ci: add wycheproof vector test job

[MarkAtwood]

Summary

• Adds .github/workflows/wycheproof.yml which builds wolfSSL from the PR branch and runs it against the wolfSSL/wychcheck test suite (340+ Wycheproof JSON test files, NIST ACVP vectors, and RFC vectors covering AES-GCM, AES-EAX, AES-SIV, ChaCha20-Poly1305, RSA-PSS, RSA-OAEP, ECDH/ECDSA over all curves, X25519, ML-DSA, ML-KEM, SLH-DSA, EdDSA)
• Guarded with if: github.repository_owner == 'wolfssl' per project convention
• Only inits the wycheproof submodule (not acvp-server which is 900 MB)
• Uploads JUnit XML results as a build artifact

Relationship to wychcheck

wolfSSL/wychcheck already runs nightly against wolfssl/wolfssl master (Saturday 22:00 UTC). This job adds per-PR coverage so regressions are caught before merge rather than after.

Test plan

• Verify job appears in PR checks
• Confirm wolfcrypt-check builds and ctest passes
• Confirm artifact upload contains wycheproof-results/test-results.xml

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds a dedicated GitHub Actions workflow to run wolfSSL against the wolfSSL/wychcheck (Wycheproof + vector) suite on pushes and PRs, and to publish JUnit XML results as an artifact.

Changes:

• Introduces .github/workflows/wycheproof.yml with a new wycheproof CI job.
• Builds wolfSSL from the PR branch, builds wolfcrypt-check from wolfSSL/wychcheck, and executes ctest with JUnit output.
• Uploads the generated JUnit XML as a workflow artifact.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753

[dgarske]

PR needs work. https://github.com/wolfSSL/wolfssl/actions/runs/25226068617/job/73969813223?pr=10258

[MarkAtwood]

All review feedback addressed in the current commit (ff2fe91):

• --enable-keywrap → --enable-aeskeywrap (LinuxJedi's catch)
• Explicit apt-get install step added (Copilot suggestion)
• branches: ['**'] for PR trigger (Copilot suggestion)
• --depth 1 on submodule init (Copilot suggestion)
• vars.WYCHCHECK_REF for optional pinning (Copilot suggestion)

The May 1st CI failure was caused by the invalid --enable-keywrap flag, which is now fixed. Ready for re-review.

[MarkAtwood]

Root cause: wychcheck's CMakeLists.txt reads WOLFSSL_DIR from the environment ($ENV{WOLFSSL_DIR}), which overwrites any -D cache variable. Switched to passing it as an env: block so cmake picks it up. Also rebased onto current master.