/config.toml
      - run: ${{ matrix.deps }}
      - run: cargo test --target ${{ matrix.target }}
      - run: cargo test --target ${{ matrix.target }} --features hazmat
      - run: cargo test --target ${{ matrix.target }} --all-features

  # Tests for CPU feature autodetection with fallback to portable software implementation
  autodetect:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          # 32-bit Linux
          - target: i686-unknown-linux-gnu
            rust: 1.85.0 # MSRV
            deps: sudo apt update && sudo apt install gcc-multilib
          - target: i686-unknown-linux-gnu
            rust: stable
            deps: sudo apt update && sudo apt install gcc-multilib

          # 64-bit Linux
          - target: x86_64-unknown-linux-gnu
            rust: 1.85.0 # MSRV
          - target: x86_64-unknown-linux-gnu
            rust: stable
    steps:
      - uses: actions/checkout@v6
      - uses: RustCrypto/actions/cargo-cache@master
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ matrix.rust }}
          targets: ${{ matrix.target }}
      - run: ${{ matrix.deps }}
      - run: cargo test --target ${{ matrix.target }}
      - run: cargo test --target ${{ matrix.target }} --features hazmat
      - run: cargo test --target ${{ matrix.target }} --all-features

  # Tests for the portable software backend (i.e. `aes_backend="soft"`-only)
  soft:
    runs-on: ubuntu-latest
    env:
      RUSTFLAGS: '-Dwarnings --cfg aes_backend="soft"'
    strategy:
      matrix:
        include:
          # 32-bit Linux
          - target: i686-unknown-linux-gnu
            rust: 1.85.0 # MSRV
            deps: sudo apt update && sudo apt install gcc-multilib
          - target: i686-unknown-linux-gnu
            rust: stable
            deps: sudo apt update && sudo apt install gcc-multilib

          # 64-bit Linux
          - target: x86_64-unknown-linux-gnu
            rust: 1.85.0 # MSRV
          - target: x86_64-unknown-linux-gnu
            rust: stable
    steps:
      - uses: actions/checkout@v6
      - uses: RustCrypto/actions/cargo-cache@master
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ matrix.rust }}
          targets: ${{ matrix.target }}
      - run: ${{ matrix.deps }}
      - run: cargo test --target ${{ matrix.target }}
      - run: cargo test --target ${{ matrix.target }} --all-features

  # Cross-compiled tests
  cross:
    strategy:
      matrix:
        include:
          # ARM64
          - target: aarch64-unknown-linux-gnu
            rust: 1.85.0 # MSRV
          - target: aarch64-unknown-linux-gnu
            rust: stable

          # PPC32
          - target: powerpc-unknown-linux-gnu
            rust: 1.85.0 # MSRV
          - target: powerpc-unknown-linux-gnu
            rust: stable
    runs-on: ubuntu-latest
    # Cross mounts only current package, i.e. by default it ignores workspace's Cargo.toml
    defaults:
      run:
        working-directory: .
    steps:
      - uses: actions/checkout@v6
      - uses: RustCrypto/actions/cargo-cache@master
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ matrix.rust }}
          targets: ${{ matrix.target }}
      - uses: RustCrypto/actions/cross-install@master
      - run: ${{ matrix.deps }}
      - run: |
          cross test --package aes --target ${{ matrix.target }}
          cross test --package aes --target ${{ matrix.target }} --features hazmat
      - env:
          RUSTFLAGS: '-Dwarnings --cfg aes_backend="soft"'
        run: |
          cross test --package aes --target ${{ matrix.target }}
          cross test --package aes --target ${{ matrix.target }} --features hazmat
      - env:
          RUSTFLAGS: '-Dwarnings --cfg aes_backend_soft="compact"'
        run: |
          cross test --package aes --target ${{ matrix.target }}
          cross test --package aes --target ${{ matrix.target }} --features hazmat
      - env:
          RUSTFLAGS: '-Dwarnings --cfg aes_backend="soft" --cfg aes_backend_soft="compact"'
        run: |
          cross test --package aes --target ${{ matrix.target }}
          cross test --package aes --target ${{ matrix.target }} --features hazmat

  # ARMv8 cross-compiled tests for AES intrinsics
  armv8:
    strategy:
      matrix:
        include:
          - target: aarch64-unknown-linux-gnu
            rust: 1.85.0 # MSRV
    runs-on: ubuntu-latest
    # Cross mounts only current package, i.e. by default it ignores workspace's Cargo.toml
    defaults:
      run:
        working-directory: .
    steps:
      - uses: actions/checkout@v6
      - uses: RustCrypto/actions/cargo-cache@master
      - run: ${{ matrix.deps }}
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ matrix.rust }}
          targets: ${{ matrix.target }}
      - uses: RustCrypto/actions/cross-install@master
      - run: cross test --package aes --target ${{ matrix.target }}
      - run: cross test --package aes --target ${{ matrix.target }} --features hazmat
      - run: cross test --package aes --target ${{ matrix.target }} --all-features

  clippy:
    env:
      RUSTFLAGS: '-Dwarnings --cfg aes_backend_soft="compact"'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: RustCrypto/actions/cargo-cache@master
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: 1.85.0 # MSRV
          components: clippy
      - run: cargo clippy --features hazmat -- -D warnings