Skip to content

Commit 3f304fd

Browse files
olenarostotskyyolenarostotskyy
authored
Merge branch 'main' into olrostob/s3tables-new-features
2 parents c7a2825 + 4811fb4 commit 3f304fd

File tree

5,799 files changed

+1360558
-1085419
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

5,799 files changed

+1360558
-1085419
lines changed

‎.github/workflows/close-stale-prs.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ jobs:
1010
permissions:
1111
pull-requests: write
1212
runs-on: ubuntu-latest
13+
environment: automation
1314
steps:
1415
- uses: cdklabs/close-stale-prs@main
1516
with:

‎.github/workflows/codebuild-pr-build.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,7 @@ jobs:
102102
103103
- name: Upload PR info artifact
104104
if: github.event_name == 'pull_request'
105-
uses: actions/upload-artifact@v6
105+
uses: actions/upload-artifact@v7
106106
with:
107107
name: pr_info
108108
path: pr/

‎.github/workflows/codecov-collect.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ jobs:
2828
run: cd packages/aws-cdk-lib && yarn test core
2929

3030
- name: Upload Coverage and PR Info
31-
uses: actions/upload-artifact@v6
31+
uses: actions/upload-artifact@v7
3232
with:
3333
name: coverage-artifacts
3434
path: |

‎.github/workflows/codecov-upload.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ jobs:
2323
- name: Checkout
2424
uses: actions/checkout@v6
2525
- name: Download Artifacts
26-
uses: actions/download-artifact@v7
26+
uses: actions/download-artifact@v8
2727
with:
2828
name: coverage-artifacts
2929
path: ./packages/aws-cdk-lib/core/coverage

‎.github/workflows/enum-auto-updater.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ jobs:
2323
NODE_OPTIONS: "--max-old-space-size=8196 --experimental-worker ${NODE_OPTIONS:-}"
2424

2525
- name: Install dependencies
26-
run: cd tools/@aws-cdk/enum-updater && yarn install --frozen-lockfile && yarn build
26+
run: yarn install --frozen-lockfile && cd tools/@aws-cdk/enum-updater && yarn build
2727

2828
- name: Identify Missing Values and Apply Code Changes
2929
run: |

‎.github/workflows/integration-test-deployment-auto.yml‎

Lines changed: 157 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
name: Integration Test deployment (Auto)
2+
3+
# This workflow automatically runs integration tests when a PR with snapshot changes
4+
# is approved by a CDK team member. No manual approval required.
5+
#
6+
# SHADOW MODE: This workflow is in shadow mode - failures don't block PR merges.
7+
# Once validated, this will replace the label-based workflow (integration-test-deployment.yml).
8+
9+
on:
10+
pull_request_review:
11+
types: [submitted]
12+
13+
concurrency:
14+
group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
15+
cancel-in-progress: true
16+
17+
jobs:
18+
# Early validation: Check if approver is a CDK team member and PR has snapshot changes
19+
validate_approver:
20+
if: github.event.review.state == 'approved'
21+
runs-on: ubuntu-latest
22+
outputs:
23+
should_run: ${{ steps.check_team.outputs.is_member == 'true' && steps.check_snapshots.outputs.has_snapshots == 'true' }}
24+
permissions:
25+
contents: read
26+
pull-requests: read
27+
steps:
28+
- name: Checkout for path filtering
29+
uses: actions/checkout@v6
30+
with:
31+
ref: ${{ github.event.pull_request.head.sha }}
32+
fetch-depth: 0
33+
34+
- name: Setup Node.js
35+
uses: actions/setup-node@v6
36+
with:
37+
node-version: "lts/*"
38+
39+
- name: Install dependencies
40+
run: yarn install --frozen-lockfile
41+
42+
- name: Build deployment-integ
43+
run: yarn --cwd tools/@aws-cdk/integration-test-deployment build
44+
45+
- name: Check for snapshot changes
46+
id: check_snapshots
47+
env:
48+
TARGET_BRANCH_COMMIT: ${{ github.event.pull_request.base.sha }}
49+
SOURCE_BRANCH_COMMIT: ${{ github.event.pull_request.head.sha }}
50+
run: |
51+
# Reuses getChangedSnapshots() from utils.ts — single source of truth
52+
if yarn --cwd tools/@aws-cdk/integration-test-deployment check-snapshots; then
53+
echo "has_snapshots=true" >> $GITHUB_OUTPUT
54+
else
55+
echo "has_snapshots=false" >> $GITHUB_OUTPUT
56+
fi
57+
58+
- name: Check if approver is CDK team member
59+
id: check_team
60+
if: steps.check_snapshots.outputs.has_snapshots == 'true'
61+
env:
62+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
63+
APPROVER: ${{ github.event.review.user.login }}
64+
run: |
65+
# Use gh CLI to check team membership (pre-installed in GitHub Actions runners)
66+
# https://docs.github.com/en/rest/teams/members#get-team-membership-for-a-user
67+
if gh api "orgs/aws/teams/aws-cdk-team/memberships/${APPROVER}" --jq '.state' 2>/dev/null | grep -q "active"; then
68+
echo "${APPROVER} is an active CDK team member"
69+
echo "is_member=true" >> $GITHUB_OUTPUT
70+
else
71+
echo "${APPROVER} is not a CDK team member or membership is not active"
72+
echo "is_member=false" >> $GITHUB_OUTPUT
73+
fi
74+
75+
integration_test_deployment_auto:
76+
needs: validate_approver
77+
# Only run if approver is a CDK team member AND PR has snapshot changes
78+
if: needs.validate_approver.outputs.should_run == 'true'
79+
runs-on: codebuild-aws-cdk-github-actions-deployment-integ-runner-${{ github.run_id }}-${{ github.run_attempt }}
80+
# No environment - runs automatically without manual approval
81+
# Shadow mode: workflow reports success even if tests fail
82+
continue-on-error: true
83+
name: 'Deploy integration test snapshots (Auto)'
84+
85+
# Job-level permissions for least privilege
86+
permissions:
87+
id-token: write # Required for OIDC authentication with AWS Atmosphere
88+
pull-requests: read # Required to check PR reviews and labels
89+
contents: read # Required to checkout code
90+
91+
env:
92+
PR_BUILD: true
93+
94+
steps:
95+
- name: Checkout HEAD
96+
uses: actions/checkout@v6
97+
with:
98+
ref: ${{ github.event.pull_request.head.sha }}
99+
fetch-depth: 0
100+
101+
- name: Setup Node.js
102+
uses: actions/setup-node@v6
103+
with:
104+
node-version: "lts/*"
105+
cache: "yarn"
106+
cache-dependency-path: |
107+
yarn.lock
108+
109+
- name: Set up Docker
110+
uses: docker/setup-buildx-action@v3
111+
112+
- name: Load Docker images
113+
id: docker-cache
114+
uses: actions/cache/restore@v5
115+
with:
116+
path: |
117+
~/.docker-images.tar
118+
key: docker-cache-${{ runner.os }}
119+
120+
- name: Restore Docker images
121+
if: ${{ steps.docker-cache.outputs.cache-hit }}
122+
run: docker image load --input ~/.docker-images.tar
123+
124+
- name: Cache build artifacts
125+
uses: actions/cache@v5
126+
with:
127+
path: |
128+
~/.s3buildcache
129+
key: s3buildcache-${{ runner.os }}
130+
131+
- name: Configure system settings
132+
run: |
133+
(command -v sysctl || sudo apt-get update && sudo apt-get install -y procps) && \
134+
sudo sysctl -w vm.max_map_count=2251954
135+
136+
- name: Install dependencies for Integration Tests
137+
run: yarn install --frozen-lockfile
138+
139+
- name: Build deployment-integ
140+
run: yarn --cwd tools/@aws-cdk/integration-test-deployment build
141+
142+
- name: Build Integration Test packages
143+
run: npx lerna run build --scope="{@aws-cdk/*,@aws-cdk-testing/framework-integ}"
144+
145+
- name: Run integration tests
146+
run: yarn run atmosphere-integ-test
147+
env:
148+
CDK_ATMOSPHERE_ENDPOINT: ${{ vars.CDK_ATMOSPHERE_ENDPOINT }}
149+
CDK_ATMOSPHERE_POOL: ${{ vars.CDK_ATMOSPHERE_POOL }}
150+
CDK_ATMOSPHERE_OIDC_ROLE: ${{ vars.CDK_ATMOSPHERE_OIDC_ROLE }}
151+
CDK_ATMOSPHERE_BATCH_SIZE: ${{ vars.CDK_ATMOSPHERE_BATCH_SIZE }}
152+
TARGET_BRANCH_COMMIT: ${{ github.event.pull_request.base.sha }}
153+
SOURCE_BRANCH_COMMIT: ${{ github.event.pull_request.head.sha }}
154+
# GitHub context for preflight check (validates CDK team membership)
155+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
156+
GITHUB_REPOSITORY: ${{ github.repository }}
157+
PR_NUMBER: ${{ github.event.pull_request.number }}

‎.github/workflows/integration-test-deployment.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ concurrency:
2525
jobs:
2626
integration_test_deployment:
2727
runs-on: codebuild-aws-cdk-github-actions-deployment-integ-runner-${{ github.run_id }}-${{ github.run_attempt }}
28+
timeout-minutes: 7200 # Maximum limit for self-hosted runners, job can still be limited by our runner timeout (which is set at 36 hours).
2829
environment: deployment-integ-test # Do not change or remove this without discussing with Appsec
2930
if: contains(github.event.pull_request.labels.*.name, 'pr/needs-integration-tests-deployment')
3031
name: 'Deploy integration test snapshots (requires `pr/needs-integration-tests-deployment` label)'

0 commit comments

Comments
 (0)
⚡