Skip to content

Commit 4e9b0aa

Browse files
leandrodamascenaleandrodamascena
authored
Merge branch 'develop' into thread-safe-keys
2 parents 49a7c5d + 72d7cc6 commit 4e9b0aa

File tree

83 files changed

+1092
-595
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

83 files changed

+1092
-595
lines changed

‎.github/workflows/codeql-analysis.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ jobs:
2828

2929
steps:
3030
- name: Checkout repository
31-
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
31+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
3232

3333
# Initializes the CodeQL tools for scanning.
3434
- name: Initialize CodeQL

‎.github/workflows/dependency-review.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,6 @@ jobs:
1717
runs-on: ubuntu-latest
1818
steps:
1919
- name: 'Checkout Repository'
20-
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
20+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
2121
- name: 'Dependency Review'
2222
uses: actions/dependency-review-action@5a2ce3f5b92ee19cbb1541a4984c76d921601d7c # v4.3.4

‎.github/workflows/label_pr_on_title.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ jobs:
5050
pull-requests: write # label respective PR
5151
steps:
5252
- name: Checkout repository
53-
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
53+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
5454
- name: "Label PR based on title"
5555
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
5656
env:

‎.github/workflows/layer_govcloud.yml

+216
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,216 @@
1+
# GovCloud Layer Publish
2+
# ---
3+
# This workflow publishes a specific layer version in an AWS account based on the environment input.
4+
#
5+
# Using a matrix, we pull each architecture and python version of the layer and store them as artifacts
6+
# we upload them to each of the GovCloud AWS accounts.
7+
#
8+
# A number of safety checks are performed to ensure safety.
9+
10+
on:
11+
workflow_dispatch:
12+
inputs:
13+
environment:
14+
description: Deployment environment
15+
type: choice
16+
options:
17+
- Gamma
18+
- Prod
19+
default: Gamma
20+
required: true
21+
version:
22+
description: Layer version to duplicate
23+
type: number
24+
required: true
25+
workflow_call:
26+
inputs:
27+
environment:
28+
description: Deployment environment
29+
type: string
30+
default: Gamma
31+
required: true
32+
version:
33+
description: Layer version to duplicate
34+
type: number
35+
required: true
36+
37+
name: Layer Deployment (GovCloud)
38+
run-name: Layer Deployment (GovCloud) - ${{ inputs.environment }}
39+
40+
jobs:
41+
download:
42+
runs-on: ubuntu-latest
43+
permissions:
44+
id-token: write
45+
contents: read
46+
strategy:
47+
matrix:
48+
layer:
49+
- AWSLambdaPowertoolsPythonV3-python38
50+
- AWSLambdaPowertoolsPythonV3-python39
51+
- AWSLambdaPowertoolsPythonV3-python310
52+
- AWSLambdaPowertoolsPythonV3-python311
53+
- AWSLambdaPowertoolsPythonV3-python312
54+
arch:
55+
- arm64
56+
- x86_64
57+
environment: Prod (Readonly)
58+
steps:
59+
- name: Configure AWS Credentials
60+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
61+
with:
62+
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
63+
aws-region: us-east-1
64+
mask-aws-account-id: true
65+
- name: Grab Zip
66+
run: |
67+
aws --region us-east-1 lambda get-layer-version-by-arn --arn arn:aws:lambda:us-east-1:017000801446:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ inputs.version }} --query 'Content.Location' | xargs curl -L -o ${{ matrix.layer }}_${{ matrix.arch }}.zip
68+
aws --region us-east-1 lambda get-layer-version-by-arn --arn arn:aws:lambda:us-east-1:017000801446:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ inputs.version }} > ${{ matrix.layer }}_${{ matrix.arch }}.json
69+
- name: Store Zip
70+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
71+
with:
72+
name: ${{ matrix.layer }}_${{ matrix.arch }}.zip
73+
path: ${{ matrix.layer }}_${{ matrix.arch }}.zip
74+
retention-days: 1
75+
if-no-files-found: error
76+
- name: Store Metadata
77+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
78+
with:
79+
name: ${{ matrix.layer }}_${{ matrix.arch }}.json
80+
path: ${{ matrix.layer }}_${{ matrix.arch }}.json
81+
retention-days: 1
82+
if-no-files-found: error
83+
84+
copy_east:
85+
name: Copy (East)
86+
needs: download
87+
runs-on: ubuntu-latest
88+
permissions:
89+
id-token: write
90+
contents: read
91+
strategy:
92+
matrix:
93+
layer:
94+
- AWSLambdaPowertoolsPythonV3-python38
95+
- AWSLambdaPowertoolsPythonV3-python39
96+
- AWSLambdaPowertoolsPythonV3-python310
97+
- AWSLambdaPowertoolsPythonV3-python311
98+
- AWSLambdaPowertoolsPythonV3-python312
99+
arch:
100+
- arm64
101+
- x86_64
102+
environment: GovCloud ${{ inputs.environment }} (East)
103+
steps:
104+
- name: Download Zip
105+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
106+
with:
107+
name: ${{ matrix.layer }}_${{ matrix.arch }}.zip
108+
- name: Download Metadata
109+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
110+
with:
111+
name: ${{ matrix.layer }}_${{ matrix.arch }}.json
112+
- name: Verify Layer Signature
113+
run: |
114+
SHA=$(jq -r '.Content.CodeSha256' ${{ matrix.layer }}_${{ matrix.arch }}.json)
115+
test $(openssl dgst -sha256 -binary ${{ matrix.layer }}_${{ matrix.arch }}.zip | openssl enc -base64) == $SHA && echo "SHA OK: ${SHA}" || exit 1
116+
- name: Configure AWS Credentials
117+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
118+
with:
119+
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
120+
aws-region: us-gov-east-1
121+
mask-aws-account-id: true
122+
- name: Create Layer
123+
id: create-layer
124+
run: |
125+
LAYER_VERSION=$(aws --region us-gov-east-1 lambda publish-layer-version \
126+
--layer-name ${{ matrix.layer }}-${{ matrix.arch }} \
127+
--zip-file fileb://./${{ matrix.layer }}_${{ matrix.arch }}.zip \
128+
--compatible-runtimes $(jq -r ".CompatibleRuntimes[0]" ${{ matrix.layer }}_${{ matrix.arch }}.json) \
129+
--compatible-architectures $(jq -r ".CompatibleArchitectures[0]" ${{ matrix.layer }}_${{ matrix.arch }}.json) \
130+
--license-info "MIT-0" \
131+
--description "$(jq -r '.Description' ${{ matrix.layer }}_${{ matrix.arch }}.json)" \
132+
--query 'Version' \
133+
--output text)
134+
echo "LAYER_VERSION=$LAYER_VERSION" >> "$GITHUB_OUTPUT"
135+
136+
aws --region us-gov-east-1 lambda add-layer-version-permission \
137+
--layer-name ${{ matrix.layer }}-${{ matrix.arch }} \
138+
--statement-id 'PublicLayer' \
139+
--action lambda:GetLayerVersion \
140+
--principal '*' \
141+
--version-number $LAYER_VERSION
142+
- name: Verify Layer
143+
env:
144+
LAYER_VERSION: ${{ steps.create-layer.outputs.LAYER_VERSION }}
145+
run: |
146+
REMOTE_SHA=$(aws --region us-gov-east-1 lambda get-layer-version-by-arn --arn arn:aws-us-gov:lambda:us-gov-east-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ env.LAYER_VERSION }} --query 'Content.CodeSha256' --output text)
147+
SHA=$(jq -r '.Content.CodeSha256' ${{ matrix.layer }}_${{ matrix.arch }}.json)
148+
test $REMOTE_SHA == $SHA && echo "SHA OK: ${SHA}" || exit 1
149+
150+
copy_west:
151+
name: Copy (West)
152+
needs: download
153+
runs-on: ubuntu-latest
154+
permissions:
155+
id-token: write
156+
contents: read
157+
strategy:
158+
matrix:
159+
layer:
160+
- AWSLambdaPowertoolsPythonV3-python38
161+
- AWSLambdaPowertoolsPythonV3-python39
162+
- AWSLambdaPowertoolsPythonV3-python310
163+
- AWSLambdaPowertoolsPythonV3-python311
164+
- AWSLambdaPowertoolsPythonV3-python312
165+
arch:
166+
- arm64
167+
- x86_64
168+
environment:
169+
name: GovCloud ${{ inputs.environment }} (West)
170+
steps:
171+
- name: Download Zip
172+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
173+
with:
174+
name: ${{ matrix.layer }}_${{ matrix.arch }}.zip
175+
- name: Download Metadata
176+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
177+
with:
178+
name: ${{ matrix.layer }}_${{ matrix.arch }}.json
179+
- name: Verify Layer Signature
180+
run: |
181+
SHA=$(jq -r '.Content.CodeSha256' ${{ matrix.layer }}_${{ matrix.arch }}.json)
182+
test $(openssl dgst -sha256 -binary ${{ matrix.layer }}_${{ matrix.arch }}.zip | openssl enc -base64) == $SHA && echo "SHA OK: ${SHA}" || exit 1
183+
- name: Configure AWS Credentials
184+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
185+
with:
186+
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
187+
aws-region: us-gov-west-1
188+
mask-aws-account-id: true
189+
- name: Create Layer
190+
id: create-layer
191+
run: |
192+
LAYER_VERSION=$(aws --region us-gov-west-1 lambda publish-layer-version \
193+
--layer-name ${{ matrix.layer }}-${{ matrix.arch }} \
194+
--zip-file fileb://./${{ matrix.layer }}_${{ matrix.arch }}.zip \
195+
--compatible-runtimes $(jq -r ".CompatibleRuntimes[0]" ${{ matrix.layer }}_${{ matrix.arch }}.json) \
196+
--compatible-architectures $(jq -r ".CompatibleArchitectures[0]" ${{ matrix.layer }}_${{ matrix.arch }}.json) \
197+
--license-info "MIT-0" \
198+
--description "$(jq -r '.Description' ${{ matrix.layer }}_${{ matrix.arch }}.json)" \
199+
--query 'Version' \
200+
--output text)
201+
202+
echo "LAYER_VERSION=$LAYER_VERSION" >> "$GITHUB_OUTPUT"
203+
204+
aws --region us-gov-west-1 lambda add-layer-version-permission \
205+
--layer-name ${{ matrix.layer }}-${{ matrix.arch }} \
206+
--statement-id 'PublicLayer' \
207+
--action lambda:GetLayerVersion \
208+
--principal '*' \
209+
--version-number $LAYER_VERSION
210+
- name: Verify Layer
211+
env:
212+
LAYER_VERSION: ${{ steps.create-layer.outputs.LAYER_VERSION }}
213+
run: |
214+
REMOTE_SHA=$(aws --region us-gov-west-1 lambda get-layer-version-by-arn --arn arn:aws-us-gov:lambda:us-gov-west-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ env.LAYER_VERSION }} --query 'Content.CodeSha256' --output text)
215+
SHA=$(jq -r '.Content.CodeSha256' ${{ matrix.layer }}_${{ matrix.arch }}.json)
216+
test $REMOTE_SHA == $SHA && echo "SHA OK: ${SHA}" || exit 1

‎.github/workflows/layer_rename.yml

+10-8
Original file line numberDiff line numberDiff line change
@@ -16,27 +16,29 @@ on:
1616
options:
1717
- beta
1818
- prod
19-
default: Gamma
19+
default: beta
2020
required: true
2121
version:
2222
description: Layer version to duplicate
23-
type: number
23+
type: string
2424
required: true
2525
workflow_call:
2626
inputs:
2727
environment:
2828
description: Deployment environment
2929
type: string
30-
default: Gamma
3130
required: true
3231
version:
3332
description: Layer version to duplicate
34-
type: number
33+
type: string
3534
required: true
3635

3736
name: Layer Rename
3837
run-name: Layer Rename - ${{ inputs.environment }}
3938

39+
permissions:
40+
contents: read
41+
4042
jobs:
4143
download:
4244
runs-on: ubuntu-latest
@@ -64,14 +66,14 @@ jobs:
6466
aws --region us-east-1 lambda get-layer-version-by-arn --arn arn:aws:lambda:us-east-1:017000801446:layer:${{ matrix.layer }}-x86:${{ inputs.version }} --query 'Content.Location' | xargs curl -L -o ${{ matrix.layer }}_x86_64.zip
6567
aws --region us-east-1 lambda get-layer-version-by-arn --arn arn:aws:lambda:us-east-1:017000801446:layer:${{ matrix.layer }}-x86:${{ inputs.version }} > ${{ matrix.layer }}_x86_64.json
6668
- name: Store Zip
67-
uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
69+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
6870
with:
6971
name: ${{ matrix.layer }}_x86_64.zip
7072
path: ${{ matrix.layer }}_x86_64.zip
7173
retention-days: 1
7274
if-no-files-found: error
7375
- name: Store Metadata
74-
uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
76+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
7577
with:
7678
name: ${{ matrix.layer }}_x86_64.json
7779
path: ${{ matrix.layer }}_x86_64.json
@@ -136,7 +138,7 @@ jobs:
136138
- name: Verify Layer Signature
137139
run: |
138140
SHA=$(jq -r '.Content.CodeSha256' ${{ matrix.layer }}_x86_64.json)
139-
test $(openssl dgst -sha256 -binary ${{ matrix.layer }}_x86_64.zip | openssl enc -base64) == $SHA && echo "SHA OK: ${SHA}" || exit 1
141+
test $(openssl dgst -sha256 -binary ${{ matrix.layer }}_x86_64.zip | openssl enc -base64) == $SHA && echo "SHA OK: ${SHA}" || exit 1
140142
- name: Configure AWS Credentials
141143
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
142144
with:
@@ -158,4 +160,4 @@ jobs:
158160
--statement-id 'PublicLayer' \
159161
--action lambda:GetLayerVersion \
160162
--principal '*' \
161-
--version-number
163+
--version-number

‎.github/workflows/on_label_added.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ jobs:
4747
permissions:
4848
pull-requests: write # comment on PR
4949
steps:
50-
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
50+
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
5151
# Maintenance: Persist state per PR as an artifact to avoid spam on label add
5252
- name: "Suggest split large Pull Request"
5353
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1

‎.github/workflows/on_merged_pr.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ jobs:
4949
issues: write # label issue with pending-release
5050
if: needs.get_pr_details.outputs.prIsMerged == 'true'
5151
steps:
52-
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
52+
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
5353
- name: "Label PR related issue for release"
5454
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
5555
env:

‎.github/workflows/on_opened_pr.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ jobs:
4747
needs: get_pr_details
4848
runs-on: ubuntu-latest
4949
steps:
50-
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
50+
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
5151
- name: "Ensure related issue is present"
5252
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
5353
env:
@@ -66,7 +66,7 @@ jobs:
6666
permissions:
6767
pull-requests: write # label and comment on PR if missing acknowledge section (requirement)
6868
steps:
69-
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
69+
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
7070
- name: "Ensure acknowledgement section is present"
7171
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
7272
env:

‎.github/workflows/ossf_scorecard.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ jobs:
2222

2323
steps:
2424
- name: "Checkout code"
25-
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
25+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
2626
with:
2727
persist-credentials: false
2828

@@ -35,7 +35,7 @@ jobs:
3535
repo_token: ${{ secrets.SCORECARD_TOKEN }} # read-only fine-grained token to read branch protection settings
3636

3737
- name: "Upload results"
38-
uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
38+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
3939
with:
4040
name: SARIF file
4141
path: results.sarif

0 commit comments

Comments
 (0)