Skip to content

Commit 75bd56f

Browse files
anafalcaoanafalcao
authored
Merge branch 'develop' into typo-docs
2 parents f7692cc + 2539e6f commit 75bd56f

File tree

338 files changed

+9897
-4086
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

338 files changed

+9897
-4086
lines changed

‎.github/ISSUE_TEMPLATE/bug_report.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,11 +58,11 @@ body:
5858
attributes:
5959
label: AWS Lambda function runtime
6060
options:
61-
- "3.8"
6261
- "3.9"
6362
- "3.10"
6463
- "3.11"
6564
- "3.12"
65+
- "3.13"
6666
validations:
6767
required: true
6868
- type: dropdown

‎.github/ISSUE_TEMPLATE/static_typing.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,11 +25,11 @@ body:
2525
attributes:
2626
label: AWS Lambda function runtime
2727
options:
28-
- "3.8"
2928
- "3.9"
3029
- "3.10"
3130
- "3.11"
3231
- "3.12"
32+
- "3.13"
3333
validations:
3434
required: true
3535
- type: input

‎.github/workflows/bootstrap_region.yml

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
name: Region Bootstrap
2+
3+
# bootstraps new regions
4+
#
5+
# PURPOSE
6+
# Ensures new regions are deployable in future releases
7+
#
8+
# JOB 1 PROCESS
9+
#
10+
# 1. Installs CDK
11+
# 2. Bootstraps region
12+
#
13+
# JOB 2 PROCESS
14+
# 1. Sets up Go
15+
# 2. Installs the balance script
16+
# 3. Runs balance script to copy layers between aws regions
17+
18+
on:
19+
workflow_dispatch:
20+
inputs:
21+
environment:
22+
type: choice
23+
options:
24+
- beta
25+
- prod
26+
description: Deployment environment
27+
region:
28+
type: string
29+
required: true
30+
description: AWS region to bootstrap (i.e. eu-west-1)
31+
32+
run-name: Region Bootstrap ${{ inputs.region }}
33+
34+
permissions:
35+
contents: read
36+
37+
jobs:
38+
cdk:
39+
name: Install CDK
40+
runs-on: ubuntu-latest
41+
permissions:
42+
contents: read
43+
id-token: write
44+
environment: layer-${{ inputs.environment }}
45+
steps:
46+
- id: credentials
47+
name: AWS Credentials
48+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
49+
with:
50+
aws-region: ${{ inputs.region }}
51+
role-to-assume: ${{ secrets.REGION_IAM_ROLE }}
52+
mask-aws-account-id: true
53+
- id: workdir
54+
name: Create Workdir
55+
run: |
56+
mkdir -p build/project
57+
- id: cdk-install
58+
name: Install CDK
59+
working-directory: build
60+
run: |
61+
npm i aws-cdk
62+
- id: cdk-project
63+
name: CDK Project
64+
working-directory: build/project
65+
run: |
66+
npx cdk init app --language=typescript
67+
AWS_REGION="${{ inputs.region }}" npx cdk bootstrap
68+
69+
copy_layers:
70+
name: Copy Layers
71+
runs-on: ubuntu-latest
72+
permissions:
73+
contents: read
74+
id-token: write
75+
strategy:
76+
matrix:
77+
layer:
78+
- AWSLambdaPowertoolsPythonV3-python38-arm64
79+
- AWSLambdaPowertoolsPythonV3-python39-arm64
80+
- AWSLambdaPowertoolsPythonV3-python310-arm64
81+
- AWSLambdaPowertoolsPythonV3-python311-arm64
82+
- AWSLambdaPowertoolsPythonV3-python312-arm64
83+
- AWSLambdaPowertoolsPythonV3-python313-arm64
84+
- AWSLambdaPowertoolsPythonV3-python38-x86_64
85+
- AWSLambdaPowertoolsPythonV3-python39-x86_64
86+
- AWSLambdaPowertoolsPythonV3-python310-x86_64
87+
- AWSLambdaPowertoolsPythonV3-python311-x86_64
88+
- AWSLambdaPowertoolsPythonV3-python312-x86_64
89+
- AWSLambdaPowertoolsPythonV3-python313-x86_64
90+
environment: layer-${{ inputs.environment }}
91+
steps:
92+
- id: credentials
93+
name: AWS Credentials
94+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
95+
with:
96+
aws-region: us-east-1
97+
role-to-assume: ${{ secrets.REGION_IAM_ROLE }}
98+
mask-aws-account-id: true
99+
- id: go-setup
100+
name: Setup Go
101+
uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
102+
- id: go-env
103+
name: Go Env
104+
run: go env
105+
- id: go-install-pkg
106+
name: Install
107+
run: go install github.com/aws-powertools/actions/layer-balancer/cmd/balance@latest
108+
- id: run-balance
109+
name: Run Balance
110+
run: balance -read-region us-east-1 -write-region ${{ inputs.region }} -write-role ${{ secrets.BALANCE_ROLE_ARN }} -layer-name ${{ matrix.layer }} -dry-run=false

‎.github/workflows/codeql-analysis.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ jobs:
2828

2929
steps:
3030
- name: Checkout repository
31-
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
31+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3232

3333
# Initializes the CodeQL tools for scanning.
3434
- name: Initialize CodeQL

‎.github/workflows/dependency-review.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,6 @@ jobs:
1717
runs-on: ubuntu-latest
1818
steps:
1919
- name: 'Checkout Repository'
20-
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
20+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2121
- name: 'Dependency Review'
22-
uses: actions/dependency-review-action@5a2ce3f5b92ee19cbb1541a4984c76d921601d7c # v4.3.4
22+
uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4.5.0

‎.github/workflows/dispatch_analytics.yml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,10 +43,11 @@ jobs:
4343
statuses: read
4444
steps:
4545
- name: Configure AWS credentials
46-
uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2.2.0
46+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
4747
with:
4848
aws-region: eu-central-1
49-
role-to-assume: ${{ secrets.AWS_ANALYTICS_ROLE_ARN }}
49+
role-to-assume: ${{ secrets.AWS_LAYERS_ROLE_ARN }}
50+
mask-aws-account-id: true
5051

5152
- name: Invoke Lambda function
5253
run: |

‎.github/workflows/label_pr_on_title.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ jobs:
5050
pull-requests: write # label respective PR
5151
steps:
5252
- name: Checkout repository
53-
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
53+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
5454
- name: "Label PR based on title"
5555
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
5656
env:

‎.github/workflows/layer_govcloud.yml

Lines changed: 221 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,221 @@
1+
name: Layer Deployment (GovCloud)
2+
3+
# GovCloud Layer Publish
4+
# ---
5+
# This workflow publishes a specific layer version in an AWS account based on the environment input.
6+
#
7+
# Using a matrix, we pull each architecture and python version of the layer and store them as artifacts
8+
# we upload them to each of the GovCloud AWS accounts.
9+
#
10+
# A number of safety checks are performed to ensure safety.
11+
12+
on:
13+
workflow_dispatch:
14+
inputs:
15+
environment:
16+
description: Deployment environment
17+
type: choice
18+
options:
19+
- Gamma
20+
- Prod
21+
required: true
22+
version:
23+
description: Layer version to duplicate
24+
type: string
25+
required: true
26+
workflow_call:
27+
inputs:
28+
environment:
29+
description: Deployment environment
30+
type: string
31+
required: true
32+
version:
33+
description: Layer version to duplicate
34+
type: string
35+
required: true
36+
37+
run-name: Layer Deployment (GovCloud) - ${{ inputs.environment }}
38+
39+
permissions:
40+
contents: read
41+
42+
jobs:
43+
download:
44+
runs-on: ubuntu-latest
45+
permissions:
46+
id-token: write
47+
contents: read
48+
strategy:
49+
matrix:
50+
layer:
51+
- AWSLambdaPowertoolsPythonV3-python39
52+
- AWSLambdaPowertoolsPythonV3-python310
53+
- AWSLambdaPowertoolsPythonV3-python311
54+
- AWSLambdaPowertoolsPythonV3-python312
55+
- AWSLambdaPowertoolsPythonV3-python313
56+
arch:
57+
- arm64
58+
- x86_64
59+
environment: Prod (Readonly)
60+
steps:
61+
- name: Configure AWS Credentials
62+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
63+
with:
64+
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
65+
aws-region: us-east-1
66+
mask-aws-account-id: true
67+
- name: Grab Zip
68+
run: |
69+
aws --region us-east-1 lambda get-layer-version-by-arn --arn arn:aws:lambda:us-east-1:017000801446:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ inputs.version }} --query 'Content.Location' | xargs curl -L -o ${{ matrix.layer }}_${{ matrix.arch }}.zip
70+
aws --region us-east-1 lambda get-layer-version-by-arn --arn arn:aws:lambda:us-east-1:017000801446:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ inputs.version }} > ${{ matrix.layer }}_${{ matrix.arch }}.json
71+
- name: Store Zip
72+
uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
73+
with:
74+
name: ${{ matrix.layer }}_${{ matrix.arch }}.zip
75+
path: ${{ matrix.layer }}_${{ matrix.arch }}.zip
76+
retention-days: 1
77+
if-no-files-found: error
78+
- name: Store Metadata
79+
uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
80+
with:
81+
name: ${{ matrix.layer }}_${{ matrix.arch }}.json
82+
path: ${{ matrix.layer }}_${{ matrix.arch }}.json
83+
retention-days: 1
84+
if-no-files-found: error
85+
86+
copy_east:
87+
name: Copy (East)
88+
needs: download
89+
runs-on: ubuntu-latest
90+
permissions:
91+
id-token: write
92+
contents: read
93+
strategy:
94+
matrix:
95+
layer:
96+
- AWSLambdaPowertoolsPythonV3-python39
97+
- AWSLambdaPowertoolsPythonV3-python310
98+
- AWSLambdaPowertoolsPythonV3-python311
99+
- AWSLambdaPowertoolsPythonV3-python312
100+
- AWSLambdaPowertoolsPythonV3-python313
101+
arch:
102+
- arm64
103+
- x86_64
104+
environment: GovCloud ${{ inputs.environment }} (East)
105+
steps:
106+
- name: Download Zip
107+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
108+
with:
109+
name: ${{ matrix.layer }}_${{ matrix.arch }}.zip
110+
- name: Download Metadata
111+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
112+
with:
113+
name: ${{ matrix.layer }}_${{ matrix.arch }}.json
114+
- name: Verify Layer Signature
115+
run: |
116+
SHA=$(jq -r '.Content.CodeSha256' '${{ matrix.layer }}_${{ matrix.arch }}.json')
117+
test "$(openssl dgst -sha256 -binary ${{ matrix.layer }}_${{ matrix.arch }}.zip | openssl enc -base64)" == "$SHA" && echo "SHA OK: ${SHA}" || exit 1
118+
- name: Configure AWS Credentials
119+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
120+
with:
121+
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
122+
aws-region: us-gov-east-1
123+
mask-aws-account-id: true
124+
- name: Create Layer
125+
id: create-layer
126+
run: |
127+
LAYER_VERSION=$(aws --region us-gov-east-1 lambda publish-layer-version \
128+
--layer-name ${{ matrix.layer }}-${{ matrix.arch }} \
129+
--zip-file fileb://./${{ matrix.layer }}_${{ matrix.arch }}.zip \
130+
--compatible-runtimes "$(jq -r '.CompatibleRuntimes[0]' '${{ matrix.layer }}_${{ matrix.arch }}.json')" \
131+
--compatible-architectures "$(jq -r '.CompatibleArchitectures[0]' '${{ matrix.layer }}_${{ matrix.arch }}.json')" \
132+
--license-info "MIT-0" \
133+
--description "$(jq -r '.Description' '${{ matrix.layer }}_${{ matrix.arch }}.json')" \
134+
--query 'Version' \
135+
--output text)
136+
137+
echo "LAYER_VERSION=$LAYER_VERSION" >> "$GITHUB_OUTPUT"
138+
139+
aws --region us-gov-east-1 lambda add-layer-version-permission \
140+
--layer-name '${{ matrix.layer }}-${{ matrix.arch }}' \
141+
--statement-id 'PublicLayer' \
142+
--action lambda:GetLayerVersion \
143+
--principal '*' \
144+
--version-number "$LAYER_VERSION"
145+
- name: Verify Layer
146+
env:
147+
LAYER_VERSION: ${{ steps.create-layer.outputs.LAYER_VERSION }}
148+
run: |
149+
REMOTE_SHA=$(aws --region us-gov-east-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-east-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ env.LAYER_VERSION }}' --query 'Content.CodeSha256' --output text)
150+
SHA=$(jq -r '.Content.CodeSha256' '${{ matrix.layer }}_${{ matrix.arch }}.json')
151+
test "$REMOTE_SHA" == "$SHA" && echo "SHA OK: ${SHA}" || exit 1
152+
aws --region us-gov-east-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-east-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ env.LAYER_VERSION }}' --output table
153+
154+
copy_west:
155+
name: Copy (West)
156+
needs: download
157+
runs-on: ubuntu-latest
158+
permissions:
159+
id-token: write
160+
contents: read
161+
strategy:
162+
matrix:
163+
layer:
164+
- AWSLambdaPowertoolsPythonV3-python39
165+
- AWSLambdaPowertoolsPythonV3-python310
166+
- AWSLambdaPowertoolsPythonV3-python311
167+
- AWSLambdaPowertoolsPythonV3-python312
168+
- AWSLambdaPowertoolsPythonV3-python313
169+
arch:
170+
- arm64
171+
- x86_64
172+
environment:
173+
name: GovCloud ${{ inputs.environment }} (West)
174+
steps:
175+
- name: Download Zip
176+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
177+
with:
178+
name: ${{ matrix.layer }}_${{ matrix.arch }}.zip
179+
- name: Download Metadata
180+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
181+
with:
182+
name: ${{ matrix.layer }}_${{ matrix.arch }}.json
183+
- name: Verify Layer Signature
184+
run: |
185+
SHA=$(jq -r '.Content.CodeSha256' '${{ matrix.layer }}_${{ matrix.arch }}.json')
186+
test "$(openssl dgst -sha256 -binary ${{ matrix.layer }}_${{ matrix.arch }}.zip | openssl enc -base64)" == "$SHA" && echo "SHA OK: ${SHA}" || exit 1
187+
- name: Configure AWS Credentials
188+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
189+
with:
190+
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
191+
aws-region: us-gov-west-1
192+
mask-aws-account-id: true
193+
- name: Create Layer
194+
id: create-layer
195+
run: |
196+
LAYER_VERSION=$(aws --region us-gov-west-1 lambda publish-layer-version \
197+
--layer-name ${{ matrix.layer }}-${{ matrix.arch }} \
198+
--zip-file fileb://./${{ matrix.layer }}_${{ matrix.arch }}.zip \
199+
--compatible-runtimes "$(jq -r '.CompatibleRuntimes[0]' '${{ matrix.layer }}_${{ matrix.arch }}.json')" \
200+
--compatible-architectures "$(jq -r '.CompatibleArchitectures[0]' '${{ matrix.layer }}_${{ matrix.arch }}.json')" \
201+
--license-info "MIT-0" \
202+
--description "$(jq -r '.Description' '${{ matrix.layer }}_${{ matrix.arch }}.json')" \
203+
--query 'Version' \
204+
--output text)
205+
206+
echo "LAYER_VERSION=$LAYER_VERSION" >> "$GITHUB_OUTPUT"
207+
208+
aws --region us-gov-west-1 lambda add-layer-version-permission \
209+
--layer-name '${{ matrix.layer }}-${{ matrix.arch }}' \
210+
--statement-id 'PublicLayer' \
211+
--action lambda:GetLayerVersion \
212+
--principal '*' \
213+
--version-number "$LAYER_VERSION"
214+
- name: Verify Layer
215+
env:
216+
LAYER_VERSION: ${{ steps.create-layer.outputs.LAYER_VERSION }}
217+
run: |
218+
REMOTE_SHA=$(aws --region us-gov-west-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-west-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ env.LAYER_VERSION }}' --query 'Content.CodeSha256' --output text)
219+
SHA=$(jq -r '.Content.CodeSha256' '${{ matrix.layer }}_${{ matrix.arch }}.json')
220+
test "$REMOTE_SHA" == "$SHA" && echo "SHA OK: ${SHA}" || exit 1
221+
aws --region us-gov-west-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-west-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ env.LAYER_VERSION }}' --output table

0 commit comments

Comments
 (0)