feat: run TestVectors tests in CI (#206)

* feat: run TestVectors tests in CI

---------

Co-authored-by: Valerie Lambert <lavaleri@amazon.com>

Author: ajewellamz

.github/workflows/ci_test_java.yml

@@ -30,7 +30,7 @@ jobs:
     strategy:
       matrix:
         library: [
-          DynamoDbEncryption,
+          DynamoDbEncryption
         ]
         java-version: [ 8, 11, 16, 17 ]
         os: [

.github/workflows/ci_test_vector_java.yml

@@ -0,0 +1,73 @@
+# This workflow performs test vectors in Java.
+name: Library Java Test Vectors
+
+on: 
+  pull_request:
+  push:
+    branches:
+      - main
+
+jobs:
+  testJava:
+    strategy:
+      matrix:
+        java-version: [ 8, 11, 16, 17 ]
+        os: [
+          # Run on ubuntu image that comes pre-configured with docker
+          ubuntu-latest
+        ]
+    runs-on: ${{ matrix.os }}
+    environment: "MPL CI"
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - name: Setup DynamoDB Local
+        uses: rrainn/dynamodb-action@v2.0.1
+        with:
+          port: 8000
+          cors: '*'
+
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v1
+        with:
+          aws-region: us-west-2
+          role-to-assume: arn:aws:iam::370957321024:role/GitHub-CI-DDBEC-Dafny-Role-us-west-2
+          role-session-name: DDBEC-Dafny-Java-Tests
+
+      - uses: actions/checkout@v3
+
+      - name: Init Submodules
+        env:
+          # This secret is in the configured environment,
+          # and set to expire every 30 days
+          MPL_PAT: ${{ secrets.MPL_PAT }}
+        run: |
+          AUTH="$(echo -n "pat:${MPL_PAT}" | base64 | tr -d '\n')"
+          git config --global http.https://github.com/.extraheader "AUTHORIZATION: basic $AUTH"
+          git config --global --add url.https://github.com/.insteadOf git@github.com:
+          git submodule update --init --recursive submodules/MaterialProviders
+
+      - name: Setup Dafny
+        uses: dafny-lang/setup-dafny-action@v1.6.1
+        with:
+          dafny-version: '4.1.0'
+
+      - name: Setup Java ${{ matrix.java-version }}
+        uses: actions/setup-java@v3
+        with:
+          distribution: 'corretto'
+          java-version: ${{ matrix.java-version }}
+
+      - name: Build TestVectors implementation
+        shell: bash
+        working-directory: ./TestVectors
+        run: |
+          # This works because `node` is installed by default on GHA runners
+          CORES=$(node -e 'console.log(os.cpus().length)')
+          make build_java CORES=$CORES
+
+      - name: Test TestVectors
+        working-directory: ./TestVectors
+        run: |
+          make test_java

TestVectors/dafny/DDBEncryption/src/JsonItem.dfy

@@ -285,8 +285,14 @@ module {:options "-functionSyntax:4"} DdbItemJson {
         :- Need(data.Array?, "Value for 'NS' must be a Array");
         var result : seq<string> := [];
         for i := 0 to |data.arr| {
-          :- Need(data.arr[i].String?, "Values for 'NS' must be Strings");
-          result := result + [data.arr[i].str];
+          if data.arr[i].String? {
+            result := result + [data.arr[i].str];
+          } else if data.arr[i].Number? {
+            var val :- DecimalToStr(data.arr[i].num);
+            result := result + [val];
+          } else {
+            return Failure("Values for 'NS' must be Strings or Numbers");
+          }
         }
         return Success(DDB.AttributeValue.NS(result));
       case "B" =>

TestVectors/dafny/DDBEncryption/src/TestVectors.dfy

@@ -373,7 +373,6 @@ module {:options "-functionSyntax:4"} DdbEncryptionTestVectors {
     {
       print "RunIoTests\n";
       for i := 0 to |ioTests| {
-        print "RunIoTest ", i, "\n";
         BasicIoTestBatchWriteItem(ioTests[i].writeConfig, ioTests[i].readConfig, ioTests[i].records);
         BasicIoTestPutItem(ioTests[i].writeConfig, ioTests[i].readConfig, ioTests[i].records);
         BasicIoTestTransactWriteItems(ioTests[i].writeConfig, ioTests[i].readConfig, ioTests[i].records);

TestVectors/runtimes/java/build.gradle.kts

@@ -1,5 +1,7 @@
 import java.net.URI
 import javax.annotation.Nullable
+import org.gradle.api.tasks.testing.logging.TestExceptionFormat
+import org.gradle.api.tasks.testing.logging.TestLogEvent
 
 tasks.wrapper {
     gradleVersion = "7.6"
@@ -26,38 +28,26 @@ java {
     }
 }
 
-var caUrl: URI? = null
-@Nullable
-val caUrlStr: String? = System.getenv("CODEARTIFACT_URL_JAVA_CONVERSION")
-if (!caUrlStr.isNullOrBlank()) {
-    caUrl = URI.create(caUrlStr)
-}
-
-var caPassword: String? = null
-@Nullable
-val caPasswordString: String? = System.getenv("CODEARTIFACT_AUTH_TOKEN")
-if (!caPasswordString.isNullOrBlank()) {
-    caPassword = caPasswordString
+tasks.withType<JavaCompile>() {
+    options.encoding = "UTF-8"
 }
 
 repositories {
+    maven {
+        name = "DynamoDB Local Release Repository - US West (Oregon) Region"
+        url  = URI.create("https://s3-us-west-2.amazonaws.com/dynamodb-local/release")
+    }
     mavenCentral()
     mavenLocal()
-    if (caUrl != null && caPassword != null) {
-        maven {
-            name = "CodeArtifact"
-            url = caUrl!!
-            credentials {
-                username = "aws"
-                password = caPassword!!
-            }
-        }
-    }
 }
 
+// Configuration to hold SQLLite information.
+// DynamoDB-Local needs to have access to native sqllite4java.
+val dynamodb by configurations.creating
+
 dependencies {
     implementation("org.dafny:DafnyRuntime:4.0.0")
-    implementation("software.amazon.dafny:conversion:1.0-SNAPSHOT")
+    implementation("software.amazon.smithy.dafny:conversion:0.1")
     implementation("software.amazon.cryptography:StandardLibrary:1.0-SNAPSHOT")
     implementation("software.amazon.cryptography:AwsCryptographyPrimitives:1.0-SNAPSHOT")
     implementation("software.amazon.cryptography:AwsCryptographicMaterialProviders:1.0-SNAPSHOT")
@@ -71,7 +61,16 @@ dependencies {
     implementation("software.amazon.awssdk:dynamodb-enhanced")
     implementation("software.amazon.awssdk:core:2.19.1")
     implementation("software.amazon.awssdk:kms")
-
+    testImplementation("com.amazonaws:DynamoDBLocal:1.+")
+    // This is where we gather the SQLLite files to copy over
+    dynamodb("com.amazonaws:DynamoDBLocal:1.+")
+    // As of 1.21.0 DynamoDBLocal does not support Apple Silicon
+    // This checks the dependencies and adds a native library
+    // to support this architecture.
+    if (org.apache.tools.ant.taskdefs.condition.Os.isArch("aarch64")) {
+        testImplementation("io.github.ganadist.sqlite4java:libsqlite4java-osx-aarch64:1.0.392")
+        dynamodb("io.github.ganadist.sqlite4java:libsqlite4java-osx-aarch64:1.0.392")
+    }
 }
 
 publishing {
@@ -83,17 +82,25 @@ publishing {
     repositories { mavenLocal() }
 }
 
-tasks.withType<JavaCompile>() {
-    options.encoding = "UTF-8"
+
+tasks.register<Copy>("copyKeysJSON") {
+    from(layout.projectDirectory.file("../../../submodules/MaterialProviders/TestVectorsAwsCryptographicMaterialProviders/dafny/TestVectorsAwsCryptographicMaterialProviders/test/keys.json"))
+    into(layout.projectDirectory.dir("dafny/DDBEncryption/test"))
+}
+
+tasks.register<Copy>("CopyDynamoDb")  {
+    from (dynamodb) {
+        include("*.dll")
+        include("*.dylib")
+        include("*.so")
+    }
+    into("build/libs")
 }
 
 tasks.register<JavaExec>("runTests") {
+    dependsOn("CopyDynamoDb")
     dependsOn("copyKeysJSON")
+    systemProperty("java.library.path", "build/libs")
     mainClass.set("TestsFromDafny")
     classpath = sourceSets["test"].runtimeClasspath
 }
-
-tasks.register<Copy>("copyKeysJSON") {
-    from(layout.projectDirectory.file("../../../submodules/MaterialProviders/TestVectorsAwsCryptographicMaterialProviders/dafny/TestVectorsAwsCryptographicMaterialProviders/test/keys.json"))
-    into(layout.projectDirectory.dir("dafny/DDBEncryption/test"))
-}