From 8f44e1b1c63352f1978bd2608059ea7d7ab049c1 Mon Sep 17 00:00:00 2001
From: Lucas McDonald <lucmcdon@amazon.com>
Date: Thu, 8 Oct 2026 00:32:21 +0000
Subject: [PATCH 01/10] ci: run Linux CI on CodeBuild-hosted runners

---
 .github/workflows/ci_integration.yml      | 4 ++--
 .github/workflows/ci_static-analysis.yaml | 2 +-
 .github/workflows/ci_tests.yaml           | 8 ++++++--
 .github/workflows/pull.yml                | 2 +-
 .github/workflows/repo-sync.yml           | 1 +
 5 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci_integration.yml b/.github/workflows/ci_integration.yml
index 38cab2b6..d656606c 100644
--- a/.github/workflows/ci_integration.yml
+++ b/.github/workflows/ci_integration.yml
@@ -9,7 +9,7 @@ on:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-aws-dynamodb-encryption-python-${{ github.run_id }}-${{ github.run_attempt }}
     strategy:
       fail-fast: false
       matrix:
@@ -65,7 +65,7 @@ jobs:
         run: tox
 
   coverage:
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-aws-dynamodb-encryption-python-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
       - uses: actions/checkout@v4
       
diff --git a/.github/workflows/ci_static-analysis.yaml b/.github/workflows/ci_static-analysis.yaml
index 1dd67a65..6d0b428e 100644
--- a/.github/workflows/ci_static-analysis.yaml
+++ b/.github/workflows/ci_static-analysis.yaml
@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   analysis:
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-aws-dynamodb-encryption-python-${{ github.run_id }}-${{ github.run_attempt }}
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/ci_tests.yaml b/.github/workflows/ci_tests.yaml
index 06e8ce5e..5f7be9b6 100644
--- a/.github/workflows/ci_tests.yaml
+++ b/.github/workflows/ci_tests.yaml
@@ -12,19 +12,23 @@ permissions:
 
 jobs:
   tests:
-    runs-on: ${{ matrix.platform.os }}
+    runs-on: ${{ matrix.platform.runner }}
     strategy:
       fail-fast: true
       matrix:
         platform:
           - os: ubuntu-latest
+            runner: codebuild-CryptoToolsCI-linux-aws-dynamodb-encryption-python-${{ github.run_id }}-${{ github.run_attempt }}
             architecture: x64
           - os: windows-latest
+            runner: windows-latest
             architecture: x64
           # x86 builds are only meaningful for Windows
           - os: windows-latest
+            runner: windows-latest
             architecture: x86
           - os: macos-latest
+            runner: macos-latest
             architecture: x64
         python:
           - 3.8
@@ -66,7 +70,7 @@ jobs:
         run: tox -- -vv
 
   upstream-py311:
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-aws-dynamodb-encryption-python-${{ github.run_id }}-${{ github.run_attempt }}
     strategy:
       fail-fast: true
       matrix:
diff --git a/.github/workflows/pull.yml b/.github/workflows/pull.yml
index f13598b9..1c00217e 100644
--- a/.github/workflows/pull.yml
+++ b/.github/workflows/pull.yml
@@ -23,7 +23,7 @@ jobs:
       - call-integration-tests
       - call-static-analysis
       - call-tests
-    runs-on: ubuntu-22.04
+    runs-on: codebuild-CryptoToolsCI-linux-aws-dynamodb-encryption-python-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
       - name: Verify all required jobs passed
         uses: re-actors/alls-green@release/v1
diff --git a/.github/workflows/repo-sync.yml b/.github/workflows/repo-sync.yml
index cf250b94..51a4ba85 100644
--- a/.github/workflows/repo-sync.yml
+++ b/.github/workflows/repo-sync.yml
@@ -11,6 +11,7 @@ jobs:
   repo-sync:
     name: Repo Sync
     environment: repo-sync
+    # repo-sync actions are Docker container actions.
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4

From 7bb5ce2e4fe22e8591f4f79da7fc7ca78a8c50df Mon Sep 17 00:00:00 2001
From: Lucas McDonald <lucmcdon@amazon.com>
Date: Thu, 8 Oct 2026 01:16:00 +0000
Subject: [PATCH 02/10] ci: keep test job names unchanged on CodeBuild runners

---
 .github/workflows/ci_tests.yaml | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/.github/workflows/ci_tests.yaml b/.github/workflows/ci_tests.yaml
index 5f7be9b6..ecdb55d1 100644
--- a/.github/workflows/ci_tests.yaml
+++ b/.github/workflows/ci_tests.yaml
@@ -12,23 +12,19 @@ permissions:
 
 jobs:
   tests:
-    runs-on: ${{ matrix.platform.runner }}
+    runs-on: ${{ matrix.platform.os == 'ubuntu-latest' && format('codebuild-CryptoToolsCI-linux-aws-dynamodb-encryption-python-{0}-{1}', github.run_id, github.run_attempt) || matrix.platform.os }}
     strategy:
       fail-fast: true
       matrix:
         platform:
           - os: ubuntu-latest
-            runner: codebuild-CryptoToolsCI-linux-aws-dynamodb-encryption-python-${{ github.run_id }}-${{ github.run_attempt }}
             architecture: x64
           - os: windows-latest
-            runner: windows-latest
             architecture: x64
           # x86 builds are only meaningful for Windows
           - os: windows-latest
-            runner: windows-latest
             architecture: x86
           - os: macos-latest
-            runner: macos-latest
             architecture: x64
         python:
           - 3.8

From b2334582d190b8d1f57172e7b9916a6128886438 Mon Sep 17 00:00:00 2001
From: Lucas McDonald <lucmcdon@amazon.com>
Date: Thu, 8 Oct 2026 17:11:12 +0000
Subject: [PATCH 03/10] ci: run tox in UTF-8 mode

---
 .github/workflows/ci_tests.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/ci_tests.yaml b/.github/workflows/ci_tests.yaml
index ecdb55d1..164987c7 100644
--- a/.github/workflows/ci_tests.yaml
+++ b/.github/workflows/ci_tests.yaml
@@ -63,6 +63,8 @@ jobs:
       - name: run test
         env:
           TOXENV: ${{ matrix.category }}
+          # tox reads pip's output as UTF-8; Windows writes it in the console code page otherwise.
+          PYTHONUTF8: "1"
         run: tox -- -vv
 
   upstream-py311:
@@ -85,4 +87,6 @@ jobs:
       - name: run test
         env:
           TOXENV: ${{ matrix.category }}
+          # tox reads pip's output as UTF-8; Windows writes it in the console code page otherwise.
+          PYTHONUTF8: "1"
         run: tox -- -vv

From 821bcac4f97eb807b56dd297918b696d30d3c098 Mon Sep 17 00:00:00 2001
From: Lucas McDonald <lucmcdon@amazon.com>
Date: Thu, 8 Oct 2026 17:18:43 +0000
Subject: [PATCH 04/10] ci: drop the 32-bit Windows test matrix entry

---
 .github/workflows/ci_tests.yaml | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/.github/workflows/ci_tests.yaml b/.github/workflows/ci_tests.yaml
index 164987c7..2e31bbf4 100644
--- a/.github/workflows/ci_tests.yaml
+++ b/.github/workflows/ci_tests.yaml
@@ -21,9 +21,6 @@ jobs:
             architecture: x64
           - os: windows-latest
             architecture: x64
-          # x86 builds are only meaningful for Windows
-          - os: windows-latest
-            architecture: x86
           - os: macos-latest
             architecture: x64
         python:

From b032b4e07a584bc6ff1e16187772afa247ae793d Mon Sep 17 00:00:00 2001
From: Lucas McDonald <lucmcdon@amazon.com>
Date: Thu, 8 Oct 2026 18:42:56 +0000
Subject: [PATCH 05/10] ci: run the Docker-based CI jobs on CodeBuild-hosted
 runners

---
 .github/workflows/repo-sync.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/repo-sync.yml b/.github/workflows/repo-sync.yml
index 51a4ba85..cf250b94 100644
--- a/.github/workflows/repo-sync.yml
+++ b/.github/workflows/repo-sync.yml
@@ -11,7 +11,6 @@ jobs:
   repo-sync:
     name: Repo Sync
     environment: repo-sync
-    # repo-sync actions are Docker container actions.
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4

From 3227eefd266667ab5d22496a41e473fe14bc842f Mon Sep 17 00:00:00 2001
From: Lucas McDonald <lucmcdon@amazon.com>
Date: Thu, 29 Oct 2026 19:50:56 +0000
Subject: [PATCH 06/10] ci: run macOS and Windows outside pr-ci-all-required

---
 .github/workflows/ci_tests.yaml | 17 ++++++++++-------
 .github/workflows/pull.yml      |  8 ++++++++
 2 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci_tests.yaml b/.github/workflows/ci_tests.yaml
index 2e31bbf4..5cb7f7f3 100644
--- a/.github/workflows/ci_tests.yaml
+++ b/.github/workflows/ci_tests.yaml
@@ -3,6 +3,14 @@ name: tests
 
 on:
   workflow_call:
+    inputs:
+      platforms:
+        type: string
+        required: false
+      upstream:
+        type: boolean
+        required: false
+        default: true
   # Keep the schedule to maintain daily runs
   schedule:
     - cron: '0 0 * * *'
@@ -16,13 +24,7 @@ jobs:
     strategy:
       fail-fast: true
       matrix:
-        platform:
-          - os: ubuntu-latest
-            architecture: x64
-          - os: windows-latest
-            architecture: x64
-          - os: macos-latest
-            architecture: x64
+        platform: ${{ fromJSON(inputs.platforms || '[{"os":"ubuntu-latest","architecture":"x64"},{"os":"windows-latest","architecture":"x64"},{"os":"macos-latest","architecture":"x64"}]') }}
         python:
           - 3.8
           - 3.9
@@ -65,6 +67,7 @@ jobs:
         run: tox -- -vv
 
   upstream-py311:
+    if: inputs.upstream != false
     runs-on: codebuild-CryptoToolsCI-linux-aws-dynamodb-encryption-python-${{ github.run_id }}-${{ github.run_attempt }}
     strategy:
       fail-fast: true
diff --git a/.github/workflows/pull.yml b/.github/workflows/pull.yml
index 1c00217e..10d13fef 100644
--- a/.github/workflows/pull.yml
+++ b/.github/workflows/pull.yml
@@ -17,6 +17,14 @@ jobs:
   call-tests:
     name: Run Tests
     uses: ./.github/workflows/ci_tests.yaml
+    with:
+      platforms: '[{"os":"ubuntu-latest","architecture":"x64"}]'
+  call-tests-macos-windows:
+    name: Run Tests (macOS, Windows)
+    uses: ./.github/workflows/ci_tests.yaml
+    with:
+      platforms: '[{"os":"windows-latest","architecture":"x64"},{"os":"macos-latest","architecture":"x64"}]'
+      upstream: false
   pr-ci-all-required:
     if: always()
     needs:

From e84e8a181e8a61cfbc4553e4094b93c475212059 Mon Sep 17 00:00:00 2001
From: Lucas McDonald <lucmcdon@amazon.com>
Date: Thu, 29 Oct 2026 20:14:24 +0000
Subject: [PATCH 07/10] ci: give each matrix platform its own runner

---
 .github/workflows/ci_tests.yaml | 8 ++++++--
 .github/workflows/pull.yml      | 7 +++++--
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci_tests.yaml b/.github/workflows/ci_tests.yaml
index 5cb7f7f3..95401a03 100644
--- a/.github/workflows/ci_tests.yaml
+++ b/.github/workflows/ci_tests.yaml
@@ -7,6 +7,10 @@ on:
       platforms:
         type: string
         required: false
+        default: >-
+          [{"os": "ubuntu-latest", "architecture": "x64", "runner": "codebuild-CryptoToolsCI-linux-aws-dynamodb-encryption-python-${{ github.run_id }}-${{ github.run_attempt }}"},
+           {"os": "windows-latest", "architecture": "x64", "runner": "windows-latest"},
+           {"os": "macos-latest", "architecture": "x64", "runner": "macos-latest"}]
       upstream:
         type: boolean
         required: false
@@ -20,11 +24,11 @@ permissions:
 
 jobs:
   tests:
-    runs-on: ${{ matrix.platform.os == 'ubuntu-latest' && format('codebuild-CryptoToolsCI-linux-aws-dynamodb-encryption-python-{0}-{1}', github.run_id, github.run_attempt) || matrix.platform.os }}
+    runs-on: ${{ matrix.platform.runner }}
     strategy:
       fail-fast: true
       matrix:
-        platform: ${{ fromJSON(inputs.platforms || '[{"os":"ubuntu-latest","architecture":"x64"},{"os":"windows-latest","architecture":"x64"},{"os":"macos-latest","architecture":"x64"}]') }}
+        platform: ${{ fromJSON(inputs.platforms || format('[{{"os":"ubuntu-latest","architecture":"x64","runner":"codebuild-CryptoToolsCI-linux-aws-dynamodb-encryption-python-{0}-{1}"}},{{"os":"windows-latest","architecture":"x64","runner":"windows-latest"}},{{"os":"macos-latest","architecture":"x64","runner":"macos-latest"}}]', github.run_id, github.run_attempt)) }}
         python:
           - 3.8
           - 3.9
diff --git a/.github/workflows/pull.yml b/.github/workflows/pull.yml
index 10d13fef..4254ad7c 100644
--- a/.github/workflows/pull.yml
+++ b/.github/workflows/pull.yml
@@ -18,12 +18,15 @@ jobs:
     name: Run Tests
     uses: ./.github/workflows/ci_tests.yaml
     with:
-      platforms: '[{"os":"ubuntu-latest","architecture":"x64"}]'
+      platforms: >-
+        [{"os": "ubuntu-latest", "architecture": "x64", "runner": "codebuild-CryptoToolsCI-linux-aws-dynamodb-encryption-python-${{ github.run_id }}-${{ github.run_attempt }}"}]
   call-tests-macos-windows:
     name: Run Tests (macOS, Windows)
     uses: ./.github/workflows/ci_tests.yaml
     with:
-      platforms: '[{"os":"windows-latest","architecture":"x64"},{"os":"macos-latest","architecture":"x64"}]'
+      platforms: >-
+        [{"os": "windows-latest", "architecture": "x64", "runner": "windows-latest"},
+         {"os": "macos-latest", "architecture": "x64", "runner": "macos-latest"}]
       upstream: false
   pr-ci-all-required:
     if: always()

From c392285b2100bd9e989e6e66665e5a8435862db8 Mon Sep 17 00:00:00 2001
From: Lucas McDonald <lucmcdon@amazon.com>
Date: Thu, 29 Oct 2026 20:17:48 +0000
Subject: [PATCH 08/10] ci: run the daily tests from their own caller

---
 .github/workflows/ci_tests.yaml |  5 +----
 .github/workflows/daily_ci.yml  | 14 ++++++++++++++
 2 files changed, 15 insertions(+), 4 deletions(-)
 create mode 100644 .github/workflows/daily_ci.yml

diff --git a/.github/workflows/ci_tests.yaml b/.github/workflows/ci_tests.yaml
index 95401a03..2ab8e87e 100644
--- a/.github/workflows/ci_tests.yaml
+++ b/.github/workflows/ci_tests.yaml
@@ -15,9 +15,6 @@ on:
         type: boolean
         required: false
         default: true
-  # Keep the schedule to maintain daily runs
-  schedule:
-    - cron: '0 0 * * *'
 
 permissions:
   contents: read
@@ -28,7 +25,7 @@ jobs:
     strategy:
       fail-fast: true
       matrix:
-        platform: ${{ fromJSON(inputs.platforms || format('[{{"os":"ubuntu-latest","architecture":"x64","runner":"codebuild-CryptoToolsCI-linux-aws-dynamodb-encryption-python-{0}-{1}"}},{{"os":"windows-latest","architecture":"x64","runner":"windows-latest"}},{{"os":"macos-latest","architecture":"x64","runner":"macos-latest"}}]', github.run_id, github.run_attempt)) }}
+        platform: ${{ fromJSON(inputs.platforms) }}
         python:
           - 3.8
           - 3.9
diff --git a/.github/workflows/daily_ci.yml b/.github/workflows/daily_ci.yml
new file mode 100644
index 00000000..bd91f8c1
--- /dev/null
+++ b/.github/workflows/daily_ci.yml
@@ -0,0 +1,14 @@
+name: Daily CI
+
+on:
+  # Keep the schedule to maintain daily runs
+  schedule:
+    - cron: '0 0 * * *'
+
+permissions:
+  contents: read
+
+jobs:
+  call-tests:
+    name: Run Tests
+    uses: ./.github/workflows/ci_tests.yaml

From 42cd20f7ca21a7fcc45d4d6cb31a3e5a56f1dffd Mon Sep 17 00:00:00 2001
From: Lucas McDonald <lucmcdon@amazon.com>
Date: Thu, 29 Oct 2026 20:22:53 +0000
Subject: [PATCH 09/10] ci: move the remaining Linux jobs to CodeBuild

---
 .github/workflows/repo-sync.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/repo-sync.yml b/.github/workflows/repo-sync.yml
index cf250b94..3c52486e 100644
--- a/.github/workflows/repo-sync.yml
+++ b/.github/workflows/repo-sync.yml
@@ -11,7 +11,7 @@ jobs:
   repo-sync:
     name: Repo Sync
     environment: repo-sync
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-aws-dynamodb-encryption-python-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
     - uses: actions/checkout@v4
     - uses: repo-sync/github-sync@v2

From 0df12a53ea14a58f2f3c8f1d4a245d4e9c302ec8 Mon Sep 17 00:00:00 2001
From: Lucas McDonald <lucmcdon@amazon.com>
Date: Thu, 29 Oct 2026 20:27:20 +0000
Subject: [PATCH 10/10] ci: write the CodeBuild runner label once per file

---
 .github/workflows/ci_integration.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci_integration.yml b/.github/workflows/ci_integration.yml
index d656606c..582e21bb 100644
--- a/.github/workflows/ci_integration.yml
+++ b/.github/workflows/ci_integration.yml
@@ -9,7 +9,7 @@ on:
 
 jobs:
   test:
-    runs-on: codebuild-CryptoToolsCI-linux-aws-dynamodb-encryption-python-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: &codebuild-linux codebuild-CryptoToolsCI-linux-aws-dynamodb-encryption-python-${{ github.run_id }}-${{ github.run_attempt }}
     strategy:
       fail-fast: false
       matrix:
@@ -65,7 +65,7 @@ jobs:
         run: tox
 
   coverage:
-    runs-on: codebuild-CryptoToolsCI-linux-aws-dynamodb-encryption-python-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: *codebuild-linux
     steps:
       - uses: actions/checkout@v4