From d56b4950bd1a9e32c06f764e884ef2acd28ec650 Mon Sep 17 00:00:00 2001
From: Lucas McDonald <lucmcdon@amazon.com>
Date: Wed, 7 Oct 2026 23:46:32 +0000
Subject: [PATCH 1/5] ci: run Linux CI on CodeBuild-hosted runners

---
 .github/workflows/duvet.yml        |  6 ++----
 .github/workflows/python-integ.yml | 15 +++++++++++----
 .github/workflows/python-perf.yml  |  6 +++---
 .github/workflows/release.yml      | 12 +++++++-----
 4 files changed, 23 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/duvet.yml b/.github/workflows/duvet.yml
index 23bbe45a..a916be11 100644
--- a/.github/workflows/duvet.yml
+++ b/.github/workflows/duvet.yml
@@ -6,7 +6,7 @@ on:
 
 jobs:
   test:
-    runs-on: ubuntu-slim
+    runs-on: codebuild-CryptoToolsCI-linux-amazon-s3-encryption-client-python-${{ github.run_id }}-${{ github.run_attempt }}
     permissions:
       id-token: write
       contents: read
@@ -20,9 +20,7 @@ jobs:
         run: git submodule update --init --recursive specification
 
       - name: Setup Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1
-        with:
-          toolchain: stable
+        uses: dtolnay/rust-toolchain@stable
 
       - name: Install duvet
         run: |
diff --git a/.github/workflows/python-integ.yml b/.github/workflows/python-integ.yml
index 7c22d3e4..0c01dde9 100644
--- a/.github/workflows/python-integ.yml
+++ b/.github/workflows/python-integ.yml
@@ -16,7 +16,14 @@ jobs:
       matrix:
         python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
         os: [ubuntu-latest, macos-latest, windows-latest]
-    runs-on: ${{ matrix.os }}
+        include:
+          - os: ubuntu-latest
+            runner: codebuild-CryptoToolsCI-linux-amazon-s3-encryption-client-python-${{ github.run_id }}-${{ github.run_attempt }}
+          - os: macos-latest
+            runner: macos-latest
+          - os: windows-latest
+            runner: windows-latest
+    runs-on: ${{ matrix.runner }}
     permissions:
       id-token: write
       contents: read
@@ -37,10 +44,10 @@ jobs:
         uses: actions/cache@v5
         with:
           path: ~/.cache/uv
-          key: ${{ runner.os }}-uv-py${{ matrix.python-version }}-${{ hashFiles('**/pyproject.toml') }}
+          key: ${{ runner.os == 'Linux' && 'cb-' || '' }}${{ runner.os }}-uv-py${{ matrix.python-version }}-${{ hashFiles('**/pyproject.toml') }}
           restore-keys: |
-            ${{ runner.os }}-uv-py${{ matrix.python-version }}-
-            ${{ runner.os }}-uv-
+            ${{ runner.os == 'Linux' && 'cb-' || '' }}${{ runner.os }}-uv-py${{ matrix.python-version }}-
+            ${{ runner.os == 'Linux' && 'cb-' || '' }}${{ runner.os }}-uv-
 
       - name: Install Uv
         run: pip install uv
diff --git a/.github/workflows/python-perf.yml b/.github/workflows/python-perf.yml
index 38bddb56..1c09efdc 100644
--- a/.github/workflows/python-perf.yml
+++ b/.github/workflows/python-perf.yml
@@ -11,7 +11,7 @@ on:
 
 jobs:
   python-perf:
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-amazon-s3-encryption-client-python-${{ github.run_id }}-${{ github.run_attempt }}
     permissions:
       id-token: write
       contents: read
@@ -31,9 +31,9 @@ jobs:
         uses: actions/cache@v5
         with:
           path: ~/.cache/uv
-          key: ${{ runner.os }}-uv-${{ hashFiles('**/pyproject.toml') }}
+          key: ${{ runner.os == 'Linux' && 'cb-' || '' }}${{ runner.os }}-uv-${{ hashFiles('**/pyproject.toml') }}
           restore-keys: |
-            ${{ runner.os }}-uv-
+            ${{ runner.os == 'Linux' && 'cb-' || '' }}${{ runner.os }}-uv-
 
       - name: Install Uv
         run: pip install uv
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f92c07ff..c1977585 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,7 +16,7 @@ on:
 jobs:
   determine-version:
     name: Determine Version
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-amazon-s3-encryption-client-python-${{ github.run_id }}-${{ github.run_attempt }}
     permissions:
       contents: write
     outputs:
@@ -65,7 +65,7 @@ jobs:
     name: Build Package
     needs: [determine-version, test]
     if: needs.determine-version.outputs.version != ''
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-amazon-s3-encryption-client-python-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
@@ -87,6 +87,7 @@ jobs:
     name: Publish to TestPyPI
     if: ${{ !inputs.dry_run && needs.determine-version.outputs.version != '' }}
     needs: [determine-version, build]
+    # pypa/gh-action-pypi-publish is a Docker container action.
     runs-on: ubuntu-latest
     environment: testpypi
     permissions:
@@ -105,7 +106,7 @@ jobs:
     name: Validate TestPyPI Package
     needs: [determine-version, publish-testpypi]
     if: needs.determine-version.outputs.version != ''
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-amazon-s3-encryption-client-python-${{ github.run_id }}-${{ github.run_attempt }}
     permissions:
       id-token: write
       contents: read
@@ -143,6 +144,7 @@ jobs:
     name: Publish to PyPI
     needs: [determine-version, validate-testpypi]
     if: needs.determine-version.outputs.version != ''
+    # pypa/gh-action-pypi-publish is a Docker container action.
     runs-on: ubuntu-latest
     environment: pypi
     permissions:
@@ -158,7 +160,7 @@ jobs:
     name: Validate PyPI Package
     needs: [determine-version, publish-pypi]
     if: needs.determine-version.outputs.version != ''
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-amazon-s3-encryption-client-python-${{ github.run_id }}-${{ github.run_attempt }}
     permissions:
       id-token: write
       contents: read
@@ -196,7 +198,7 @@ jobs:
     name: Create GitHub Release
     if: ${{ !inputs.dry_run && needs.determine-version.outputs.version != '' }}
     needs: [determine-version, validate-pypi]
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-amazon-s3-encryption-client-python-${{ github.run_id }}-${{ github.run_attempt }}
     permissions:
       contents: write
     steps:

From 1aa35ed933dda5cd6691dbdf0c866f7684b245bc Mon Sep 17 00:00:00 2001
From: Lucas McDonald <lucmcdon@amazon.com>
Date: Thu, 8 Oct 2026 16:25:32 +0000
Subject: [PATCH 2/5] ci: keep release, benchmark, and maintenance workflows on
 GitHub-hosted runners

---
 .github/workflows/python-perf.yml |  6 +++---
 .github/workflows/release.yml     | 12 +++++-------
 2 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/python-perf.yml b/.github/workflows/python-perf.yml
index 1c09efdc..38bddb56 100644
--- a/.github/workflows/python-perf.yml
+++ b/.github/workflows/python-perf.yml
@@ -11,7 +11,7 @@ on:
 
 jobs:
   python-perf:
-    runs-on: codebuild-CryptoToolsCI-linux-amazon-s3-encryption-client-python-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-latest
     permissions:
       id-token: write
       contents: read
@@ -31,9 +31,9 @@ jobs:
         uses: actions/cache@v5
         with:
           path: ~/.cache/uv
-          key: ${{ runner.os == 'Linux' && 'cb-' || '' }}${{ runner.os }}-uv-${{ hashFiles('**/pyproject.toml') }}
+          key: ${{ runner.os }}-uv-${{ hashFiles('**/pyproject.toml') }}
           restore-keys: |
-            ${{ runner.os == 'Linux' && 'cb-' || '' }}${{ runner.os }}-uv-
+            ${{ runner.os }}-uv-
 
       - name: Install Uv
         run: pip install uv
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c1977585..f92c07ff 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,7 +16,7 @@ on:
 jobs:
   determine-version:
     name: Determine Version
-    runs-on: codebuild-CryptoToolsCI-linux-amazon-s3-encryption-client-python-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-latest
     permissions:
       contents: write
     outputs:
@@ -65,7 +65,7 @@ jobs:
     name: Build Package
     needs: [determine-version, test]
     if: needs.determine-version.outputs.version != ''
-    runs-on: codebuild-CryptoToolsCI-linux-amazon-s3-encryption-client-python-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
@@ -87,7 +87,6 @@ jobs:
     name: Publish to TestPyPI
     if: ${{ !inputs.dry_run && needs.determine-version.outputs.version != '' }}
     needs: [determine-version, build]
-    # pypa/gh-action-pypi-publish is a Docker container action.
     runs-on: ubuntu-latest
     environment: testpypi
     permissions:
@@ -106,7 +105,7 @@ jobs:
     name: Validate TestPyPI Package
     needs: [determine-version, publish-testpypi]
     if: needs.determine-version.outputs.version != ''
-    runs-on: codebuild-CryptoToolsCI-linux-amazon-s3-encryption-client-python-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-latest
     permissions:
       id-token: write
       contents: read
@@ -144,7 +143,6 @@ jobs:
     name: Publish to PyPI
     needs: [determine-version, validate-testpypi]
     if: needs.determine-version.outputs.version != ''
-    # pypa/gh-action-pypi-publish is a Docker container action.
     runs-on: ubuntu-latest
     environment: pypi
     permissions:
@@ -160,7 +158,7 @@ jobs:
     name: Validate PyPI Package
     needs: [determine-version, publish-pypi]
     if: needs.determine-version.outputs.version != ''
-    runs-on: codebuild-CryptoToolsCI-linux-amazon-s3-encryption-client-python-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-latest
     permissions:
       id-token: write
       contents: read
@@ -198,7 +196,7 @@ jobs:
     name: Create GitHub Release
     if: ${{ !inputs.dry_run && needs.determine-version.outputs.version != '' }}
     needs: [determine-version, validate-pypi]
-    runs-on: codebuild-CryptoToolsCI-linux-amazon-s3-encryption-client-python-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-latest
     permissions:
       contents: write
     steps:

From fe205a01041bdce447d09fdbf8b6a3e77aea3ae9 Mon Sep 17 00:00:00 2001
From: Lucas McDonald <lucmcdon@amazon.com>
Date: Thu, 8 Oct 2026 16:30:48 +0000
Subject: [PATCH 3/5] ci: run benchmark and maintenance workflows on
 CodeBuild-hosted runners

---
 .github/workflows/python-perf.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/python-perf.yml b/.github/workflows/python-perf.yml
index 38bddb56..1c09efdc 100644
--- a/.github/workflows/python-perf.yml
+++ b/.github/workflows/python-perf.yml
@@ -11,7 +11,7 @@ on:
 
 jobs:
   python-perf:
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-amazon-s3-encryption-client-python-${{ github.run_id }}-${{ github.run_attempt }}
     permissions:
       id-token: write
       contents: read
@@ -31,9 +31,9 @@ jobs:
         uses: actions/cache@v5
         with:
           path: ~/.cache/uv
-          key: ${{ runner.os }}-uv-${{ hashFiles('**/pyproject.toml') }}
+          key: ${{ runner.os == 'Linux' && 'cb-' || '' }}${{ runner.os }}-uv-${{ hashFiles('**/pyproject.toml') }}
           restore-keys: |
-            ${{ runner.os }}-uv-
+            ${{ runner.os == 'Linux' && 'cb-' || '' }}${{ runner.os }}-uv-
 
       - name: Install Uv
         run: pip install uv

From 087d1974a4ee46ec28d9705b86e8c20637f08dc7 Mon Sep 17 00:00:00 2001
From: Lucas McDonald <lucmcdon@amazon.com>
Date: Thu, 29 Oct 2026 20:22:02 +0000
Subject: [PATCH 4/5] ci: move the remaining Linux jobs to CodeBuild

---
 .github/workflows/release.yml | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f92c07ff..108ecae6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,7 +16,7 @@ on:
 jobs:
   determine-version:
     name: Determine Version
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-amazon-s3-encryption-client-python-${{ github.run_id }}-${{ github.run_attempt }}
     permissions:
       contents: write
     outputs:
@@ -65,7 +65,7 @@ jobs:
     name: Build Package
     needs: [determine-version, test]
     if: needs.determine-version.outputs.version != ''
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-amazon-s3-encryption-client-python-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
@@ -87,7 +87,7 @@ jobs:
     name: Publish to TestPyPI
     if: ${{ !inputs.dry_run && needs.determine-version.outputs.version != '' }}
     needs: [determine-version, build]
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-amazon-s3-encryption-client-python-${{ github.run_id }}-${{ github.run_attempt }}
     environment: testpypi
     permissions:
       id-token: write
@@ -105,7 +105,7 @@ jobs:
     name: Validate TestPyPI Package
     needs: [determine-version, publish-testpypi]
     if: needs.determine-version.outputs.version != ''
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-amazon-s3-encryption-client-python-${{ github.run_id }}-${{ github.run_attempt }}
     permissions:
       id-token: write
       contents: read
@@ -143,7 +143,7 @@ jobs:
     name: Publish to PyPI
     needs: [determine-version, validate-testpypi]
     if: needs.determine-version.outputs.version != ''
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-amazon-s3-encryption-client-python-${{ github.run_id }}-${{ github.run_attempt }}
     environment: pypi
     permissions:
       id-token: write
@@ -158,7 +158,7 @@ jobs:
     name: Validate PyPI Package
     needs: [determine-version, publish-pypi]
     if: needs.determine-version.outputs.version != ''
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-amazon-s3-encryption-client-python-${{ github.run_id }}-${{ github.run_attempt }}
     permissions:
       id-token: write
       contents: read
@@ -196,7 +196,7 @@ jobs:
     name: Create GitHub Release
     if: ${{ !inputs.dry_run && needs.determine-version.outputs.version != '' }}
     needs: [determine-version, validate-pypi]
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-amazon-s3-encryption-client-python-${{ github.run_id }}-${{ github.run_attempt }}
     permissions:
       contents: write
     steps:

From facb03e8a716e9663a83e557ec3271e2b897e031 Mon Sep 17 00:00:00 2001
From: Lucas McDonald <lucmcdon@amazon.com>
Date: Thu, 29 Oct 2026 20:27:20 +0000
Subject: [PATCH 5/5] ci: write the CodeBuild runner label once per file

---
 .github/workflows/release.yml | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 108ecae6..e6093aef 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,7 +16,7 @@ on:
 jobs:
   determine-version:
     name: Determine Version
-    runs-on: codebuild-CryptoToolsCI-linux-amazon-s3-encryption-client-python-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: &codebuild-linux codebuild-CryptoToolsCI-linux-amazon-s3-encryption-client-python-${{ github.run_id }}-${{ github.run_attempt }}
     permissions:
       contents: write
     outputs:
@@ -65,7 +65,7 @@ jobs:
     name: Build Package
     needs: [determine-version, test]
     if: needs.determine-version.outputs.version != ''
-    runs-on: codebuild-CryptoToolsCI-linux-amazon-s3-encryption-client-python-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: *codebuild-linux
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
@@ -87,7 +87,7 @@ jobs:
     name: Publish to TestPyPI
     if: ${{ !inputs.dry_run && needs.determine-version.outputs.version != '' }}
     needs: [determine-version, build]
-    runs-on: codebuild-CryptoToolsCI-linux-amazon-s3-encryption-client-python-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: *codebuild-linux
     environment: testpypi
     permissions:
       id-token: write
@@ -105,7 +105,7 @@ jobs:
     name: Validate TestPyPI Package
     needs: [determine-version, publish-testpypi]
     if: needs.determine-version.outputs.version != ''
-    runs-on: codebuild-CryptoToolsCI-linux-amazon-s3-encryption-client-python-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: *codebuild-linux
     permissions:
       id-token: write
       contents: read
@@ -143,7 +143,7 @@ jobs:
     name: Publish to PyPI
     needs: [determine-version, validate-testpypi]
     if: needs.determine-version.outputs.version != ''
-    runs-on: codebuild-CryptoToolsCI-linux-amazon-s3-encryption-client-python-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: *codebuild-linux
     environment: pypi
     permissions:
       id-token: write
@@ -158,7 +158,7 @@ jobs:
     name: Validate PyPI Package
     needs: [determine-version, publish-pypi]
     if: needs.determine-version.outputs.version != ''
-    runs-on: codebuild-CryptoToolsCI-linux-amazon-s3-encryption-client-python-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: *codebuild-linux
     permissions:
       id-token: write
       contents: read
@@ -196,7 +196,7 @@ jobs:
     name: Create GitHub Release
     if: ${{ !inputs.dry_run && needs.determine-version.outputs.version != '' }}
     needs: [determine-version, validate-pypi]
-    runs-on: codebuild-CryptoToolsCI-linux-amazon-s3-encryption-client-python-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: *codebuild-linux
     permissions:
       contents: write
     steps: