library_interop_mkp_test_vectors.yml

# This workflow performs interoperability tests across the supported runtimes of the ESDK Dafny
name: Library Interoperability with MasterKeyProvider & Keyring across ESDKs excluding ESDK-C

on:
  workflow_call:
    inputs:
      dafny:
        description: "The Dafny version to use"
        required: true
        type: string
      regenerate-code:
        description: "Regenerate code using smithy-dafny"
        required: false
        default: false
        type: boolean

# These Interop test vectors are split into 4 different stages:
# 1. Create TestVectors that are compatible with MasterKeyProviders or
#     Keyrings written by a non-Dafny product like ESDK-JS.
#     These test vector manifests will be written in v2 format. The Python
#     oracle and @aws-crypto/integration-node should be able to read these
#     without any updates to their source code.
# 2. Decrypt Vectors
#     All libraries MUST attempt to decrypt what the other libraries just wrote.
# 3. Generate Decrypt Vectors with ESDK-JS
#     @aws-crypto/integration-node has the functionality to be given an encrypt manifest
#     and a keys.json manifest to produce a zip file whose contents include a decrypt-manifest.
#     This allows other ESDKs to read what ESDK-JS wrote.
# 4. Read what ESDK-JS wrote
#     Using the zip file created in stage 3 every library attempts
#     to decrypt what ESDK-JS wrote.
# These tests will ensure that messages encrypted with compatible MKP to Keyring
# can be successfully read by other languages
# These tests will ensure that the JavaScript ESDK can successfully decrypt messages encrypted
# by compatible MKPs or Keyrings.
# These tests will ensure that given an encrypt-manifest, every
# integrated library can successfully decrypt what ESDK-JS encrypted.
jobs:
  generateMkpKeyringLegacyFormatEncryptVectors:
    strategy:
      fail-fast: false
      matrix:
        library: [TestVectors]
        os: [
            # https://taskei.amazon.dev/tasks/CrypTool-5283
            # windows-latest,
            ubuntu-22.04,
          ]
        language: [java, net, rust, python, python_mkp, java_mkp, go]
        # https://taskei.amazon.dev/tasks/CrypTool-5284
        dotnet-version: ["6.0.x"]
    runs-on: ${{ matrix.os }}
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Support longpaths on Git checkout
        run: |
          git config --global core.longpaths true

      # TestVectors will call KMS
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v5
        with:
          aws-region: us-west-2
          role-to-assume: arn:aws:iam::370957321024:role/GitHub-CI-Public-ESDK-Dafny-Role-us-west-2
          role-session-name: InterOpTests
          role-duration-seconds: 3600

      - uses: actions/checkout@v6
        with:
          submodules: "recursive"

      # Set up runtimes
      - name: Setup .NET Core SDK ${{ matrix.dotnet-version }}
        if: matrix.language == 'net'
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: ${{ matrix.dotnet-version }}

      # Setup Java in Rust is needed for running polymorph
      - name: Setup Java 17
        if: matrix.language == 'java_mkp' || matrix.language == 'java' || matrix.language == 'rust'
        uses: actions/setup-java@v5
        with:
          distribution: "corretto"
          java-version: 17

      - name: Setup Python for running tests
        if: matrix.language == 'python_mkp' || matrix.language == 'python'
        uses: actions/setup-python@v6
        with:
          python-version: 3.11
          architecture: x64
      - run: |
          python -m pip install --upgrade pip
          pip install --upgrade tox
          pip install poetry

      - name: Setup Rust Toolchain for GitHub CI
        if: matrix.language == 'rust'
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          components: rustfmt

      - name: Setup NASM for Windows in Rust (aws-lc-sys)
        if: matrix.language == 'rust' && matrix.os == 'windows-latest'
        uses: ilammy/setup-nasm@v1

      - name: Setup Dafny Rust
        if: matrix.language == 'rust'
        uses: ./mpl/.github/actions/setup_dafny
        with:
          dafny-version: 4.10.0

      - name: Setup Dafny Not Rust
        if: matrix.language != 'rust'
        uses: ./mpl/.github/actions/setup_dafny
        with:
          dafny-version: ${{ inputs.dafny }}

      - name: Install Smithy-Dafny codegen dependencies
        uses: ./.github/actions/install_smithy_dafny_codegen_dependencies

      - name: Regenerate code using smithy-dafny if necessary
        if: ${{ inputs.regenerate-code }}
        uses: ./.github/actions/polymorph_codegen
        with:
          dafny: ${{ inputs.dafny }}
          library: ${{ matrix.library }}
          diff-generated-code: false

      # Build implementation for each runtime
      - name: Build ${{ matrix.library }} implementation in Java
        if: matrix.language == 'java_mkp' || matrix.language == 'java'
        shell: bash
        working-directory: ./${{ matrix.library }}
        run: |
          # This works because `node` is installed by default on GHA runners
          CORES=$(node -e 'console.log(os.cpus().length)')
          make build_java CORES=$CORES

      - name: Build ${{ matrix.library }} implementation in .NET
        if: matrix.language == 'net'
        shell: bash
        working-directory: ./${{ matrix.library }}
        run: |
          # This works because `node` is installed by default on GHA runners
          CORES=$(node -e 'console.log(os.cpus().length)')
          make transpile_net

      - name: Install Smithy-Dafny codegen dependencies
        if: matrix.language == 'rust'
        uses: ./.github/actions/install_smithy_dafny_codegen_dependencies

      - name: Run make polymorph_rust
        if: matrix.language == 'rust'
        shell: bash
        working-directory: ./${{ matrix.library }}
        run: |
          make polymorph_rust

      - name: Build ${{ matrix.library }} implementation in Rust
        if: matrix.language == 'rust'
        shell: bash
        working-directory: ./${{ matrix.library }}
        run: |
          CORES=$(node -e 'console.log(os.cpus().length)')
          make transpile_rust CORES=$CORES

      - name: Build ${{ matrix.library }} implementation in Python
        if: matrix.language == 'python' || matrix.language == 'python_mkp'
        shell: bash
        working-directory: ./${{ matrix.library }}
        run: |
          # This works because `node` is installed by default on GHA runners
          CORES=$(node -e 'console.log(os.cpus().length)')
          make transpile_python CORES=$CORES

      - name: Build ${{ matrix.library }} implementation in Go
        if: matrix.language == 'go'
        shell: bash
        working-directory: ./${{ matrix.library }}
        run: |
          # This works because `node` is installed by default on GHA runners
          CORES=$(node -e 'console.log(os.cpus().length)')
          make transpile_go

      # TODO: Remove this after Go polymorph does not generate unwanted duplicate code.
      - name: Purge polymorph code in Go
        if: matrix.language == 'go'
        shell: bash
        working-directory: ./${{ matrix.library }}
        run: |
          make purge_polymorph_code

      - name: Create Manifests
        if: matrix.language != 'go'
        working-directory: ./${{ matrix.library }}
        run: make test_generate_vectors_${{ matrix.language }}_legacy_format

      - name: Create Encrypt Manifests
        if: matrix.language != 'go'
        working-directory: ./${{ matrix.library }}
        run: make test_encrypt_vectors_${{ matrix.language }}_legacy_format

      - name: Create Encrypt Manifests
        if: matrix.language == 'go'
        working-directory: ./${{ matrix.library }}
        run: |
          cp dafny/TestVectors/test/keys.json runtimes/go
          make test_encrypt_vectors_${{ matrix.language }}_legacy_format

      - name: Upload Encrypt Manifest and keys.json files
        uses: actions/upload-artifact@v4
        with:
          name: ${{matrix.os}}_vector_artifact_${{matrix.language}}_legacy_format_${{github.sha}}
          path: |
            ./${{matrix.library}}/runtimes/${{matrix.language}}/*.json
            ./${{matrix.library}}/runtimes/${{matrix.language}}/plaintexts
            ./${{matrix.library}}/runtimes/${{matrix.language}}/ciphertexts

  testInteroperablity:
    needs: generateMkpKeyringLegacyFormatEncryptVectors
    strategy:
      fail-fast: false
      matrix:
        library: [TestVectors]
        os: [
            # https://taskei.amazon.dev/tasks/CrypTool-5283
            # windows-latest,
            ubuntu-22.04,
          ]
        decrypting_language: [java, net, rust, python, python_mkp, java_mkp, go]
        # https://taskei.amazon.dev/tasks/CrypTool-5284
        dotnet-version: ["6.0.x"]
    runs-on: ${{ matrix.os }}
    permissions:
      id-token: write
      contents: read

    steps:
      - name: Support longpaths on Git checkout
        run: |
          git config --global core.longpaths true

      # TestVectors will call KMS
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v5
        with:
          aws-region: us-west-2
          role-to-assume: arn:aws:iam::370957321024:role/GitHub-CI-Public-ESDK-Dafny-Role-us-west-2
          role-session-name: InterOpTests
          role-duration-seconds: 3600

      - uses: actions/checkout@v6
        with:
          submodules: "recursive"

      # Set up runtimes
      - name: Setup .NET Core SDK ${{ matrix.dotnet-version }}
        if: matrix.decrypting_language == 'net'
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: ${{ matrix.dotnet-version }}

      # Setup Java in Rust is needed for running polymorph
      - name: Setup Java 17
        if: matrix.decrypting_language == 'java' || matrix.decrypting_language == 'java_mkp'|| matrix.decrypting_language == 'rust'
        uses: actions/setup-java@v5
        with:
          distribution: "corretto"
          java-version: 17

      - name: Setup Python for running tests
        if: matrix.decrypting_language == 'python' || matrix.decrypting_language == 'python_mkp'
        uses: actions/setup-python@v6
        with:
          python-version: 3.11
          architecture: x64
      - run: |
          python -m pip install --upgrade pip
          pip install --upgrade tox
          pip install poetry

      - name: Setup Rust Toolchain for GitHub CI
        if: matrix.decrypting_language == 'rust'
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          components: rustfmt

      - name: Setup NASM for Windows in Rust (aws-lc-sys)
        if: matrix.decrypting_language == 'rust' && matrix.os == 'windows-latest'
        uses: ilammy/setup-nasm@v1

      - name: Setup Dafny Rust
        if: matrix.decrypting_language == 'rust'
        uses: ./mpl/.github/actions/setup_dafny
        with:
          dafny-version: 4.10.0

      - name: Setup Dafny Not Rust
        if: matrix.decrypting_language != 'rust'
        uses: ./mpl/.github/actions/setup_dafny
        with:
          dafny-version: ${{ inputs.dafny }}

      - name: Install Smithy-Dafny codegen dependencies
        uses: ./.github/actions/install_smithy_dafny_codegen_dependencies

      - name: Regenerate code using smithy-dafny if necessary
        if: ${{ inputs.regenerate-code }}
        uses: ./.github/actions/polymorph_codegen
        with:
          dafny: ${{ inputs.dafny }}
          library: ${{ matrix.library }}
          diff-generated-code: false

      # Build implementation for each runtime
      - name: Build ${{ matrix.library }} implementation in Java
        if: matrix.decrypting_language == 'java' || matrix.decrypting_language == 'java_mkp'
        working-directory: ./${{ matrix.library }}
        shell: bash
        run: |
          # This works because `node` is installed by default on GHA runners
          CORES=$(node -e 'console.log(os.cpus().length)')
          make build_java CORES=$CORES

      - name: Build ${{ matrix.library }} implementation in .NET
        if: matrix.decrypting_language == 'net'
        working-directory: ./${{ matrix.library }}
        shell: bash
        run: |
          # This works because `node` is installed by default on GHA runners
          CORES=$(node -e 'console.log(os.cpus().length)')
          make transpile_net

      - name: Install Smithy-Dafny codegen dependencies
        if: matrix.decrypting_language == 'rust'
        uses: ./.github/actions/install_smithy_dafny_codegen_dependencies

      - name: Run make polymorph_rust
        if: matrix.decrypting_language == 'rust'
        shell: bash
        working-directory: ./${{ matrix.library }}
        run: |
          make polymorph_rust

      - name: Build ${{ matrix.library }} implementation in Rust
        if: matrix.decrypting_language == 'rust'
        shell: bash
        working-directory: ./${{ matrix.library }}
        run: |
          CORES=$(node -e 'console.log(os.cpus().length)')
          make transpile_rust CORES=$CORES

      - name: Build ${{ matrix.library }} implementation in Go
        if: matrix.decrypting_language == 'go'
        shell: bash
        working-directory: ./${{ matrix.library }}
        run: |
          # This works because `node` is installed by default on GHA runners
          CORES=$(node -e 'console.log(os.cpus().length)')
          make transpile_go

      # TODO: Remove this after Go polymorph does not generate unwanted duplicate code.
      - name: Purge polymorph code in Go
        if: matrix.decrypting_language == 'go'
        shell: bash
        working-directory: ./${{ matrix.library }}
        run: |
          make purge_polymorph_code

      - name: Build ${{ matrix.library }} implementation in Python
        if: matrix.decrypting_language == 'python' || matrix.decrypting_language == 'python_mkp'
        shell: bash
        working-directory: ./${{ matrix.library }}
        run: |
          CORES=$(node -e 'console.log(os.cpus().length)')
          make transpile_python CORES=$CORES

      # TestVectors will call KMS
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v5
        with:
          aws-region: us-west-2
          role-to-assume: arn:aws:iam::370957321024:role/GitHub-CI-Public-ESDK-Dafny-Role-us-west-2
          role-session-name: InterOpTests
          role-duration-seconds: 3600

      - name: Download Encrypt Manifest Artifact
        uses: actions/download-artifact@v7
        with:
          name: ${{matrix.os}}_vector_artifact_java_legacy_format_${{github.sha}}
          path: ./${{matrix.library}}/runtimes/${{matrix.decrypting_language}}

      - name: Decrypt Encrypt Manifest
        working-directory: ./${{ matrix.library }}
        run: make test_decrypt_encrypt_vectors_${{matrix.decrypting_language}}

      # TestVectors will call KMS
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v5
        with:
          aws-region: us-west-2
          role-to-assume: arn:aws:iam::370957321024:role/GitHub-CI-Public-ESDK-Dafny-Role-us-west-2
          role-session-name: InterOpTests
          role-duration-seconds: 3600

      - name: Download Encrypt Manifest Artifact
        uses: actions/download-artifact@v7
        with:
          name: ${{matrix.os}}_vector_artifact_net_legacy_format_${{github.sha}}
          path: ./${{matrix.library}}/runtimes/${{matrix.decrypting_language}}

      - name: Decrypt Encrypt Manifest
        working-directory: ./${{ matrix.library }}
        run: make test_decrypt_encrypt_vectors_${{matrix.decrypting_language}}

      # TestVectors will call KMS
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v5
        with:
          aws-region: us-west-2
          role-to-assume: arn:aws:iam::370957321024:role/GitHub-CI-Public-ESDK-Dafny-Role-us-west-2
          role-session-name: InterOpTests
          role-duration-seconds: 3600

      - name: Download Encrypt Manifest Artifact
        uses: actions/download-artifact@v7
        with:
          name: ${{matrix.os}}_vector_artifact_rust_legacy_format_${{github.sha}}
          path: ./${{matrix.library}}/runtimes/${{matrix.decrypting_language}}

      - name: Decrypt Encrypt Manifest
        working-directory: ./${{ matrix.library }}
        run: make test_decrypt_encrypt_vectors_${{matrix.decrypting_language}}

      # TestVectors will call KMS
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v5
        with:
          aws-region: us-west-2
          role-to-assume: arn:aws:iam::370957321024:role/GitHub-CI-Public-ESDK-Dafny-Role-us-west-2
          role-session-name: InterOpTests
          role-duration-seconds: 3600

      - name: Download Encrypt Manifest Artifact
        uses: actions/download-artifact@v7
        with:
          name: ${{matrix.os}}_vector_artifact_python_legacy_format_${{github.sha}}
          path: ./${{matrix.library}}/runtimes/${{matrix.decrypting_language}}

      - name: Decrypt Encrypt Manifest
        working-directory: ./${{ matrix.library }}
        run: make test_decrypt_encrypt_vectors_${{matrix.decrypting_language}}

      # TestVectors will call KMS
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v5
        with:
          aws-region: us-west-2
          role-to-assume: arn:aws:iam::370957321024:role/GitHub-CI-Public-ESDK-Dafny-Role-us-west-2
          role-session-name: InterOpTests
          role-duration-seconds: 3600

      - name: Download Encrypt Manifest Artifact
        uses: actions/download-artifact@v7
        with:
          name: ${{matrix.os}}_vector_artifact_python_mkp_legacy_format_${{github.sha}}
          path: ./${{matrix.library}}/runtimes/${{matrix.decrypting_language}}

      - name: Decrypt Encrypt Manifest
        working-directory: ./${{ matrix.library }}
        run: make test_decrypt_encrypt_vectors_${{matrix.decrypting_language}}

      # TestVectors will call KMS
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v5
        with:
          aws-region: us-west-2
          role-to-assume: arn:aws:iam::370957321024:role/GitHub-CI-Public-ESDK-Dafny-Role-us-west-2
          role-session-name: InterOpTests
          role-duration-seconds: 3600

      - name: Download Encrypt Manifest Artifact
        uses: actions/download-artifact@v7
        with:
          name: ${{matrix.os}}_vector_artifact_java_mkp_legacy_format_${{github.sha}}
          path: ./${{matrix.library}}/runtimes/${{matrix.decrypting_language}}

      - name: Decrypt Encrypt Manifest
        working-directory: ./${{ matrix.library }}
        run: make test_decrypt_encrypt_vectors_${{matrix.decrypting_language}}

      # TestVectors will call KMS
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v5
        with:
          aws-region: us-west-2
          role-to-assume: arn:aws:iam::370957321024:role/GitHub-CI-Public-ESDK-Dafny-Role-us-west-2
          role-session-name: InterOpTests
          role-duration-seconds: 3600

      - name: Download Encrypt Manifest Artifact
        uses: actions/download-artifact@v7
        with:
          name: ${{matrix.os}}_vector_artifact_go_legacy_format_${{github.sha}}
          path: ./${{matrix.library}}/runtimes/${{matrix.decrypting_language}}

      - name: Decrypt Encrypt Manifest
        working-directory: ./${{ matrix.library }}
        run: make test_decrypt_encrypt_vectors_${{matrix.decrypting_language}}

  testInteroperabilityWithJs:
    needs: generateMkpKeyringLegacyFormatEncryptVectors
    strategy:
      fail-fast: false
      matrix:
        library: [TestVectors]
        os: [
            # https://taskei.amazon.dev/tasks/CrypTool-5283
            # windows-latest,
            ubuntu-22.04,
          ]
        encrypting_language: [java, net, rust, python, python_mkp, java_mkp, go]
        # https://taskei.amazon.dev/tasks/CrypTool-5284
        dotnet-version: ["6.0.x"]
    runs-on: ${{ matrix.os }}
    permissions:
      id-token: write
      contents: read

    steps:
      - name: Support longpaths on Git checkout
        run: |
          git config --global core.longpaths true

      - uses: actions/checkout@v6
        with:
          submodules: "recursive"

      # TestVectors will call KMS
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v5
        with:
          aws-region: us-west-2
          role-to-assume: arn:aws:iam::370957321024:role/GitHub-CI-Public-ESDK-Dafny-Role-us-west-2
          role-session-name: InterOpTests
          role-duration-seconds: 3600

      - uses: actions/setup-node@v5
        with:
          node-version: 17

      - name: Install deps
        run: |
          openssl version
          npm install @aws-crypto/integration-node
          npm install fast-xml-parser

      - name: Download Encrypt Manifest Artifact
        uses: actions/download-artifact@v7
        with:
          name: ${{matrix.os}}_vector_artifact_${{matrix.encrypting_language}}_legacy_format_${{github.sha}}
          path: ./${{matrix.library}}/runtimes/

      # Sadly we have to zip up the artifacts again to be consumed by JS
      - name: Decrypt Generated Test Vectors with ESDK-JS
        working-directory: ${{matrix.library}}/runtimes
        shell: bash
        run: |
          zip -qq tests.zip -r ciphertexts plaintexts *.json

      - name: Decrypt Generated Test Vectors with ESDK-JS
        working-directory: ${{matrix.library}}/runtimes
        shell: bash
        run: |
          npx -y @aws-crypto/integration-node decrypt -v tests.zip -c cpu -f 100 -C

  testWritesWithJs:
    needs: generateMkpKeyringLegacyFormatEncryptVectors
    strategy:
      fail-fast: false
      matrix:
        library: [TestVectors]
        os: [
            # https://taskei.amazon.dev/tasks/CrypTool-5283
            # windows-latest,
            ubuntu-22.04,
          ]
        # https://taskei.amazon.dev/tasks/CrypTool-5284
        dotnet-version: ["6.0.x"]
    runs-on: ${{ matrix.os }}
    permissions:
      id-token: write
      contents: read

    steps:
      - name: Support longpaths on Git checkout
        run: |
          git config --global core.longpaths true

      - uses: actions/checkout@v6
        with:
          submodules: "recursive"

      # TestVectors will call KMS
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v5
        with:
          aws-region: us-west-2
          role-to-assume: arn:aws:iam::370957321024:role/GitHub-CI-Public-ESDK-Dafny-Role-us-west-2
          role-session-name: InterOpTests
          role-duration-seconds: 3600

      - uses: actions/setup-node@v5
        with:
          node-version: 17

      - name: Install deps
        run: |
          openssl version
          npm install @aws-crypto/integration-node
          npm install fast-xml-parser

      - name: Download Encrypt Manifest Artifact
        uses: actions/download-artifact@v7
        with:
          # we can pick any manifest we want. i choose java because it runs 6 billion devices
          name: ubuntu-22.04_vector_artifact_java_legacy_format_${{github.sha}}
          path: ./${{matrix.library}}

      - name: Create JS decrypt manifest
        working-directory: ${{matrix.library}}
        shell: bash
        run: |
          npx -y @aws-crypto/integration-node encrypt -m encrypt-manifest.json -k keys.json -d decrypt-manifest-js.zip -C

      - name: Upload Encrypt Manifest and keys.json files
        uses: actions/upload-artifact@v4
        with:
          name: ${{matrix.os}}_vector_artifact_javascript_legacy_format_${{github.sha}}
          path: |
            ./${{matrix.library}}/decrypt-manifest-js.zip

  testWhatJsWrote:
    needs: testWritesWithJs
    strategy:
      fail-fast: false
      matrix:
        library: [TestVectors]
        os: [
            # https://taskei.amazon.dev/tasks/CrypTool-5283
            # windows-latest,
            ubuntu-22.04,
          ]
        decrypting_language: [java, net, rust, python, python_mkp, java_mkp, go]
        # https://taskei.amazon.dev/tasks/CrypTool-5284
        dotnet-version: ["6.0.x"]
    runs-on: ${{ matrix.os }}
    permissions:
      id-token: write
      contents: read

    steps:
      - name: Support longpaths on Git checkout
        run: |
          git config --global core.longpaths true

      # TestVectors will call KMS
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v5
        with:
          aws-region: us-west-2
          role-to-assume: arn:aws:iam::370957321024:role/GitHub-CI-Public-ESDK-Dafny-Role-us-west-2
          role-session-name: InterOpTests
          role-duration-seconds: 3600

      - uses: actions/checkout@v6
        with:
          submodules: "recursive"

      # Set up runtimes
      - name: Setup .NET Core SDK ${{ matrix.dotnet-version }}
        if: matrix.decrypting_language == 'net'
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: ${{ matrix.dotnet-version }}

      # Setup Java in Rust is needed for running polymorph
      - name: Setup Java 17
        if: matrix.decrypting_language == 'java' || matrix.decrypting_language == 'java_mkp'|| matrix.decrypting_language == 'rust'
        uses: actions/setup-java@v5
        with:
          distribution: "corretto"
          java-version: 17

      - name: Setup Python for running tests
        if: matrix.decrypting_language == 'python' || matrix.decrypting_language == 'python_mkp'
        uses: actions/setup-python@v6
        with:
          python-version: 3.11
          architecture: x64
      - run: |
          python -m pip install --upgrade pip
          pip install --upgrade tox
          pip install poetry

      - name: Setup Rust Toolchain for GitHub CI
        if: matrix.decrypting_language == 'rust'
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          components: rustfmt

      - name: Setup NASM for Windows in Rust (aws-lc-sys)
        if: matrix.decrypting_language == 'rust' && matrix.os == 'windows-latest'
        uses: ilammy/setup-nasm@v1

      - name: Setup Dafny Rust
        if: matrix.decrypting_language == 'rust'
        uses: ./mpl/.github/actions/setup_dafny
        with:
          dafny-version: 4.10.0

      - name: Setup Dafny Not Rust
        if: matrix.decrypting_language != 'rust'
        uses: ./mpl/.github/actions/setup_dafny
        with:
          dafny-version: ${{ inputs.dafny }}

      - name: Install Smithy-Dafny codegen dependencies
        uses: ./.github/actions/install_smithy_dafny_codegen_dependencies

      - name: Regenerate code using smithy-dafny if necessary
        if: ${{ inputs.regenerate-code }}
        uses: ./.github/actions/polymorph_codegen
        with:
          dafny: ${{ inputs.dafny }}
          library: ${{ matrix.library }}
          diff-generated-code: false

      # Build implementation for each runtime
      - name: Build ${{ matrix.library }} implementation in Java
        if: matrix.decrypting_language == 'java' || matrix.decrypting_language == 'java_mkp'
        working-directory: ./${{ matrix.library }}
        shell: bash
        run: |
          # This works because `node` is installed by default on GHA runners
          CORES=$(node -e 'console.log(os.cpus().length)')
          make build_java CORES=$CORES

      - name: Build ${{ matrix.library }} implementation in .NET
        if: matrix.decrypting_language == 'net'
        working-directory: ./${{ matrix.library }}
        shell: bash
        run: |
          # This works because `node` is installed by default on GHA runners
          CORES=$(node -e 'console.log(os.cpus().length)')
          make transpile_net

      - name: Install Smithy-Dafny codegen dependencies
        if: matrix.decrypting_language == 'rust'
        uses: ./.github/actions/install_smithy_dafny_codegen_dependencies

      - name: Run make polymorph_rust
        if: matrix.decrypting_language == 'rust'
        shell: bash
        working-directory: ./${{ matrix.library }}
        run: |
          make polymorph_rust

      - name: Build ${{ matrix.library }} implementation in Rust
        if: matrix.decrypting_language == 'rust'
        shell: bash
        working-directory: ./${{ matrix.library }}
        run: |
          CORES=$(node -e 'console.log(os.cpus().length)')
          make transpile_rust CORES=$CORES

      - name: Build ${{ matrix.library }} implementation in Go
        if: matrix.decrypting_language == 'go'
        shell: bash
        working-directory: ./${{ matrix.library }}
        run: |
          # This works because `node` is installed by default on GHA runners
          CORES=$(node -e 'console.log(os.cpus().length)')
          make transpile_go

      # TODO: Remove this after Go polymorph does not generate unwanted duplicate code.
      - name: Purge polymorph code in Go
        if: matrix.decrypting_language == 'go'
        shell: bash
        working-directory: ./${{ matrix.library }}
        run: |
          make purge_polymorph_code

      - name: Build ${{ matrix.library }} implementation in Python
        if: matrix.decrypting_language == 'python' || matrix.decrypting_language == 'python_mkp'
        shell: bash
        working-directory: ./${{ matrix.library }}
        run: |
          CORES=$(node -e 'console.log(os.cpus().length)')
          make transpile_python CORES=$CORES

      - name: Download Encrypt Manifest Artifact
        uses: actions/download-artifact@v7
        with:
          name: ${{matrix.os}}_vector_artifact_javascript_legacy_format_${{github.sha}}
          path: ./${{matrix.library}}/runtimes/${{matrix.decrypting_language}}

      - name: Decrypt Encrypt Manifest
        working-directory: ./${{ matrix.library }}
        run: |
          unzip runtimes/${{matrix.decrypting_language}}/decrypt-manifest-js.zip -d runtimes/${{matrix.decrypting_language}}
          ls
          make test_decrypt_encrypt_vectors_${{matrix.decrypting_language}}