diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8b51542b8..b35e59b65 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -13,7 +13,7 @@ jobs: if: always() needs: - shared-ci - runs-on: ubuntu-22.04 + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-javascript-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Verify all required jobs passed uses: re-actors/alls-green@release/v1 diff --git a/.github/workflows/ci_static-analysis.yaml b/.github/workflows/ci_static-analysis.yaml index eb05c10b5..937ab0cf6 100644 --- a/.github/workflows/ci_static-analysis.yaml +++ b/.github/workflows/ci_static-analysis.yaml @@ -8,7 +8,7 @@ permissions: jobs: not-grep: - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-javascript-${{ github.run_id }}-${{ github.run_attempt }} steps: - uses: actions/checkout@v2 - name: not-grep diff --git a/.github/workflows/prod-release.yml b/.github/workflows/prod-release.yml index 88d4d9ce1..5e119166e 100644 --- a/.github/workflows/prod-release.yml +++ b/.github/workflows/prod-release.yml @@ -24,7 +24,7 @@ jobs: # Once all tests have passed, run semantic versioning version: - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-javascript-${{ github.run_id }}-${{ github.run_attempt }} needs: [pre-release-ci] environment: release steps: @@ -48,7 +48,7 @@ jobs: cache: 'npm' - name: Install dependencies - run: npm ci --unsafe-perm + run: npm ci - name: Configure AWS Credentials for Release uses: aws-actions/configure-aws-credentials@v5 diff --git a/.github/workflows/repo-sync.yml b/.github/workflows/repo-sync.yml index a55d58b84..f7c1fff80 100644 --- a/.github/workflows/repo-sync.yml +++ b/.github/workflows/repo-sync.yml @@ -11,7 +11,7 @@ jobs: repo-sync: name: Repo Sync environment: repo-sync - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-javascript-${{ github.run_id }}-${{ github.run_attempt }} steps: - uses: actions/checkout@v2 - uses: repo-sync/github-sync@v2 diff --git a/.github/workflows/shared-ci.yml b/.github/workflows/shared-ci.yml index aa43e1825..3ba858173 100644 --- a/.github/workflows/shared-ci.yml +++ b/.github/workflows/shared-ci.yml @@ -20,14 +20,14 @@ env: jobs: test: - runs-on: ubuntu-latest + runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-javascript-${{ github.run_id }}-${{ github.run_attempt }} permissions: id-token: write contents: read strategy: fail-fast: false matrix: - node-version: ['22.x', '24.x', 'latest'] + node-version: ['22.x', '24.x', '*'] test-type: ['node', 'browser'] # Determine test categories based on whether testing published packages or source code: # - Testing published packages: only run vector tests (don't have build artifacts to test coverage or compliance) @@ -57,7 +57,7 @@ jobs: role-session-name: JavaScriptTests - name: Install dependencies - run: npm ci --unsafe-perm + run: npm ci - name: Build (for source code testing) if: ${{ !inputs.test-published-packages }} diff --git a/modules/decrypt-node/test/decrypt.test.ts b/modules/decrypt-node/test/decrypt.test.ts index d8e635c39..9b3b85ead 100644 --- a/modules/decrypt-node/test/decrypt.test.ts +++ b/modules/decrypt-node/test/decrypt.test.ts @@ -277,7 +277,10 @@ describe('decrypt', () => { decrypt(hkeyring, ciphertext, { encoding: 'base64', }) - ).to.rejectedWith(Error, 'Unsupported state or unable to authenticate data') + ).to.rejectedWith( + Error, + /Unsupported state or unable to authenticate data|bad decrypt/ + ) }) it('will decrypt ciphertext with high utf8 codepoints with a keyring configured to do utf8 sorting', async () => { diff --git a/modules/integration-browser/karma.conf.js b/modules/integration-browser/karma.conf.js index 61e1c7140..92509c012 100644 --- a/modules/integration-browser/karma.conf.js +++ b/modules/integration-browser/karma.conf.js @@ -58,6 +58,11 @@ module.exports = function (config) { new webpack.ProvidePlugin({ Buffer: ['buffer', 'Buffer'], }), + { + apply(compiler) { + compiler.options.optimization.sideEffects = false + }, + }, ], devtool: 'inline-source-map', resolve: { diff --git a/modules/kms-keyring-node/test/kms_hkeyring_node.edk-order.test.ts b/modules/kms-keyring-node/test/kms_hkeyring_node.edk-order.test.ts index d8d059818..d10f8f5e2 100644 --- a/modules/kms-keyring-node/test/kms_hkeyring_node.edk-order.test.ts +++ b/modules/kms-keyring-node/test/kms_hkeyring_node.edk-order.test.ts @@ -254,7 +254,7 @@ describe('KmsHierarchicalKeyRingNode: decrypt EDK order', () => { `Error #1 \n Error: The encrypted data key ciphertext must be ${ciphertextLength} bytes long`, 'Error #2 \n Error: Input must represent a uuidv4', `Error #3 \n Error: A branch key record with branch-key-id=${branchKeyId} and type=branch:version:${nonExistentBranchKeyVersion} was not found in DynamoDB`, - 'Error #4 \n Error: Unsupported state or unable to authenticate data', + /Error #4 \n Error: (Unsupported state or unable to authenticate data|error:1C800064:Provider routines::bad decrypt)/, ] await testOnDecryptError( diff --git a/modules/kms-keyring-node/test/kms_hkeyring_node.helpers.test.ts b/modules/kms-keyring-node/test/kms_hkeyring_node.helpers.test.ts index 243182d18..6bd29c6f8 100644 --- a/modules/kms-keyring-node/test/kms_hkeyring_node.helpers.test.ts +++ b/modules/kms-keyring-node/test/kms_hkeyring_node.helpers.test.ts @@ -281,7 +281,9 @@ describe('KmsHierarchicalKeyRingNode: helpers', () => { decryptionMaterial, utf8Sorting.utf8Sorting ) - ).to.throw('Unsupported state or unable to authenticate data') + ).to.throw( + /Unsupported state or unable to authenticate data|bad decrypt/ + ) } }) }) diff --git a/modules/kms-keyring-node/test/kms_hkeyring_node.test.ts b/modules/kms-keyring-node/test/kms_hkeyring_node.test.ts index 37daaa0e0..77d3f1a99 100644 --- a/modules/kms-keyring-node/test/kms_hkeyring_node.test.ts +++ b/modules/kms-keyring-node/test/kms_hkeyring_node.test.ts @@ -199,7 +199,7 @@ export async function testOnDecryptError( edks: EncryptedDataKey[], decryptionMaterial: NodeDecryptionMaterial, errorMessage?: string, - errorMessages?: string[] + errorMessages?: (string | RegExp)[] ) { const expectedNumberOfTraces = decryptionMaterial.keyringTrace.length const alreadyHasPdk = decryptionMaterial.hasUnencryptedDataKey @@ -218,8 +218,12 @@ export async function testOnDecryptError( //# then it MUST yield an error that includes all the collected errors //# and MUST NOT modify the [decryption materials](structures.md#decryption-materials). const errMsg = (error as Error).message - for (const expectedError of errorMessages as string[]) { - expect(errMsg.includes(expectedError)).to.be.true + for (const expectedError of errorMessages as (string | RegExp)[]) { + expect( + typeof expectedError === 'string' + ? errMsg.includes(expectedError) + : expectedError.test(errMsg) + ).to.be.true } } }