layer_govcloud_verify.yml

# GovCloud Layer Verification
# ---
# This workflow queries the GovCloud layer info in production only

on:
  workflow_dispatch:
    inputs:
      version:
        description: Layer version to verify information
        type: string
        required: true
  workflow_call:
    inputs:
      version:
        description: Layer version to verify information
        type: string
        required: true

name: Layer Verification (GovCloud)
run-name: Layer Verification (GovCloud)

jobs:
  commercial:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    strategy:
      matrix:
        layer:
          - AWSLambdaPowertoolsPythonV3-python39
          - AWSLambdaPowertoolsPythonV3-python310
          - AWSLambdaPowertoolsPythonV3-python311
          - AWSLambdaPowertoolsPythonV3-python312
          - AWSLambdaPowertoolsPythonV3-python313
        arch:
          - arm64
          - x86_64
    environment: Prod (Readonly)
    steps:
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0
        with:
          role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
          aws-region: us-east-1
          mask-aws-account-id: true
      - name: Output ${{ matrix.layer }}-${{ matrix.arch }}
        run: |
          aws --region us-east-1 lambda get-layer-version-by-arn --arn 'arn:aws:lambda:us-east-1:017000801446:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ inputs.version }}' | jq -r '{"Layer Version Arn": .LayerVersionArn, "Version": .Version, "Description": .Description, "Compatible Runtimes": .CompatibleRuntimes[0], "Compatible Architectures": .CompatibleArchitectures[0], "SHA": .Content.CodeSha256} | keys[] as $k | [$k, .[$k]] | @tsv' | column -t -s $'\t'

  gov_east:
    name: Verify (East)
    needs: commercial
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    strategy:
      matrix:
        layer:
          - AWSLambdaPowertoolsPythonV3-python39
          - AWSLambdaPowertoolsPythonV3-python310
          - AWSLambdaPowertoolsPythonV3-python311
          - AWSLambdaPowertoolsPythonV3-python312
          - AWSLambdaPowertoolsPythonV3-python313
        arch:
          - arm64
          - x86_64
    environment: GovCloud Prod (East)
    steps:
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0
        with:
          role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
          aws-region: us-gov-east-1
          mask-aws-account-id: true
      - name: Verify Layer ${{ matrix.layer }}-${{ matrix.arch }}
        id: verify-layer
        run: |
          aws --region us-gov-east-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-east-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ inputs.version }}' | jq -r '{"Layer Version Arn": .LayerVersionArn, "Version": .Version, "Description": .Description, "Compatible Runtimes": .CompatibleRuntimes[0], "Compatible Architectures": .CompatibleArchitectures[0], "SHA": .Content.CodeSha256} | keys[] as $k | [$k, .[$k]] | @tsv' | column -t -s $'\t'

  gov_west:
    name: Verify (West)
    needs: commercial
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    strategy:
      matrix:
        layer:
          - AWSLambdaPowertoolsPythonV3-python39
          - AWSLambdaPowertoolsPythonV3-python310
          - AWSLambdaPowertoolsPythonV3-python311
          - AWSLambdaPowertoolsPythonV3-python312
          - AWSLambdaPowertoolsPythonV3-python313
        arch:
          - arm64
          - x86_64
    environment: GovCloud Prod (West)
    steps:
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0
        with:
          role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
          aws-region: us-gov-east-1
          mask-aws-account-id: true
      - name: Verify Layer ${{ matrix.layer }}-${{ matrix.arch }}
        id: verify-layer
        run: |
          aws --region us-gov-west-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-west-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ inputs.version }}' | jq -r '{"Layer Version Arn": .LayerVersionArn, "Version": .Version, "Description": .Description, "Compatible Runtimes": .CompatibleRuntimes[0], "Compatible Architectures": .CompatibleArchitectures[0], "SHA": .Content.CodeSha256} | keys[] as $k | [$k, .[$k]] | @tsv' | column -t -s $'\t'