ci: run Linux CI on CodeBuild-hosted runners

.github/workflows/ci.yml

@@ -13,7 +13,7 @@ jobs:
     if: always()
     needs:
       - shared-ci
-    runs-on: ubuntu-22.04
+    runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-javascript-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
       - name: Verify all required jobs passed
         uses: re-actors/alls-green@release/v1

.github/workflows/ci_static-analysis.yaml

@@ -8,7 +8,7 @@ permissions:
 
 jobs:
   not-grep:
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-javascript-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
       - uses: actions/checkout@v2
       - name: not-grep

.github/workflows/prod-release.yml

@@ -24,7 +24,7 @@ jobs:
 
   # Once all tests have passed, run semantic versioning
   version:
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-javascript-${{ github.run_id }}-${{ github.run_attempt }}
     needs: [pre-release-ci]
     environment: release
     steps:
@@ -48,7 +48,7 @@ jobs:
           cache: 'npm'
 
       - name: Install dependencies
-        run: npm ci --unsafe-perm
+        run: npm ci
 
       - name: Configure AWS Credentials for Release
         uses: aws-actions/configure-aws-credentials@v5

.github/workflows/repo-sync.yml

@@ -11,7 +11,7 @@ jobs:
   repo-sync:
     name: Repo Sync
     environment: repo-sync
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-javascript-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
     - uses: actions/checkout@v2
     - uses: repo-sync/github-sync@v2

.github/workflows/shared-ci.yml

@@ -20,14 +20,14 @@ env:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-javascript-${{ github.run_id }}-${{ github.run_attempt }}
     permissions:
       id-token: write
       contents: read
     strategy:
       fail-fast: false
       matrix:
-        node-version: ['22.x', '24.x', 'latest']
+        node-version: ['22.x', '24.x', '*']
         test-type: ['node', 'browser']
         # Determine test categories based on whether testing published packages or source code:
         # - Testing published packages: only run vector tests (don't have build artifacts to test coverage or compliance)
@@ -57,7 +57,7 @@ jobs:
           role-session-name: JavaScriptTests
 
       - name: Install dependencies
-        run: npm ci --unsafe-perm
+        run: npm ci
 
       - name: Build (for source code testing)
         if: ${{ !inputs.test-published-packages }}

modules/decrypt-node/test/decrypt.test.ts

@@ -277,7 +277,10 @@ describe('decrypt', () => {
       decrypt(hkeyring, ciphertext, {
         encoding: 'base64',
       })
-    ).to.rejectedWith(Error, 'Unsupported state or unable to authenticate data')
+    ).to.rejectedWith(
+      Error,
+      /Unsupported state or unable to authenticate data|bad decrypt/
+    )
   })
 
   it('will decrypt ciphertext with high utf8 codepoints with a keyring configured to do utf8 sorting', async () => {

modules/integration-browser/karma.conf.js

@@ -58,6 +58,11 @@ module.exports = function (config) {
         new webpack.ProvidePlugin({
           Buffer: ['buffer', 'Buffer'],
         }),
+        {
+          apply(compiler) {
+            compiler.options.optimization.sideEffects = false
+          },
+        },
       ],
       devtool: 'inline-source-map',
       resolve: {

modules/kms-keyring-node/test/kms_hkeyring_node.edk-order.test.ts

@@ -254,7 +254,7 @@ describe('KmsHierarchicalKeyRingNode: decrypt EDK order', () => {
       `Error #1 \n Error: The encrypted data key ciphertext must be ${ciphertextLength} bytes long`,
       'Error #2 \n Error: Input must represent a uuidv4',
       `Error #3 \n Error: A branch key record with branch-key-id=${branchKeyId} and type=branch:version:${nonExistentBranchKeyVersion} was not found in DynamoDB`,
-      'Error #4 \n Error: Unsupported state or unable to authenticate data',
+      /Error #4 \n Error: (Unsupported state or unable to authenticate data|error:1C800064:Provider routines::bad decrypt)/,
     ]
 
     await testOnDecryptError(

modules/kms-keyring-node/test/kms_hkeyring_node.helpers.test.ts

@@ -281,7 +281,9 @@ describe('KmsHierarchicalKeyRingNode: helpers', () => {
             decryptionMaterial,
             utf8Sorting.utf8Sorting
           )
-        ).to.throw('Unsupported state or unable to authenticate data')
+        ).to.throw(
+          /Unsupported state or unable to authenticate data|bad decrypt/
+        )
       }
     })
   })

modules/kms-keyring-node/test/kms_hkeyring_node.test.ts

@@ -199,7 +199,7 @@ export async function testOnDecryptError(
   edks: EncryptedDataKey[],
   decryptionMaterial: NodeDecryptionMaterial,
   errorMessage?: string,
-  errorMessages?: string[]
+  errorMessages?: (string | RegExp)[]
 ) {
   const expectedNumberOfTraces = decryptionMaterial.keyringTrace.length
   const alreadyHasPdk = decryptionMaterial.hasUnencryptedDataKey
@@ -218,8 +218,12 @@ export async function testOnDecryptError(
       //# then it MUST yield an error that includes all the collected errors
       //# and MUST NOT modify the [decryption materials](structures.md#decryption-materials).
       const errMsg = (error as Error).message
-      for (const expectedError of errorMessages as string[]) {
-        expect(errMsg.includes(expectedError)).to.be.true
+      for (const expectedError of errorMessages as (string | RegExp)[]) {
+        expect(
+          typeof expectedError === 'string'
+            ? errMsg.includes(expectedError)
+            : expectedError.test(errMsg)
+        ).to.be.true
       }
     }
   }