Repository navigation
Zeroize stack in assembly routines spilling to the stack #63
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Copyright (c) The mlkem-native project authors | |
| # Copyright (c) The mldsa-native project authors | |
| # SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT | |
| name: SLOTHY re-optimization tests | |
| permissions: | |
| contents: read | |
| on: | |
| workflow_call: | |
| secrets: | |
| AWS_GITHUB_TOKEN: | |
| description: Token for registering EC2 runners and reading the nix cache | |
| required: false | |
| workflow_dispatch: | |
| push: | |
| branches: ["main"] | |
| # Standalone trigger so SLOTHY can be requested on an existing PR by adding | |
| # the `slothy-tests` label. Adding `labeled` to all.yml instead would re-run | |
| # all of CI on every label change. | |
| pull_request: | |
| branches: ["main"] | |
| types: [ "labeled" ] | |
| jobs: | |
| # Coarse gate so the EC2 instance only starts when the SLOTHY | |
| # inputs or toolchain are changed. | |
| check_modified_files: | |
| name: Determine changed files | |
| runs-on: ubuntu-latest | |
| if: github.repository_owner == 'pq-code-package' && !github.event.pull_request.head.repo.fork | |
| outputs: | |
| # The `slothy-tests` label is the manual override for changes the file | |
| # filter below cannot see, e.g. a toolchain regression to reproduce. | |
| # Pushes to main always run SLOTHY. | |
| # A `labeled` event is only ever a request for SLOTHY itself, so adding | |
| # an unrelated label must not start an EC2 instance; other PR events | |
| # fall back to the file filter. | |
| run_needed: >- | |
| ${{ github.event_name == 'push' || | |
| (github.event.action == 'labeled' && github.event.label.name == 'slothy-tests') || | |
| (github.event.action != 'labeled' && | |
| (steps.changed-files.outputs.any_changed == 'true' || | |
| github.event_name == 'workflow_dispatch' || | |
| contains(github.event.pull_request.labels.*.name, 'slothy-tests'))) }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| if: github.event_name != 'workflow_dispatch' && github.event.action != 'labeled' | |
| with: | |
| persist-credentials: false | |
| # Enough history for changed-files (rebase-merge pushes can be multi-commit) | |
| fetch-depth: 100 | |
| - name: Get changed files | |
| id: changed-files | |
| if: github.event_name != 'workflow_dispatch' && github.event.action != 'labeled' | |
| uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6 | |
| with: | |
| files: | | |
| .github/workflows/slothy.yml | |
| .github/workflows/ci_ec2_reusable.yml | |
| scripts/autogen | |
| dev/aarch64_clean/** | |
| dev/aarch64_opt/** | |
| dev/fips202/aarch64/** | |
| mldsa/src/native/aarch64/** | |
| mldsa/src/fips202/native/aarch64/** | |
| flake.nix | |
| flake.lock | |
| nix/** | |
| slothy: | |
| name: SLOTHY | |
| needs: [ check_modified_files ] | |
| if: needs.check_modified_files.outputs.run_needed == 'true' | |
| permissions: | |
| contents: 'read' | |
| id-token: 'write' | |
| uses: ./.github/workflows/ci_ec2_reusable.yml | |
| with: | |
| name: SLOTHY | |
| ec2_instance_type: c8g.8xlarge | |
| ec2_ami: ubuntu (aarch64) | |
| ec2_volume_size: 20 | |
| lint: false | |
| test: false | |
| cbmc: false | |
| slothy: true | |
| secrets: | |
| AWS_GITHUB_TOKEN: ${{ secrets.AWS_GITHUB_TOKEN }} |