Skip to content

Commit c1fb6b1

Browse files
leandrodamascenaleandrodamascena
authored
Merge branch 'develop' into logger-context
2 parents 8071f5d + 465afe5 commit c1fb6b1

File tree

267 files changed

+7111
-2723
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

267 files changed

+7111
-2723
lines changed

‎.github/ISSUE_TEMPLATE/bug_report.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ body:
6363
- "3.10"
6464
- "3.11"
6565
- "3.12"
66+
- "3.13"
6667
validations:
6768
required: true
6869
- type: dropdown

‎.github/ISSUE_TEMPLATE/static_typing.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ body:
3030
- "3.10"
3131
- "3.11"
3232
- "3.12"
33+
- "3.13"
3334
validations:
3435
required: true
3536
- type: input

‎.github/workflows/bootstrap_region.yml

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
name: Region Bootstrap
2+
3+
# bootstraps new regions
4+
#
5+
# PURPOSE
6+
# Ensures new regions are deployable in future releases
7+
#
8+
# JOB 1 PROCESS
9+
#
10+
# 1. Installs CDK
11+
# 2. Bootstraps region
12+
#
13+
# JOB 2 PROCESS
14+
# 1. Sets up Go
15+
# 2. Installs the balance script
16+
# 3. Runs balance script to copy layers between aws regions
17+
18+
on:
19+
workflow_dispatch:
20+
inputs:
21+
environment:
22+
type: choice
23+
options:
24+
- beta
25+
- prod
26+
description: Deployment environment
27+
region:
28+
type: string
29+
required: true
30+
description: AWS region to bootstrap (i.e. eu-west-1)
31+
32+
run-name: Region Bootstrap ${{ inputs.region }}
33+
34+
permissions:
35+
contents: read
36+
37+
jobs:
38+
cdk:
39+
name: Install CDK
40+
runs-on: ubuntu-latest
41+
permissions:
42+
contents: read
43+
id-token: write
44+
environment: layer-${{ inputs.environment }}
45+
steps:
46+
- id: credentials
47+
name: AWS Credentials
48+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
49+
with:
50+
aws-region: ${{ inputs.region }}
51+
role-to-assume: ${{ secrets.REGION_IAM_ROLE }}
52+
mask-aws-account-id: true
53+
- id: workdir
54+
name: Create Workdir
55+
run: |
56+
mkdir -p build/project
57+
- id: cdk-install
58+
name: Install CDK
59+
working-directory: build
60+
run: |
61+
npm i aws-cdk
62+
- id: cdk-project
63+
name: CDK Project
64+
working-directory: build/project
65+
run: |
66+
npx cdk init app --language=typescript
67+
AWS_REGION="${{ inputs.region }}" npx cdk bootstrap
68+
69+
copy_layers:
70+
name: Copy Layers
71+
runs-on: ubuntu-latest
72+
permissions:
73+
contents: read
74+
id-token: write
75+
strategy:
76+
matrix:
77+
layer:
78+
- AWSLambdaPowertoolsPythonV3-python38-arm64
79+
- AWSLambdaPowertoolsPythonV3-python39-arm64
80+
- AWSLambdaPowertoolsPythonV3-python310-arm64
81+
- AWSLambdaPowertoolsPythonV3-python311-arm64
82+
- AWSLambdaPowertoolsPythonV3-python312-arm64
83+
- AWSLambdaPowertoolsPythonV3-python313-arm64
84+
- AWSLambdaPowertoolsPythonV3-python38-x86_64
85+
- AWSLambdaPowertoolsPythonV3-python39-x86_64
86+
- AWSLambdaPowertoolsPythonV3-python310-x86_64
87+
- AWSLambdaPowertoolsPythonV3-python311-x86_64
88+
- AWSLambdaPowertoolsPythonV3-python312-x86_64
89+
- AWSLambdaPowertoolsPythonV3-python313-x86_64
90+
environment: layer-${{ inputs.environment }}
91+
steps:
92+
- id: credentials
93+
name: AWS Credentials
94+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
95+
with:
96+
aws-region: us-east-1
97+
role-to-assume: ${{ secrets.REGION_IAM_ROLE }}
98+
mask-aws-account-id: true
99+
- id: go-setup
100+
name: Setup Go
101+
uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
102+
- id: go-env
103+
name: Go Env
104+
run: go env
105+
- id: go-install-pkg
106+
name: Install
107+
run: go install github.com/aws-powertools/actions/layer-balancer/cmd/balance@latest
108+
- id: run-balance
109+
name: Run Balance
110+
run: balance -read-region us-east-1 -write-region ${{ inputs.region }} -write-role ${{ secrets.BALANCE_ROLE_ARN }} -layer-name ${{ matrix.layer }} -dry-run=false

‎.github/workflows/codeql-analysis.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ jobs:
2828

2929
steps:
3030
- name: Checkout repository
31-
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
31+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3232

3333
# Initializes the CodeQL tools for scanning.
3434
- name: Initialize CodeQL

‎.github/workflows/dependency-review.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,6 @@ jobs:
1717
runs-on: ubuntu-latest
1818
steps:
1919
- name: 'Checkout Repository'
20-
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
20+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2121
- name: 'Dependency Review'
22-
uses: actions/dependency-review-action@5a2ce3f5b92ee19cbb1541a4984c76d921601d7c # v4.3.4
22+
uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4.5.0

‎.github/workflows/dispatch_analytics.yml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,10 +43,11 @@ jobs:
4343
statuses: read
4444
steps:
4545
- name: Configure AWS credentials
46-
uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2.2.0
46+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
4747
with:
4848
aws-region: eu-central-1
49-
role-to-assume: ${{ secrets.AWS_ANALYTICS_ROLE_ARN }}
49+
role-to-assume: ${{ secrets.AWS_LAYERS_ROLE_ARN }}
50+
mask-aws-account-id: true
5051

5152
- name: Invoke Lambda function
5253
run: |

‎.github/workflows/label_pr_on_title.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ jobs:
5050
pull-requests: write # label respective PR
5151
steps:
5252
- name: Checkout repository
53-
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
53+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
5454
- name: "Label PR based on title"
5555
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
5656
env:

‎.github/workflows/layer_govcloud.yml

Lines changed: 224 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,224 @@
1+
name: Layer Deployment (GovCloud)
2+
3+
# GovCloud Layer Publish
4+
# ---
5+
# This workflow publishes a specific layer version in an AWS account based on the environment input.
6+
#
7+
# Using a matrix, we pull each architecture and python version of the layer and store them as artifacts
8+
# we upload them to each of the GovCloud AWS accounts.
9+
#
10+
# A number of safety checks are performed to ensure safety.
11+
12+
on:
13+
workflow_dispatch:
14+
inputs:
15+
environment:
16+
description: Deployment environment
17+
type: choice
18+
options:
19+
- Gamma
20+
- Prod
21+
required: true
22+
version:
23+
description: Layer version to duplicate
24+
type: string
25+
required: true
26+
workflow_call:
27+
inputs:
28+
environment:
29+
description: Deployment environment
30+
type: string
31+
required: true
32+
version:
33+
description: Layer version to duplicate
34+
type: string
35+
required: true
36+
37+
run-name: Layer Deployment (GovCloud) - ${{ inputs.environment }}
38+
39+
permissions:
40+
contents: read
41+
42+
jobs:
43+
download:
44+
runs-on: ubuntu-latest
45+
permissions:
46+
id-token: write
47+
contents: read
48+
strategy:
49+
matrix:
50+
layer:
51+
- AWSLambdaPowertoolsPythonV3-python38
52+
- AWSLambdaPowertoolsPythonV3-python39
53+
- AWSLambdaPowertoolsPythonV3-python310
54+
- AWSLambdaPowertoolsPythonV3-python311
55+
- AWSLambdaPowertoolsPythonV3-python312
56+
- AWSLambdaPowertoolsPythonV3-python313
57+
arch:
58+
- arm64
59+
- x86_64
60+
environment: Prod (Readonly)
61+
steps:
62+
- name: Configure AWS Credentials
63+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
64+
with:
65+
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
66+
aws-region: us-east-1
67+
mask-aws-account-id: true
68+
- name: Grab Zip
69+
run: |
70+
aws --region us-east-1 lambda get-layer-version-by-arn --arn arn:aws:lambda:us-east-1:017000801446:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ inputs.version }} --query 'Content.Location' | xargs curl -L -o ${{ matrix.layer }}_${{ matrix.arch }}.zip
71+
aws --region us-east-1 lambda get-layer-version-by-arn --arn arn:aws:lambda:us-east-1:017000801446:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ inputs.version }} > ${{ matrix.layer }}_${{ matrix.arch }}.json
72+
- name: Store Zip
73+
uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
74+
with:
75+
name: ${{ matrix.layer }}_${{ matrix.arch }}.zip
76+
path: ${{ matrix.layer }}_${{ matrix.arch }}.zip
77+
retention-days: 1
78+
if-no-files-found: error
79+
- name: Store Metadata
80+
uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
81+
with:
82+
name: ${{ matrix.layer }}_${{ matrix.arch }}.json
83+
path: ${{ matrix.layer }}_${{ matrix.arch }}.json
84+
retention-days: 1
85+
if-no-files-found: error
86+
87+
copy_east:
88+
name: Copy (East)
89+
needs: download
90+
runs-on: ubuntu-latest
91+
permissions:
92+
id-token: write
93+
contents: read
94+
strategy:
95+
matrix:
96+
layer:
97+
- AWSLambdaPowertoolsPythonV3-python38
98+
- AWSLambdaPowertoolsPythonV3-python39
99+
- AWSLambdaPowertoolsPythonV3-python310
100+
- AWSLambdaPowertoolsPythonV3-python311
101+
- AWSLambdaPowertoolsPythonV3-python312
102+
- AWSLambdaPowertoolsPythonV3-python313
103+
arch:
104+
- arm64
105+
- x86_64
106+
environment: GovCloud ${{ inputs.environment }} (East)
107+
steps:
108+
- name: Download Zip
109+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
110+
with:
111+
name: ${{ matrix.layer }}_${{ matrix.arch }}.zip
112+
- name: Download Metadata
113+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
114+
with:
115+
name: ${{ matrix.layer }}_${{ matrix.arch }}.json
116+
- name: Verify Layer Signature
117+
run: |
118+
SHA=$(jq -r '.Content.CodeSha256' '${{ matrix.layer }}_${{ matrix.arch }}.json')
119+
test "$(openssl dgst -sha256 -binary ${{ matrix.layer }}_${{ matrix.arch }}.zip | openssl enc -base64)" == "$SHA" && echo "SHA OK: ${SHA}" || exit 1
120+
- name: Configure AWS Credentials
121+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
122+
with:
123+
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
124+
aws-region: us-gov-east-1
125+
mask-aws-account-id: true
126+
- name: Create Layer
127+
id: create-layer
128+
run: |
129+
LAYER_VERSION=$(aws --region us-gov-east-1 lambda publish-layer-version \
130+
--layer-name ${{ matrix.layer }}-${{ matrix.arch }} \
131+
--zip-file fileb://./${{ matrix.layer }}_${{ matrix.arch }}.zip \
132+
--compatible-runtimes "$(jq -r '.CompatibleRuntimes[0]' '${{ matrix.layer }}_${{ matrix.arch }}.json')" \
133+
--compatible-architectures "$(jq -r '.CompatibleArchitectures[0]' '${{ matrix.layer }}_${{ matrix.arch }}.json')" \
134+
--license-info "MIT-0" \
135+
--description "$(jq -r '.Description' '${{ matrix.layer }}_${{ matrix.arch }}.json')" \
136+
--query 'Version' \
137+
--output text)
138+
139+
echo "LAYER_VERSION=$LAYER_VERSION" >> "$GITHUB_OUTPUT"
140+
141+
aws --region us-gov-east-1 lambda add-layer-version-permission \
142+
--layer-name '${{ matrix.layer }}-${{ matrix.arch }}' \
143+
--statement-id 'PublicLayer' \
144+
--action lambda:GetLayerVersion \
145+
--principal '*' \
146+
--version-number "$LAYER_VERSION"
147+
- name: Verify Layer
148+
env:
149+
LAYER_VERSION: ${{ steps.create-layer.outputs.LAYER_VERSION }}
150+
run: |
151+
REMOTE_SHA=$(aws --region us-gov-east-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-east-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ env.LAYER_VERSION }}' --query 'Content.CodeSha256' --output text)
152+
SHA=$(jq -r '.Content.CodeSha256' '${{ matrix.layer }}_${{ matrix.arch }}.json')
153+
test "$REMOTE_SHA" == "$SHA" && echo "SHA OK: ${SHA}" || exit 1
154+
aws --region us-gov-east-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-east-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ env.LAYER_VERSION }}' --output table
155+
156+
copy_west:
157+
name: Copy (West)
158+
needs: download
159+
runs-on: ubuntu-latest
160+
permissions:
161+
id-token: write
162+
contents: read
163+
strategy:
164+
matrix:
165+
layer:
166+
- AWSLambdaPowertoolsPythonV3-python38
167+
- AWSLambdaPowertoolsPythonV3-python39
168+
- AWSLambdaPowertoolsPythonV3-python310
169+
- AWSLambdaPowertoolsPythonV3-python311
170+
- AWSLambdaPowertoolsPythonV3-python312
171+
- AWSLambdaPowertoolsPythonV3-python313
172+
arch:
173+
- arm64
174+
- x86_64
175+
environment:
176+
name: GovCloud ${{ inputs.environment }} (West)
177+
steps:
178+
- name: Download Zip
179+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
180+
with:
181+
name: ${{ matrix.layer }}_${{ matrix.arch }}.zip
182+
- name: Download Metadata
183+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
184+
with:
185+
name: ${{ matrix.layer }}_${{ matrix.arch }}.json
186+
- name: Verify Layer Signature
187+
run: |
188+
SHA=$(jq -r '.Content.CodeSha256' '${{ matrix.layer }}_${{ matrix.arch }}.json')
189+
test "$(openssl dgst -sha256 -binary ${{ matrix.layer }}_${{ matrix.arch }}.zip | openssl enc -base64)" == "$SHA" && echo "SHA OK: ${SHA}" || exit 1
190+
- name: Configure AWS Credentials
191+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
192+
with:
193+
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
194+
aws-region: us-gov-west-1
195+
mask-aws-account-id: true
196+
- name: Create Layer
197+
id: create-layer
198+
run: |
199+
LAYER_VERSION=$(aws --region us-gov-west-1 lambda publish-layer-version \
200+
--layer-name ${{ matrix.layer }}-${{ matrix.arch }} \
201+
--zip-file fileb://./${{ matrix.layer }}_${{ matrix.arch }}.zip \
202+
--compatible-runtimes "$(jq -r '.CompatibleRuntimes[0]' '${{ matrix.layer }}_${{ matrix.arch }}.json')" \
203+
--compatible-architectures "$(jq -r '.CompatibleArchitectures[0]' '${{ matrix.layer }}_${{ matrix.arch }}.json')" \
204+
--license-info "MIT-0" \
205+
--description "$(jq -r '.Description' '${{ matrix.layer }}_${{ matrix.arch }}.json')" \
206+
--query 'Version' \
207+
--output text)
208+
209+
echo "LAYER_VERSION=$LAYER_VERSION" >> "$GITHUB_OUTPUT"
210+
211+
aws --region us-gov-west-1 lambda add-layer-version-permission \
212+
--layer-name '${{ matrix.layer }}-${{ matrix.arch }}' \
213+
--statement-id 'PublicLayer' \
214+
--action lambda:GetLayerVersion \
215+
--principal '*' \
216+
--version-number "$LAYER_VERSION"
217+
- name: Verify Layer
218+
env:
219+
LAYER_VERSION: ${{ steps.create-layer.outputs.LAYER_VERSION }}
220+
run: |
221+
REMOTE_SHA=$(aws --region us-gov-west-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-west-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ env.LAYER_VERSION }}' --query 'Content.CodeSha256' --output text)
222+
SHA=$(jq -r '.Content.CodeSha256' '${{ matrix.layer }}_${{ matrix.arch }}.json')
223+
test "$REMOTE_SHA" == "$SHA" && echo "SHA OK: ${SHA}" || exit 1
224+
aws --region us-gov-west-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-west-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ env.LAYER_VERSION }}' --output table

0 commit comments

Comments
 (0)