Move from CircleCI to GitHub Actions (#1849)

Duplicate jobs from the CircleCI workflow as closely as possible in GitHub Actions. Remove Ubuntu Bionic / i386 support in CI.

---------

Signed-off-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>

.circleci/config.yml

@@ -1,308 +0,0 @@
-version: 2.1
-
-require_stylecheck: &require_stylecheck
-  requires:
-    - stylecheck
-
-require_buildcheck: &require_buildcheck
-  requires:
-    - stylecheck
-    - buildcheck
-
-require_testapproval: &require_testapproval
-  requires:
-    - stylecheck
-    - buildcheck
-    - testapproval
-
-# CircleCI doesn't handle large file sets properly for local builds
-# https://github.com/CircleCI-Public/circleci-cli/issues/281#issuecomment-472808051
-localCheckout: &localCheckout
-  run: |-
-    PROJECT_PATH=$(cd ${CIRCLE_WORKING_DIRECTORY}; pwd)
-    mkdir -p ${PROJECT_PATH}
-    git config --global --add safe.directory /tmp/_circleci_local_build_repo
-    cd /tmp/_circleci_local_build_repo
-    git ls-files -z | xargs -0 -s 2090860 tar -c | tar -x -C ${PROJECT_PATH}
-    cp -a /tmp/_circleci_local_build_repo/.git ${PROJECT_PATH}
-
-jobs:
-  stylecheck:
-    description: Validate formatting of code and documentation
-    docker:
-      - image: openquantumsafe/ci-ubuntu-focal-x86_64:latest
-# Re-enable iff docker enforces rate limitations without auth:
-#        auth:
-#          username: $DOCKER_LOGIN
-#          password: $DOCKER_PASSWORD
-    steps:
-      - checkout # change this from "checkout" to "*localCheckout" when running CircleCI locally
-      - run:
-          name: Ensure code conventions are upheld
-          command: python3 -m pytest --verbose tests/test_code_conventions.py
-      - run:
-          name: Check that doxygen can parse the documentation
-          command: mkdir -p build/docs && ./scripts/run_doxygen.sh doxygen docs/.Doxyfile build/docs
-
-  buildcheck:
-    description: Test that we can build a single KEM/Signature pair as part of a minimal build.
-    parameters:
-      CONTAINER:
-        description: "The docker container to use."
-        type: string
-      CMAKE_ARGS:
-        description: "Arguments to pass to CMake."
-        type: string
-        default: ''
-      KEM_NAME:
-        description: "The KEM to build."
-        type: string
-      SIG_NAME:
-        description: "The signature scheme to build."
-        type: string
-    docker:
-      - image: << parameters.CONTAINER >>
-    steps:
-      - checkout # change this from "checkout" to "*localCheckout" when running CircleCI locally
-      - run:
-          name: Configure
-          command: |2
-            mkdir build && cd build && source ~/.bashrc && \
-            cmake .. --warn-uninitialized \
-                     -GNinja << parameters.CMAKE_ARGS >> \
-                     -DOQS_MINIMAL_BUILD="KEM_<< parameters.KEM_NAME >>;SIG_<< parameters.SIG_NAME >>" \
-                     > config.log 2>&1 && \
-            cat config.log && \
-            cmake -LA -N .. && ! (grep "uninitialized variable" config.log)
-      - run:
-          name: Build
-          command: ninja
-          working_directory: build
-
-  linux_oqs:
-    description: A template for running liboqs tests on Linux Docker VMs
-    parameters:
-      CONTAINER:
-        description: "The docker container to use."
-        type: string
-      CMAKE_ARGS:
-        description: "Arguments to pass to CMake."
-        type: string
-        default: ''
-      PYTEST_ARGS:
-        description: "Arguments to pass to pytest."
-        type: string
-        # Not every executor handles --numprocesses=auto being passed to pytest well
-        # See https://github.com/open-quantum-safe/liboqs/issues/738#issuecomment-621394744
-        default: --numprocesses=auto
-      SKIP_ALGS:
-        description: "Algorithms not to test in test_constant_time."
-        type: string
-        default: ''
-    docker:
-      - image: << parameters.CONTAINER >>
-# Re-enable iff docker enforces rate limitations without auth:
-#        auth:
-#          username: $DOCKER_LOGIN
-#          password: $DOCKER_PASSWORD
-    steps:
-      - checkout # change this from "checkout" to "*localCheckout" when running CircleCI locally
-      - run:
-          name: Configure
-          command: mkdir build && cd build && source ~/.bashrc && cmake -GNinja << parameters.CMAKE_ARGS >> .. && cmake -LA -N ..
-      - run:
-          name: Build
-          command: ninja
-          working_directory: build
-      - run:
-          name: Run tests
-          no_output_timeout: 1h
-          command: mkdir -p tmp && python3 -m pytest --verbose --ignore=tests/test_speed.py --ignore=tests/test_code_conventions.py --junitxml=build/test-results/pytest/test-results.xml << parameters.PYTEST_ARGS >>
-          environment:
-             SKIP_ALGS: << parameters.SKIP_ALGS >>
-      - store_test_results: # Note that this command will fail when running CircleCI locally, that is expected behaviour
-          path: build/test-results
-      - store_artifacts:
-          path: build/test-results
-
-
-  scan_build:
-    description: Executing scan-build test
-    parameters:
-      CONTAINER:
-        description: "The docker container to use."
-        type: string
-    docker:
-      - image: << parameters.CONTAINER >>
-    steps:
-      - checkout # change this from "checkout" to "*localCheckout" when running CircleCI locally
-      - run:
-          name: Configure
-          command: mkdir build && cd build && pwd && source ~/.bashrc && scan-build-15 cmake -GNinja ..
-      - run:
-          name: Build
-          command: scan-build-15 --status-bugs ninja
-          working_directory: build
-
-  trigger-downstream-ci:
-    docker:
-      - image: cimg/base:2020.01
-# Re-enable iff docker enforces rate limitations without auth:
-#        auth:
-#          username: $DOCKER_LOGIN
-#          password: $DOCKER_PASSWORD
-    steps:
-      - run:
-          name: Trigger OQS-OpenSSL CI
-          command: |2
-            curl --silent \
-                 --write-out "\n%{response_code}\n" \
-                 --user ${BUILD_TRIGGER_TOKEN}: \
-                 --request POST \
-                 --header "Content-Type: application/json" \
-                 --data '{ "branch": "OQS-OpenSSL_1_1_1-stable", "parameters": { "run_downstream_tests": true } }' \
-                 https://circleci.com/api/v2/project/gh/open-quantum-safe/openssl/pipeline | tee curl_out \
-            && grep -q "201" curl_out
-
-      - run:
-          name: Trigger OQS-BoringSSL CI
-          command: |2
-            curl --silent \
-                 --write-out "\n%{response_code}\n" \
-                 --user ${BUILD_TRIGGER_TOKEN}: \
-                 --request POST \
-                 --header "Content-Type: application/json" \
-                 --data '{ "branch": "master", "parameters": { "run_downstream_tests": true } }' \
-                 https://circleci.com/api/v2/project/gh/open-quantum-safe/boringssl/pipeline | tee curl_out \
-            && grep -q "201" curl_out
-      - run:
-          name: Trigger OQS-OpenSSH CI
-          command: |2
-            curl --silent \
-                 --write-out "\n%{response_code}\n" \
-                 --user ${BUILD_TRIGGER_TOKEN}: \
-                 --request POST \
-                 --header "Content-Type: application/json" \
-                 --data '{ "branch": "OQS-v8", "parameters": { "run_downstream_tests": true } }' \
-                 https://circleci.com/api/v2/project/gh/open-quantum-safe/openssh/pipeline | tee curl_out \
-            && grep -q "201" curl_out
-      - run:
-          name: Trigger oqs-provider CI
-          command: |2
-            curl --silent \
-                 --write-out "\n%{response_code}\n" \
-                 --user ${BUILD_TRIGGER_TOKEN}: \
-                 --request POST \
-                 --header "Content-Type: application/json" \
-                 --data '{ "branch": "main" }' \
-                 https://circleci.com/api/v2/project/gh/open-quantum-safe/oqs-provider/pipeline | tee curl_out \
-            && grep -q "201" curl_out
-      - run:
-          name: Trigger liboqs-dotnet CI
-          command: |2
-            curl --silent \
-                 --write-out "\n%{response_code}\n" \
-                 --user ${BUILD_TRIGGER_TOKEN}: \
-                 --request POST \
-                 --header "Content-Type: application/json" \
-                 --data '{ "branch": "master" }' \
-                 https://circleci.com/api/v2/project/gh/open-quantum-safe/liboqs-dotnet/pipeline | tee curl_out \
-            && grep -q "201" curl_out
-      - run:
-          name: Trigger liboqs-java CI
-          command: |2
-            curl --silent \
-                 --write-out "\n%{response_code}\n" \
-                 --user ${BUILD_TRIGGER_TOKEN}: \
-                 --request POST \
-                 --header "Content-Type: application/json" \
-                 --data '{ "branch": "master" }' \
-                 https://circleci.com/api/v2/project/gh/open-quantum-safe/liboqs-java/pipeline | tee curl_out \
-            && grep -q "201" curl_out
-      - run:
-          name: Trigger liboqs-python CI
-          command: |2
-            curl --silent \
-                 --write-out "\n%{response_code}\n" \
-                 --request POST \
-                 --header "Accept: application/vnd.github+json" \
-                 --header "Authorization: Bearer $OQSBOT_GITHUB_ACTIONS" \
-                 --header "X-GitHub-Api-Version: 2022-11-28" \
-                 --data '{"event_type":"liboqs-upstream-trigger"}' \
-                 https://api.github.com/repos/open-quantum-safe/liboqs-python/dispatches | tee curl_out \
-            && grep -q "204" curl_out
-
-workflows:
-  version: 2.1
-  build:
-    when:
-      and:
-        - not:
-            equal: [ main, << pipeline.git.branch >> ]
-        - not:
-            matches: { pattern: "^ghactionsonly-.*", value: << pipeline.git.branch >> }
-    jobs:
-      - stylecheck
-      - buildcheck:
-          <<: *require_stylecheck
-          context: openquantumsafe
-          CONTAINER: openquantumsafe/ci-ubuntu-focal-x86_64:latest
-          KEM_NAME: kyber_768
-          SIG_NAME: dilithium_3
-      # Disabling testapproval as no jobs currently need it.
-      #- testapproval:
-      #    <<: *require_buildcheck
-      #    type: approval
-      # Disabling centos-8 and debian-buster.
-      # Re-enable if specific configurations (package versions etc) that need to be tested are identified.
-      #- linux_oqs:
-      #    <<: *require_buildcheck
-      #    name: centos-8
-      #    context: openquantumsafe
-      #    CONTAINER: openquantumsafe/ci-centos-8-amd64:latest
-      #    CMAKE_ARGS: -DCMAKE_C_COMPILER=clang
-      #- linux_oqs:
-      #    <<: *require_buildcheck
-      #    name: debian-buster
-      #    context: openquantumsafe
-      #    CONTAINER: openquantumsafe/ci-debian-buster-amd64:latest
-      - scan_build:
-          <<: *require_buildcheck
-          name: scan_build
-          context: openquantumsafe
-          CONTAINER: openquantumsafe/ci-ubuntu-focal-x86_64:latest
-      - linux_oqs:
-          <<: *require_buildcheck
-          name: ubuntu-focal-noopenssl
-          context: openquantumsafe
-          CONTAINER: openquantumsafe/ci-ubuntu-focal-x86_64:latest
-          CMAKE_ARGS: -DCMAKE_C_COMPILER=gcc-8 -DOQS_USE_OPENSSL=OFF
-          PYTEST_ARGS: --ignore=tests/test_leaks.py --ignore=tests/test_kat_all.py
-      - linux_oqs:
-          <<: *require_buildcheck
-          name: ubuntu-focal-shared-noopenssl
-          context: openquantumsafe
-          CONTAINER: openquantumsafe/ci-ubuntu-focal-x86_64:latest
-          CMAKE_ARGS: -DCMAKE_C_COMPILER=gcc-7 -DOQS_DIST_BUILD=OFF -DOQS_USE_OPENSSL=OFF -DBUILD_SHARED_LIBS=ON
-          PYTEST_ARGS: --ignore=tests/test_namespace.py --ignore=tests/test_leaks.py --ignore=tests/test_kat_all.py --numprocesses=auto
-      - linux_oqs:
-          <<: *require_buildcheck
-          name: ubuntu-focal-clang15
-          context: openquantumsafe
-          CONTAINER: openquantumsafe/ci-ubuntu-focal-x86_64:latest
-          CMAKE_ARGS: -DOQS_STRICT_WARNINGS=ON -DCMAKE_C_COMPILER=clang-15 -DOQS_OPT_TARGET=skylake
-          PYTEST_ARGS: --ignore=tests/test_kat_all.py
-      - linux_oqs:
-          <<: *require_buildcheck
-          name: ubuntu-bionic-i386
-          context: openquantumsafe
-          CONTAINER: openquantumsafe/ci-ubuntu-bionic-i386:latest
-          CMAKE_ARGS: -DCMAKE_TOOLCHAIN_FILE=../.CMake/toolchain_x86.cmake
-          PYTEST_ARGS: --ignore=tests/test_leaks.py --ignore=tests/test_kat_all.py
-
-  commit-to-main:
-    when:
-      equal: [ main, << pipeline.git.branch >> ]
-    jobs:
-      - trigger-downstream-ci:
-          context: openquantumsafe

.github/workflows/commit-to-main.yml

@@ -0,0 +1,87 @@
+name: Trigger basic downstream CI
+
+permissions:
+  contents: read
+
+on:
+  push:
+    branches: [ "main" ]
+
+jobs:
+  trigger-downstream-ci:
+    strategy:
+      fail-fast: false
+    runs-on: ubuntu-latest
+    steps:
+      # TODO: missing projects?
+      - name: Trigger OQS-OpenSSL CI
+        run: |
+          curl --silent \
+               --write-out "\n%{response_code}\n" \
+               --user ${BUILD_TRIGGER_TOKEN}: \
+               --request POST \
+               --header "Content-Type: application/json" \
+               --data '{ "branch": "OQS-OpenSSL_1_1_1-stable", "parameters": { "run_downstream_tests": true } }' \
+               https://circleci.com/api/v2/project/gh/open-quantum-safe/openssl/pipeline | tee curl_out \
+          && grep -q "201" curl_out
+      - name: Trigger OQS-BoringSSL CI
+        run: |
+          curl --silent \
+               --write-out "\n%{response_code}\n" \
+               --user ${BUILD_TRIGGER_TOKEN}: \
+               --request POST \
+               --header "Content-Type: application/json" \
+               --data '{ "branch": "master", "parameters": { "run_downstream_tests": true } }' \
+               https://circleci.com/api/v2/project/gh/open-quantum-safe/boringssl/pipeline | tee curl_out \
+          && grep -q "201" curl_out
+      - name: Trigger OQS-OpenSSH CI
+        run: |
+          curl --silent \
+               --write-out "\n%{response_code}\n" \
+               --user ${BUILD_TRIGGER_TOKEN}: \
+               --request POST \
+               --header "Content-Type: application/json" \
+               --data '{ "branch": "OQS-v8", "parameters": { "run_downstream_tests": true } }' \
+               https://circleci.com/api/v2/project/gh/open-quantum-safe/openssh/pipeline | tee curl_out \
+          && grep -q "201" curl_out
+      - name: Trigger oqs-provider CI
+        run: |
+          curl --silent \
+               --write-out "\n%{response_code}\n" \
+               --user ${BUILD_TRIGGER_TOKEN}: \
+               --request POST \
+               --header "Content-Type: application/json" \
+               --data '{ "branch": "main" }' \
+               https://circleci.com/api/v2/project/gh/open-quantum-safe/oqs-provider/pipeline | tee curl_out \
+          && grep -q "201" curl_out
+      - name: Trigger liboqs-dotnet CI
+        run: |
+          curl --silent \
+               --write-out "\n%{response_code}\n" \
+               --user ${BUILD_TRIGGER_TOKEN}: \
+               --request POST \
+               --header "Content-Type: application/json" \
+               --data '{ "branch": "master" }' \
+               https://circleci.com/api/v2/project/gh/open-quantum-safe/liboqs-dotnet/pipeline | tee curl_out \
+          && grep -q "201" curl_out
+      - name: Trigger liboqs-java CI
+        run: |
+          curl --silent \
+               --write-out "\n%{response_code}\n" \
+               --user ${BUILD_TRIGGER_TOKEN}: \
+               --request POST \
+               --header "Content-Type: application/json" \
+               --data '{ "branch": "master" }' \
+               https://circleci.com/api/v2/project/gh/open-quantum-safe/liboqs-java/pipeline | tee curl_out \
+          && grep -q "201" curl_out
+      - name: Trigger liboqs-python CI
+        run: |
+          curl --silent \
+               --write-out "\n%{response_code}\n" \
+               --request POST \
+               --header "Accept: application/vnd.github+json" \
+               --header "Authorization: Bearer $OQSBOT_GITHUB_ACTIONS" \
+               --header "X-GitHub-Api-Version: 2022-11-28" \
+               --data '{"event_type":"liboqs-upstream-trigger"}' \
+               https://api.github.com/repos/open-quantum-safe/liboqs-python/dispatches | tee curl_out \
+          && grep -q "204" curl_out

.github/workflows/unix.yml

@@ -85,7 +85,7 @@ jobs:
           - name: arm64
             runner: oqs-arm64
             container: openquantumsafe/ci-ubuntu-focal-arm64:latest
-            PYTEST_ARGS: --numprocesses=auto --maxprocesses=10 --ignore=tests/test_kat_all.py
+            PYTEST_ARGS: --maxprocesses=10 --ignore=tests/test_kat_all.py
             CMAKE_ARGS: -DOQS_ENABLE_SIG_STFL_LMS=ON -DOQS_ENABLE_SIG_STFL_XMSS=ON -DOQS_HAZARDOUS_EXPERIMENTAL_ENABLE_SIG_STFL_KEY_SIG_GEN=ON
           - name: alpine
             runner: ubuntu-latest
@@ -117,6 +117,21 @@ jobs:
             container: openquantumsafe/ci-ubuntu-focal-x86_64:latest
             CMAKE_ARGS: -DOQS_STRICT_WARNINGS=ON -DOQS_ALGS_ENABLED=NIST_SIG_ONRAMP
             PYTEST_ARGS: --ignore=tests/test_leaks.py --ignore=tests/test_kat_all.py
+          - name: focal-noopenssl
+            runner: ubuntu-latest
+            container: openquantumsafe/ci-ubuntu-focal-x86_64:latest
+            CMAKE_ARGS: -DCMAKE_C_COMPILER=gcc-8 -DOQS_USE_OPENSSL=OFF
+            PYTEST_ARGS: --ignore=tests/test_leaks.py --ignore=tests/test_kat_all.py
+          - name: focal-shared-noopenssl
+            runner: ubuntu-latest
+            container: openquantumsafe/ci-ubuntu-focal-x86_64:latest
+            CMAKE_ARGS: -DCMAKE_C_COMPILER=gcc-7 -DOQS_DIST_BUILD=OFF -DOQS_USE_OPENSSL=OFF -DBUILD_SHARED_LIBS=ON
+            PYTEST_ARGS: --ignore=tests/test_namespace.py --ignore=tests/test_leaks.py --ignore=tests/test_kat_all.py
+          - name: focal-clang15
+            runner: ubuntu-latest
+            container: openquantumsafe/ci-ubuntu-focal-x86_64:latest
+            CMAKE_ARGS: -DOQS_STRICT_WARNINGS=ON -DCMAKE_C_COMPILER=clang-15
+            PYTEST_ARGS: --ignore=tests/test_kat_all.py
           - name: jammy-std-openssl3
             runner: ubuntu-latest
             container: openquantumsafe/ci-ubuntu-jammy:latest
@@ -131,12 +146,12 @@ jobs:
             runner: ubuntu-latest
             container: openquantumsafe/ci-ubuntu-focal-x86_64:latest
             CMAKE_ARGS: -DCMAKE_C_COMPILER=clang-9 -DCMAKE_BUILD_TYPE=Debug -DUSE_SANITIZER=Address -DOQS_HAZARDOUS_EXPERIMENTAL_ENABLE_SIG_STFL_KEY_SIG_GEN=ON -DOQS_ENABLE_SIG_STFL_XMSS=ON -DOQS_ENABLE_SIG_STFL_LMS=ON
-            PYTEST_ARGS: --ignore=tests/test_distbuild.py --ignore=tests/test_leaks.py --ignore=tests/test_kat_all.py --numprocesses=auto --maxprocesses=10
+            PYTEST_ARGS: --ignore=tests/test_distbuild.py --ignore=tests/test_leaks.py --ignore=tests/test_kat_all.py --maxprocesses=10
           - name: address-sanitizer-no-stfl-key-sig-gen
             runner: ubuntu-latest
             container: openquantumsafe/ci-ubuntu-focal-x86_64:latest
             CMAKE_ARGS: -DCMAKE_C_COMPILER=clang-9 -DCMAKE_BUILD_TYPE=Debug -DUSE_SANITIZER=Address -DOQS_HAZARDOUS_EXPERIMENTAL_ENABLE_SIG_STFL_KEY_SIG_GEN=OFF -DOQS_ENABLE_SIG_STFL_XMSS=ON -DOQS_ENABLE_SIG_STFL_LMS=ON
-            PYTEST_ARGS: --ignore=tests/test_distbuild.py --ignore=tests/test_leaks.py --ignore=tests/test_kat_all.py --numprocesses=auto --maxprocesses=10
+            PYTEST_ARGS: --ignore=tests/test_distbuild.py --ignore=tests/test_leaks.py --ignore=tests/test_kat_all.py --maxprocesses=10
     runs-on: ${{ matrix.runner }}
     container:
       image: ${{ matrix.container }}
@@ -150,7 +165,7 @@ jobs:
         working-directory: build
       - name: Run tests
         timeout-minutes: 60
-        run: mkdir -p tmp && python3 -m pytest --verbose --ignore=tests/test_code_conventions.py ${{ matrix.PYTEST_ARGS }}
+        run: mkdir -p tmp && python3 -m pytest --verbose --ignore=tests/test_code_conventions.py --numprocesses=auto ${{ matrix.PYTEST_ARGS }}
       - name: Package .deb
         if: matrix.name == 'jammy-std-openssl3'
         run: cpack
@@ -175,16 +190,16 @@ jobs:
         include:
           - name: armhf
             ARCH: armhf
-            CMAKE_ARGS: -DOQS_ENABLE_SIG_SPHINCS=OFF -DOQS_USE_OPENSSL=OFF -DOQS_OPT_TARGET=generic -DOQS_HAZARDOUS_EXPERIMENTAL_ENABLE_SIG_STFL_KEY_SIG_GEN=ON -DOQS_ENABLE_SIG_STFL_XMSS=ON -DOQS_ENABLE_SIG_STFL_LMS=ON
+            CMAKE_ARGS: -DOQS_ENABLE_SIG_SPHINCS=OFF -DOQS_USE_OPENSSL=OFF -DOQS_DIST_BUILD=OFF -DOQS_OPT_TARGET=generic -DOQS_HAZARDOUS_EXPERIMENTAL_ENABLE_SIG_STFL_KEY_SIG_GEN=ON -DOQS_ENABLE_SIG_STFL_XMSS=ON -DOQS_ENABLE_SIG_STFL_LMS=ON
             PYTEST_ARGS: --ignore=tests/test_alg_info.py --ignore=tests/test_kat_all.py
           - name: armhf-no-stfl-key-sig-gen
             ARCH: armhf
-            CMAKE_ARGS: -DOQS_ENABLE_SIG_SPHINCS=OFF -DOQS_USE_OPENSSL=OFF -DOQS_OPT_TARGET=generic -DOQS_HAZARDOUS_EXPERIMENTAL_ENABLE_SIG_STFL_KEY_SIG_GEN=OFF -DOQS_ENABLE_SIG_STFL_XMSS=ON -DOQS_ENABLE_SIG_STFL_LMS=ON
+            CMAKE_ARGS: -DOQS_ENABLE_SIG_SPHINCS=OFF -DOQS_USE_OPENSSL=OFF -DOQS_DIST_BUILD=OFF -DOQS_OPT_TARGET=generic -DOQS_HAZARDOUS_EXPERIMENTAL_ENABLE_SIG_STFL_KEY_SIG_GEN=OFF -DOQS_ENABLE_SIG_STFL_XMSS=ON -DOQS_ENABLE_SIG_STFL_LMS=ON
             PYTEST_ARGS: --ignore=tests/test_alg_info.py --ignore=tests/test_kat_all.py
           # no longer supporting armel
           # - name: armel
           #   ARCH: armel
-          #   CMAKE_ARGS: -DOQS_ENABLE_SIG_SPHINCS=OFF -DOQS_USE_OPENSSL=OFF -DOQS_OPT_TARGET=generic
+          #   CMAKE_ARGS: -DOQS_ENABLE_SIG_SPHINCS=OFF -DOQS_USE_OPENSSL=OFF -DOQS_DIST_BUILD=OFF -DOQS_OPT_TARGET=generic
     steps:
       - name: Checkout code
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # pin@v4
@@ -319,3 +334,16 @@ jobs:
       - name: Run tests
         timeout-minutes: 60
         run: mkdir -p tmp && python3 -m pytest --verbose --ignore=tests/test_code_conventions.py --ignore=tests/test_leaks.py --ignore=tests/test_kat_all.py
+
+  scan_build:
+    needs: buildcheck
+    runs-on: ubuntu-latest
+    container: openquantumsafe/ci-ubuntu-focal-x86_64:latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Configure
+        run: mkdir build && cd build && scan-build-15 cmake -GNinja ..
+      - name: Build
+        run: scan-build-15 --status-bugs ninja
+        working-directory: build

.github/workflows/weekly.yml

@@ -21,7 +21,7 @@ jobs:
             SKIP_ALGS: 'SPHINCS\+-SHA(.)*s-simple,SPHINCS\+-SHAKE-(.)*,Classic-McEliece-[^3](.)*'
           - name: extensions
             container: openquantumsafe/ci-ubuntu-focal-x86_64:latest
-            CMAKE_ARGS: -DOQS_DIST_BUILD=OFF -DOQS_OPT_TARGET=haswell -DCMAKE_BUILD_TYPE=Debug -DOQS_ENABLE_TEST_CONSTANT_TIME=ON
+            CMAKE_ARGS: -DOQS_DIST_BUILD=OFF -DOQS_OPT_TARGET=auto -DCMAKE_BUILD_TYPE=Debug -DOQS_ENABLE_TEST_CONSTANT_TIME=ON
             PYTEST_ARGS: --numprocesses=auto -k 'test_constant_time'
             SKIP_ALGS: 'SPHINCS\+-SHA(.)*s-simple,SPHINCS\+-SHAKE-(.)*,Classic-McEliece-[^3](.)*'
     container:
@@ -50,7 +50,7 @@ jobs:
             PYTEST_ARGS: --numprocesses=auto -k 'test_kat_all'
           - name: extensions
             container: openquantumsafe/ci-ubuntu-focal-x86_64:latest
-            CMAKE_ARGS: -DOQS_DIST_BUILD=OFF -DOQS_OPT_TARGET=haswell
+            CMAKE_ARGS: -DOQS_DIST_BUILD=OFF -DOQS_OPT_TARGET=auto
             PYTEST_ARGS: --numprocesses=auto -k 'test_kat_all'
     container:
       image: ${{ matrix.container }}

CONTRIBUTING.md

@@ -34,16 +34,6 @@ run the following command in the project main directory prior to finishing a PR:
 
 ### Running CI locally
 
-#### CircleCI
-
-If encountering CI errors in CircleCI, it may be helpful to execute the test jobs
-locally to debug. This can be facilitated by executing the command
-
-   circleci local execute --job some-test-job
-
-assuming "some-test-job" is the name of the test to be executed and the CircleCI
-[command line tools have been installed](https://circleci.com/docs/local-cli).
-
 #### Github CI
 
 [Act](https://github.com/nektos/act) is a tool facilitating local execution of
@@ -57,7 +47,7 @@ When installing `act` as a github extension, prefix the commands with `gh `.
 ### New features
 
 Any PR introducing a new feature is expected to contain a test of this feature
-and this test should be part of the CI pipeline, preferably using Github CI.
+and this test should be part of the CI pipeline.
 
 ## Failsafe
 

README.md

@@ -1,4 +1,4 @@
-![CircleCI Build Status](https://circleci.com/gh/open-quantum-safe/liboqs/tree/main.svg?style=shield) ![Build Status](https://img.shields.io/travis/com/open-quantum-safe/liboqs?logo=travis&label=travis%20ci)
+![Travis Build Status](https://img.shields.io/travis/com/open-quantum-safe/liboqs?logo=travis&label=travis%20ci)
 
 liboqs
 ======================