ci: run Linux CI on CodeBuild-hosted runners

.github/workflows/ci_integration.yml

@@ -9,7 +9,7 @@
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: &codebuild-linux codebuild-CryptoToolsCI-linux-aws-dynamodb-encryption-python-${{ github.run_id }}-${{ github.run_attempt }}
     strategy:
       fail-fast: false
       matrix:
@@ -65,22 +65,22 @@
         run: tox
 
   coverage:
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - uses: actions/checkout@v4
 
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
           python-version: '3.13'
 
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
           pip install "tox < 4.0"  
           pip install setuptools
 
       - name: Run coverage
         env:
           TOXENV: coverage
         run: tox

.github/workflows/ci_static-analysis.yaml

@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   analysis:
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-aws-dynamodb-encryption-python-${{ github.run_id }}-${{ github.run_attempt }}
     strategy:
       fail-fast: false
       matrix:

.github/workflows/ci_tests.yaml

@@ -3,29 +3,29 @@ name: tests
 
 on:
   workflow_call:
-  # Keep the schedule to maintain daily runs
-  schedule:
-    - cron: '0 0 * * *'
+    inputs:
+      platforms:
+        type: string
+        required: false
+        default: >-
+          [{"os": "ubuntu-latest", "architecture": "x64", "runner": "codebuild-CryptoToolsCI-linux-aws-dynamodb-encryption-python-${{ github.run_id }}-${{ github.run_attempt }}"},
+           {"os": "windows-latest", "architecture": "x64", "runner": "windows-latest"},
+           {"os": "macos-latest", "architecture": "x64", "runner": "macos-latest"}]
+      upstream:
+        type: boolean
+        required: false
+        default: true
 
 permissions:
   contents: read
 
 jobs:
   tests:
-    runs-on: ${{ matrix.platform.os }}
+    runs-on: ${{ matrix.platform.runner }}
     strategy:
       fail-fast: true
       matrix:
-        platform:
-          - os: ubuntu-latest
-            architecture: x64
-          - os: windows-latest
-            architecture: x64
-          # x86 builds are only meaningful for Windows
-          - os: windows-latest
-            architecture: x86
-          - os: macos-latest
-            architecture: x64
+        platform: ${{ fromJSON(inputs.platforms) }}
         python:
           - 3.8
           - 3.9
@@ -63,10 +63,13 @@ jobs:
       - name: run test
         env:
           TOXENV: ${{ matrix.category }}
+          # tox reads pip's output as UTF-8; Windows writes it in the console code page otherwise.
+          PYTHONUTF8: "1"
         run: tox -- -vv
 
   upstream-py311:
-    runs-on: ubuntu-latest
+    if: inputs.upstream != false
+    runs-on: codebuild-CryptoToolsCI-linux-aws-dynamodb-encryption-python-${{ github.run_id }}-${{ github.run_attempt }}
     strategy:
       fail-fast: true
       matrix:
@@ -85,4 +88,6 @@ jobs:
       - name: run test
         env:
           TOXENV: ${{ matrix.category }}
+          # tox reads pip's output as UTF-8; Windows writes it in the console code page otherwise.
+          PYTHONUTF8: "1"
         run: tox -- -vv

.github/workflows/daily_ci.yml

@@ -0,0 +1,14 @@
+name: Daily CI
+
+on:
+  # Keep the schedule to maintain daily runs
+  schedule:
+    - cron: '0 0 * * *'
+
+permissions:
+  contents: read
+
+jobs:
+  call-tests:
+    name: Run Tests
+    uses: ./.github/workflows/ci_tests.yaml

.github/workflows/pull.yml

@@ -17,13 +17,24 @@ jobs:
   call-tests:
     name: Run Tests
     uses: ./.github/workflows/ci_tests.yaml
+    with:
+      platforms: >-
+        [{"os": "ubuntu-latest", "architecture": "x64", "runner": "codebuild-CryptoToolsCI-linux-aws-dynamodb-encryption-python-${{ github.run_id }}-${{ github.run_attempt }}"}]
+  call-tests-macos-windows:
+    name: Run Tests (macOS, Windows)
+    uses: ./.github/workflows/ci_tests.yaml
+    with:
+      platforms: >-
+        [{"os": "windows-latest", "architecture": "x64", "runner": "windows-latest"},
+         {"os": "macos-latest", "architecture": "x64", "runner": "macos-latest"}]
+      upstream: false
   pr-ci-all-required:
     if: always()
     needs:
       - call-integration-tests
       - call-static-analysis
       - call-tests
-    runs-on: ubuntu-22.04
+    runs-on: codebuild-CryptoToolsCI-linux-aws-dynamodb-encryption-python-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
       - name: Verify all required jobs passed
         uses: re-actors/alls-green@release/v1

.github/workflows/repo-sync.yml

@@ -11,7 +11,7 @@ jobs:
   repo-sync:
     name: Repo Sync
     environment: repo-sync
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-aws-dynamodb-encryption-python-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
     - uses: actions/checkout@v4
     - uses: repo-sync/github-sync@v2