Move macOS CI tests to GitHub Actions; add M1 CI tests (#1709)

* Move all CircleCI macOS jobs to GitHub

* Unify macOS and Linux workflows so that both pend minimal tests

* Fix a build warning on macOS

.circleci/config.yml

@@ -185,41 +185,6 @@ jobs:
       - store_artifacts:
           path: build/test-results
 
-  macOS:
-    description: A template for running liboqs tests on macOS
-    parameters:
-      CMAKE_ARGS:
-        description: "Arguments to pass to CMake."
-        type: string
-      PYTEST_ARGS:
-        description: "Arguments to pass to pytest."
-        type: string
-        default: ""
-    macos:
-      xcode: "14.3.1"
-    steps:
-      - checkout # change this from "checkout" to "*localCheckout" when running CircleCI locally
-      - run:
-          name: Install dependencies
-          command: env HOMEBREW_NO_AUTO_UPDATE=1 brew install openssl cmake ninja gcc@11 && pip3 install pytest pytest-xdist pyyaml
-      - run:
-          name: Get system information
-          command: sysctl -a | grep machdep.cpu
-      - run:
-          name: Configure
-          command: mkdir build && cd build && source ~/.bashrc && cmake -GNinja << parameters.CMAKE_ARGS >> .. && cmake -LA ..
-      - run:
-          name: Build
-          command: ninja
-          working_directory: build
-      - run:
-          name: Run tests
-          command: mkdir tmp && python3 -m pytest --verbose --ignore=tests/test_code_conventions.py --junitxml=build/test-results/pytest/test-results.xml << parameters.PYTEST_ARGS >>
-      - store_test_results: # Note that this command will fail when running CircleCI locally, that is expected behaviour
-          path: build/test-results
-      - store_artifacts:
-          path: build/test-results
-
   trigger-downstream-ci:
     docker:
       - image: cimg/base:2020.01
@@ -379,21 +344,6 @@ workflows:
           <<: *require_buildcheck
           name: arm64
           PYTEST_ARGS: --numprocesses=auto --maxprocesses=10 --ignore=tests/test_kat_all.py
-      - macOS:
-          <<: *require_buildcheck
-          name: macOS-gcc11
-          CMAKE_ARGS: -DCMAKE_C_COMPILER=gcc-11
-          PYTEST_ARGS: --ignore=tests/test_kat_all.py
-      - macOS:
-          <<: *require_buildcheck
-          name: macOS-noopenssl
-          CMAKE_ARGS: -DOQS_STRICT_WARNINGS=ON -DOQS_USE_OPENSSL=OFF
-          PYTEST_ARGS: --ignore=tests/test_kat_all.py
-      - macOS:
-          <<: *require_buildcheck
-          name: macOS-shared
-          CMAKE_ARGS: -DBUILD_SHARED_LIBS=ON -DOQS_DIST_BUILD=OFF -DOQS_ENABLE_KEM_CLASSIC_MCELIECE=OFF
-          PYTEST_ARGS: --ignore=tests/test_kat_all.py
 
   commit-to-main:
     when:

.github/workflows/unix.yml

@@ -1,4 +1,4 @@
-name: Linux tests
+name: Linux and MacOS tests
 
 on: [push, pull_request]
 
@@ -39,7 +39,7 @@ jobs:
   buildcheck:
     name: Check that code passes a basic build before starting heavier tests
     container: openquantumsafe/ci-ubuntu-focal-x86_64:latest
-    needs: stylecheck
+    needs: [stylecheck, upstreamcheck]
     runs-on: ubuntu-latest
     env:
       KEM_NAME: kyber_768
@@ -63,7 +63,7 @@ jobs:
         working-directory: build
 
   linux_intel:
-    needs: [stylecheck, upstreamcheck, buildcheck]
+    needs: buildcheck
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -118,7 +118,7 @@ jobs:
           path: build/*.deb
 
   linux_arm_emulated:
-    needs: [stylecheck, upstreamcheck, buildcheck]
+    needs: buildcheck
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -162,7 +162,7 @@ jobs:
                                                 --ignore=tests/test_code_conventions.py ${{ matrix.PYTEST_ARGS }}"
 
   linux_cross_compile:
-    needs: [stylecheck, upstreamcheck, buildcheck]
+    needs: buildcheck
     runs-on: ubuntu-latest
     container: openquantumsafe/ci-ubuntu-focal-x86_64:latest
     strategy:
@@ -181,3 +181,33 @@ jobs:
       - name: Build
         run: ninja
         working-directory: build
+
+  macos:
+    needs: buildcheck
+    strategy:
+      fail-fast: false
+      matrix:
+        os: # macos-14 runs on aarch64; the others run on x64
+          - macos-12
+          - macos-13
+          - macos-14
+        CMAKE_ARGS:
+          - -DCMAKE_C_COMPILER=gcc-13
+          - -DOQS_USE_OPENSSL=OFF
+          - -DBUILD_SHARED_LIBS=ON -DOQS_DIST_BUILD=OFF
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Install dependencies
+        run: env HOMEBREW_NO_AUTO_UPDATE=1 brew install ninja && pip3 install pytest pytest-xdist pyyaml
+      - name: Get system information
+        run: sysctl -a | grep machdep.cpu
+      - name: Configure
+        run: mkdir -p build && cd build && source ~/.bashrc && cmake -GNinja -DOQS_STRICT_WARNINGS=ON ${{ matrix.CMAKE_ARGS }} .. && cmake -LA ..
+      - name: Build
+        run: ninja
+        working-directory: build
+      - name: Run tests
+        run: mkdir -p tmp && python3 -m pytest --verbose --ignore=tests/test_code_conventions.py --ignore=tests/test_kat_all.py ${{ matrix.PYTEST_ARGS }}
+        timeout-minutes: 60

PLATFORMS.md

@@ -45,8 +45,9 @@ In this policy, the words "must" and "must not" specify absolute requirements th
 ### Tier 1
 
 - x86_64/amd64/x64 for Ubuntu Linux (Focal)†
-- x86_64/amd64/x64 for MacOS (XCode 14)
+- x86_64/amd64/x64 for MacOS (XCode 14 and 15)
 - aarch64 for Ubuntu (Focal)
+- aarch64 for MacOS (XCode 15)
 - armhf/ARM7 and aarch64 emulation on Ubuntu
 
 ### Tier 2
@@ -59,7 +60,6 @@ In this policy, the words "must" and "must not" specify absolute requirements th
 ### Tier 3
 
 - x86 for Windows
-- aarch64 for MacOS
 - ppc64le for Ubuntu (Focal)
 - s390x for Ubuntu (Focal)
 

src/common/ossl_helpers.c

@@ -13,8 +13,8 @@ static EVP_CIPHER *aes128_ecb_ptr, *aes256_ecb_ptr, *aes256_ctr_ptr;
 
 CRYPTO_ONCE OQS_ONCE_STATIC_INIT;
 
-static void oqs_fetch_ossl_objects(void) {
 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
+static void oqs_fetch_ossl_objects(void) {
 	sha256_ptr = EVP_MD_fetch(NULL, "SHA256", NULL);
 	sha384_ptr = EVP_MD_fetch(NULL, "SHA384", NULL);
 	sha512_ptr = EVP_MD_fetch(NULL, "SHA512", NULL);
@@ -34,8 +34,8 @@ static void oqs_fetch_ossl_objects(void) {
 	        !aes128_ecb_ptr || !aes256_ecb_ptr || !aes256_ctr_ptr) {
 		fprintf(stderr, "liboqs warning: OpenSSL initialization failure. Is provider for SHA, SHAKE, AES enabled?\n");
 	}
-#endif
 }
+#endif
 
 void oqs_free_ossl_objects(void) {
 #if OPENSSL_VERSION_NUMBER >= 0x30000000L