Skip to content

Commit 6f4f3e5

Browse files
anafalcaoanafalcao
authored
Merge branch 'develop' into community_blog
2 parents 79e66ee + daf11dd commit 6f4f3e5

File tree

255 files changed

+6472
-2133
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

255 files changed

+6472
-2133
lines changed

‎.github/ISSUE_TEMPLATE/bug_report.yml

+1
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ body:
6363
- "3.10"
6464
- "3.11"
6565
- "3.12"
66+
- "3.13"
6667
validations:
6768
required: true
6869
- type: dropdown

‎.github/ISSUE_TEMPLATE/static_typing.yml

+1
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ body:
3030
- "3.10"
3131
- "3.11"
3232
- "3.12"
33+
- "3.13"
3334
validations:
3435
required: true
3536
- type: input

‎.github/workflows/bootstrap_region.yml

+109
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
# bootstraps new regions
2+
#
3+
# PURPOSE
4+
# Ensures new regions are deployable in future releases
5+
#
6+
# JOB 1 PROCESS
7+
#
8+
# 1. Installs CDK
9+
# 2. Bootstraps region
10+
#
11+
# JOB 2 PROCESS
12+
# 1. Sets up Go
13+
# 2. Installs the balance script
14+
# 3. Runs balance script to copy layers between aws regions
15+
16+
on:
17+
workflow_dispatch:
18+
inputs:
19+
environment:
20+
type: choice
21+
options:
22+
- beta
23+
- prod
24+
description: Deployment environment
25+
region:
26+
type: string
27+
required: true
28+
description: AWS region to bootstrap (i.e. eu-west-1)
29+
30+
name: Region Bootstrap
31+
run-name: Region Bootstrap ${{ inputs.region }}
32+
33+
permissions:
34+
contents: read
35+
36+
jobs:
37+
cdk:
38+
name: Install CDK
39+
runs-on: ubuntu-latest
40+
permissions:
41+
contents: write
42+
id-token: write
43+
environment: layer-${{ inputs.environment }}
44+
steps:
45+
- id: credentials
46+
name: AWS Credentials
47+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502
48+
with:
49+
aws-region: ${{ inputs.region }}
50+
role-to-assume: ${{ secrets.REGION_IAM_ROLE }}
51+
mask-aws-account-id: true
52+
- id: workdir
53+
name: Create Workdir
54+
run: |
55+
mkdir -p build/project
56+
- id: cdk-install
57+
name: Install CDK
58+
working-directory: build
59+
run: |
60+
npm i aws-cdk
61+
- id: cdk-project
62+
name: CDK Project
63+
working-directory: build/project
64+
run: |
65+
npx cdk init app --language=typescript
66+
AWS_REGION="${{ inputs.region }}" npx cdk bootstrap
67+
68+
copy_layers:
69+
name: Copy Layers
70+
runs-on: ubuntu-latest
71+
permissions:
72+
contents: write
73+
id-token: write
74+
strategy:
75+
matrix:
76+
layer:
77+
- AWSLambdaPowertoolsPythonV3-python38-arm64
78+
- AWSLambdaPowertoolsPythonV3-python39-arm64
79+
- AWSLambdaPowertoolsPythonV3-python310-arm64
80+
- AWSLambdaPowertoolsPythonV3-python311-arm64
81+
- AWSLambdaPowertoolsPythonV3-python312-arm64
82+
- AWSLambdaPowertoolsPythonV3-python313-arm64
83+
- AWSLambdaPowertoolsPythonV3-python38-x86_64
84+
- AWSLambdaPowertoolsPythonV3-python39-x86_64
85+
- AWSLambdaPowertoolsPythonV3-python310-x86_64
86+
- AWSLambdaPowertoolsPythonV3-python311-x86_64
87+
- AWSLambdaPowertoolsPythonV3-python312-x86_64
88+
- AWSLambdaPowertoolsPythonV3-python313-x86_64
89+
environment: layer-${{ inputs.environment }}
90+
steps:
91+
- id: credentials
92+
name: AWS Credentials
93+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502
94+
with:
95+
aws-region: us-east-1
96+
role-to-assume: ${{ secrets.REGION_IAM_ROLE }}
97+
mask-aws-account-id: true
98+
- id: go-setup
99+
name: Setup Go
100+
uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
101+
- id: go-env
102+
name: Go Env
103+
run: go env
104+
- id: go-install-pkg
105+
name: Install
106+
run: go install github.com/aws-powertools/actions/layer-balancer/cmd/balance@latest
107+
- id: run-balance
108+
name: Run Balance
109+
run: balance -read-region us-east-1 -write-region ${{ inputs.region }} -write-role ${{ secrets.BALANCE_ROLE_ARN }} -layer-name ${{ matrix.layer }} -dry-run=false

‎.github/workflows/codeql-analysis.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ jobs:
2828

2929
steps:
3030
- name: Checkout repository
31-
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
31+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3232

3333
# Initializes the CodeQL tools for scanning.
3434
- name: Initialize CodeQL

‎.github/workflows/dependency-review.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,6 @@ jobs:
1717
runs-on: ubuntu-latest
1818
steps:
1919
- name: 'Checkout Repository'
20-
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
20+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2121
- name: 'Dependency Review'
22-
uses: actions/dependency-review-action@5a2ce3f5b92ee19cbb1541a4984c76d921601d7c # v4.3.4
22+
uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4.5.0

‎.github/workflows/label_pr_on_title.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ jobs:
5050
pull-requests: write # label respective PR
5151
steps:
5252
- name: Checkout repository
53-
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
53+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
5454
- name: "Label PR based on title"
5555
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
5656
env:

‎.github/workflows/layer_govcloud.yml

+220
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,220 @@
1+
# GovCloud Layer Publish
2+
# ---
3+
# This workflow publishes a specific layer version in an AWS account based on the environment input.
4+
#
5+
# Using a matrix, we pull each architecture and python version of the layer and store them as artifacts
6+
# we upload them to each of the GovCloud AWS accounts.
7+
#
8+
# A number of safety checks are performed to ensure safety.
9+
10+
on:
11+
workflow_dispatch:
12+
inputs:
13+
environment:
14+
description: Deployment environment
15+
type: choice
16+
options:
17+
- Gamma
18+
- Prod
19+
required: true
20+
version:
21+
description: Layer version to duplicate
22+
type: string
23+
required: true
24+
workflow_call:
25+
inputs:
26+
environment:
27+
description: Deployment environment
28+
type: string
29+
required: true
30+
version:
31+
description: Layer version to duplicate
32+
type: string
33+
required: true
34+
35+
name: Layer Deployment (GovCloud)
36+
run-name: Layer Deployment (GovCloud) - ${{ inputs.environment }}
37+
38+
jobs:
39+
download:
40+
runs-on: ubuntu-latest
41+
permissions:
42+
id-token: write
43+
contents: read
44+
strategy:
45+
matrix:
46+
layer:
47+
- AWSLambdaPowertoolsPythonV3-python38
48+
- AWSLambdaPowertoolsPythonV3-python39
49+
- AWSLambdaPowertoolsPythonV3-python310
50+
- AWSLambdaPowertoolsPythonV3-python311
51+
- AWSLambdaPowertoolsPythonV3-python312
52+
- AWSLambdaPowertoolsPythonV3-python313
53+
arch:
54+
- arm64
55+
- x86_64
56+
environment: Prod (Readonly)
57+
steps:
58+
- name: Configure AWS Credentials
59+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
60+
with:
61+
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
62+
aws-region: us-east-1
63+
mask-aws-account-id: true
64+
- name: Grab Zip
65+
run: |
66+
aws --region us-east-1 lambda get-layer-version-by-arn --arn arn:aws:lambda:us-east-1:017000801446:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ inputs.version }} --query 'Content.Location' | xargs curl -L -o ${{ matrix.layer }}_${{ matrix.arch }}.zip
67+
aws --region us-east-1 lambda get-layer-version-by-arn --arn arn:aws:lambda:us-east-1:017000801446:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ inputs.version }} > ${{ matrix.layer }}_${{ matrix.arch }}.json
68+
- name: Store Zip
69+
uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
70+
with:
71+
name: ${{ matrix.layer }}_${{ matrix.arch }}.zip
72+
path: ${{ matrix.layer }}_${{ matrix.arch }}.zip
73+
retention-days: 1
74+
if-no-files-found: error
75+
- name: Store Metadata
76+
uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
77+
with:
78+
name: ${{ matrix.layer }}_${{ matrix.arch }}.json
79+
path: ${{ matrix.layer }}_${{ matrix.arch }}.json
80+
retention-days: 1
81+
if-no-files-found: error
82+
83+
copy_east:
84+
name: Copy (East)
85+
needs: download
86+
runs-on: ubuntu-latest
87+
permissions:
88+
id-token: write
89+
contents: read
90+
strategy:
91+
matrix:
92+
layer:
93+
- AWSLambdaPowertoolsPythonV3-python38
94+
- AWSLambdaPowertoolsPythonV3-python39
95+
- AWSLambdaPowertoolsPythonV3-python310
96+
- AWSLambdaPowertoolsPythonV3-python311
97+
- AWSLambdaPowertoolsPythonV3-python312
98+
- AWSLambdaPowertoolsPythonV3-python313
99+
arch:
100+
- arm64
101+
- x86_64
102+
environment: GovCloud ${{ inputs.environment }} (East)
103+
steps:
104+
- name: Download Zip
105+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
106+
with:
107+
name: ${{ matrix.layer }}_${{ matrix.arch }}.zip
108+
- name: Download Metadata
109+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
110+
with:
111+
name: ${{ matrix.layer }}_${{ matrix.arch }}.json
112+
- name: Verify Layer Signature
113+
run: |
114+
SHA=$(jq -r '.Content.CodeSha256' '${{ matrix.layer }}_${{ matrix.arch }}.json')
115+
test "$(openssl dgst -sha256 -binary ${{ matrix.layer }}_${{ matrix.arch }}.zip | openssl enc -base64)" == "$SHA" && echo "SHA OK: ${SHA}" || exit 1
116+
- name: Configure AWS Credentials
117+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
118+
with:
119+
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
120+
aws-region: us-gov-east-1
121+
mask-aws-account-id: true
122+
- name: Create Layer
123+
id: create-layer
124+
run: |
125+
LAYER_VERSION=$(aws --region us-gov-east-1 lambda publish-layer-version \
126+
--layer-name ${{ matrix.layer }}-${{ matrix.arch }} \
127+
--zip-file fileb://./${{ matrix.layer }}_${{ matrix.arch }}.zip \
128+
--compatible-runtimes "$(jq -r '.CompatibleRuntimes[0]' '${{ matrix.layer }}_${{ matrix.arch }}.json')" \
129+
--compatible-architectures "$(jq -r '.CompatibleArchitectures[0]' '${{ matrix.layer }}_${{ matrix.arch }}.json')" \
130+
--license-info "MIT-0" \
131+
--description "$(jq -r '.Description' '${{ matrix.layer }}_${{ matrix.arch }}.json')" \
132+
--query 'Version' \
133+
--output text)
134+
135+
echo "LAYER_VERSION=$LAYER_VERSION" >> "$GITHUB_OUTPUT"
136+
137+
aws --region us-gov-east-1 lambda add-layer-version-permission \
138+
--layer-name '${{ matrix.layer }}-${{ matrix.arch }}' \
139+
--statement-id 'PublicLayer' \
140+
--action lambda:GetLayerVersion \
141+
--principal '*' \
142+
--version-number "$LAYER_VERSION"
143+
- name: Verify Layer
144+
env:
145+
LAYER_VERSION: ${{ steps.create-layer.outputs.LAYER_VERSION }}
146+
run: |
147+
REMOTE_SHA=$(aws --region us-gov-east-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-east-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ env.LAYER_VERSION }}' --query 'Content.CodeSha256' --output text)
148+
SHA=$(jq -r '.Content.CodeSha256' '${{ matrix.layer }}_${{ matrix.arch }}.json')
149+
test "$REMOTE_SHA" == "$SHA" && echo "SHA OK: ${SHA}" || exit 1
150+
aws --region us-gov-east-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-east-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ env.LAYER_VERSION }}' --output table
151+
152+
copy_west:
153+
name: Copy (West)
154+
needs: download
155+
runs-on: ubuntu-latest
156+
permissions:
157+
id-token: write
158+
contents: read
159+
strategy:
160+
matrix:
161+
layer:
162+
- AWSLambdaPowertoolsPythonV3-python38
163+
- AWSLambdaPowertoolsPythonV3-python39
164+
- AWSLambdaPowertoolsPythonV3-python310
165+
- AWSLambdaPowertoolsPythonV3-python311
166+
- AWSLambdaPowertoolsPythonV3-python312
167+
- AWSLambdaPowertoolsPythonV3-python313
168+
arch:
169+
- arm64
170+
- x86_64
171+
environment:
172+
name: GovCloud ${{ inputs.environment }} (West)
173+
steps:
174+
- name: Download Zip
175+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
176+
with:
177+
name: ${{ matrix.layer }}_${{ matrix.arch }}.zip
178+
- name: Download Metadata
179+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
180+
with:
181+
name: ${{ matrix.layer }}_${{ matrix.arch }}.json
182+
- name: Verify Layer Signature
183+
run: |
184+
SHA=$(jq -r '.Content.CodeSha256' '${{ matrix.layer }}_${{ matrix.arch }}.json')
185+
test "$(openssl dgst -sha256 -binary ${{ matrix.layer }}_${{ matrix.arch }}.zip | openssl enc -base64)" == "$SHA" && echo "SHA OK: ${SHA}" || exit 1
186+
- name: Configure AWS Credentials
187+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
188+
with:
189+
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
190+
aws-region: us-gov-west-1
191+
mask-aws-account-id: true
192+
- name: Create Layer
193+
id: create-layer
194+
run: |
195+
LAYER_VERSION=$(aws --region us-gov-west-1 lambda publish-layer-version \
196+
--layer-name ${{ matrix.layer }}-${{ matrix.arch }} \
197+
--zip-file fileb://./${{ matrix.layer }}_${{ matrix.arch }}.zip \
198+
--compatible-runtimes "$(jq -r '.CompatibleRuntimes[0]' '${{ matrix.layer }}_${{ matrix.arch }}.json')" \
199+
--compatible-architectures "$(jq -r '.CompatibleArchitectures[0]' '${{ matrix.layer }}_${{ matrix.arch }}.json')" \
200+
--license-info "MIT-0" \
201+
--description "$(jq -r '.Description' '${{ matrix.layer }}_${{ matrix.arch }}.json')" \
202+
--query 'Version' \
203+
--output text)
204+
205+
echo "LAYER_VERSION=$LAYER_VERSION" >> "$GITHUB_OUTPUT"
206+
207+
aws --region us-gov-west-1 lambda add-layer-version-permission \
208+
--layer-name '${{ matrix.layer }}-${{ matrix.arch }}' \
209+
--statement-id 'PublicLayer' \
210+
--action lambda:GetLayerVersion \
211+
--principal '*' \
212+
--version-number "$LAYER_VERSION"
213+
- name: Verify Layer
214+
env:
215+
LAYER_VERSION: ${{ steps.create-layer.outputs.LAYER_VERSION }}
216+
run: |
217+
REMOTE_SHA=$(aws --region us-gov-west-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-west-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ env.LAYER_VERSION }}' --query 'Content.CodeSha256' --output text)
218+
SHA=$(jq -r '.Content.CodeSha256' '${{ matrix.layer }}_${{ matrix.arch }}.json')
219+
test "$REMOTE_SHA" == "$SHA" && echo "SHA OK: ${SHA}" || exit 1
220+
aws --region us-gov-west-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-west-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ env.LAYER_VERSION }}' --output table

0 commit comments

Comments
 (0)