Skip to content

Commit e2dd5ff

Browse files
dreamorosidreamorosi
authored
Merge branch 'main' into feature/cognito-trigger-schema
2 parents 35b2473 + 1bcd9ba commit e2dd5ff

File tree

163 files changed

+7526
-4010
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

163 files changed

+7526
-4010
lines changed

Diff for: ‎.devcontainer/Dockerfile

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# See here for image contents: https://github.com/microsoft/vscode-dev-containers/blob/v0.212.0/containers/javascript-node/.devcontainer/base.Dockerfile
2-
FROM mcr.microsoft.com/vscode/devcontainers/javascript-node@sha256:896bfba10582c9239d1c36bab53b80af06253019f62b846fa440ee643ca63eb1
2+
FROM mcr.microsoft.com/vscode/devcontainers/javascript-node@sha256:78fda8c284dd3247d7385d55974e278314233f1acc130ba89757703137dbda45
33

44
# Install fnm to manage Node.js versions
55
RUN curl -fsSL https://fnm.vercel.app/install -o /tmp/install \

Diff for: ‎.github/scripts/get_pr_info.js

-30
This file was deleted.

Diff for: ‎.github/workflows/bootstrap_region.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ jobs:
8888
mask-aws-account-id: true
8989
- id: go-setup
9090
name: Setup Go
91-
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
91+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
9292
with:
9393
go-version: '>=1.23.0'
9494
- id: go-env

Diff for: ‎.github/workflows/dependency-review.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -19,4 +19,4 @@ jobs:
1919
- name: 'Checkout Repository'
2020
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2121
- name: 'Dependency Review'
22-
uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4.5.0
22+
uses: actions/dependency-review-action@ce3cf9537a52e8119d91fd484ab5b8a807627bf8 # v4.6.0

Diff for: ‎.github/workflows/layer_balance.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ jobs:
5050
mask-aws-account-id: true
5151
- id: go-setup
5252
name: Setup Go
53-
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
53+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
5454
with:
5555
go-version: '>=1.23.0'
5656
- id: go-env

Diff for: ‎.github/workflows/layer_govcloud_verify.yml

+108
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
# GovCloud Layer Verification
2+
# ---
3+
# This workflow queries the GovCloud layer info in production only
4+
5+
on:
6+
workflow_dispatch:
7+
inputs:
8+
environment:
9+
description: Deployment environment
10+
type: choice
11+
options:
12+
- Gamma
13+
- Prod
14+
required: true
15+
version:
16+
description: Layer version to verify
17+
type: string
18+
required: true
19+
govcloud_version:
20+
description: GovCloud Layer version to verify, this is mostly used in Gamma where a version mismatch might exist
21+
type: string
22+
required: false
23+
24+
workflow_call:
25+
inputs:
26+
environment:
27+
description: Deployment environment
28+
type: string
29+
required: true
30+
version:
31+
description: Layer version to verify
32+
type: string
33+
required: true
34+
govcloud_version:
35+
description: GovCloud Layer version to verify, this is mostly used in Gamma where a version mismatch might exist
36+
type: string
37+
required: false
38+
39+
name: Layer Verification (GovCloud)
40+
run-name: Layer Verification (GovCloud) / Version ${{ inputs.version }}
41+
42+
permissions: {}
43+
44+
jobs:
45+
commercial:
46+
runs-on: ubuntu-latest
47+
permissions:
48+
id-token: write
49+
contents: read
50+
environment: Prod (Readonly)
51+
steps:
52+
- name: Configure AWS Credentials
53+
uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0
54+
with:
55+
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
56+
aws-region: us-east-1
57+
mask-aws-account-id: true
58+
- name: Output AWSLambdaPowertoolsTypeScriptV2
59+
# fetch the specific layer version information from the us-east-1 commercial region
60+
run: |
61+
aws --region us-east-1 lambda get-layer-version-by-arn --arn 'arn:aws:lambda:us-east-1:094274105915:layer:AWSLambdaPowertoolsTypeScriptV2:${{ inputs.version }}' > AWSLambdaPowertoolsTypeScriptV2.json
62+
- name: Store Metadata
63+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
64+
with:
65+
name: AWSLambdaPowertoolsTypeScriptV2.json
66+
path: AWSLambdaPowertoolsTypeScriptV2.json
67+
retention-days: 1
68+
if-no-files-found: error
69+
70+
verify:
71+
name: Verify
72+
needs: commercial
73+
runs-on: ubuntu-latest
74+
permissions:
75+
id-token: write
76+
contents: read
77+
environment: GovCloud ${{ inputs.environment }}
78+
strategy:
79+
matrix:
80+
region:
81+
- us-gov-east-1
82+
- us-gov-west-1
83+
steps:
84+
- name: Download Metadata
85+
uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
86+
with:
87+
name: AWSLambdaPowertoolsTypeScriptV2.json
88+
- id: transform
89+
run: |
90+
echo 'CONVERTED_REGION=${{ matrix.region }}' | tr 'a-z\-' 'A-Z_' >> "$GITHUB_OUTPUT"
91+
- name: Configure AWS Credentials
92+
uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0
93+
with:
94+
role-to-assume: ${{ secrets[format('IAM_ROLE_{0}', steps.transform.outputs.CONVERTED_REGION)] }}
95+
aws-region: ${{ matrix.region}}
96+
mask-aws-account-id: true
97+
- id: govcloud_version
98+
name: GovCloud Layer Version
99+
run: |
100+
echo 'govcloud_version=$([[ -n "${{ inputs.govcloud_version}}" ]] && echo ${{ inputs.govcloud_version}} || echo ${{ inputs.version }} )' >> "$GITHUB_OUTPUT"
101+
- name: Verify Layer
102+
run: |
103+
export layer_output='AWSLambdaPowertoolsTypeScriptV2-${{matrix.region}}.json'
104+
aws --region ${{ matrix.region}} lambda get-layer-version-by-arn --arn "arn:aws-us-gov:lambda:${{ matrix.region}}:${{ secrets[format('AWS_ACCOUNT_{0}', steps.transform.outputs.CONVERTED_REGION)] }}:layer:AWSLambdaPowertoolsTypeScriptV2:${{ steps.govcloud_version.outputs.govcloud_version }}" > $layer_output
105+
REMOTE_SHA=$(jq -r '.Content.CodeSha256' $layer_output)
106+
LOCAL_SHA=$(jq -r '.Content.CodeSha256' AWSLambdaPowertoolsTypeScriptV2.json)
107+
test "$REMOTE_SHA" == "$LOCAL_SHA" && echo "SHA OK: ${LOCAL_SHA}" || exit 1
108+
jq -s -r '["Layer Arn", "Runtimes", "Version", "Description", "SHA256"], ([.[0], .[1]] | .[] | [.LayerArn, (.CompatibleRuntimes | join("/")), .Version, .Description, .Content.CodeSha256]) |@tsv' AWSLambdaPowertoolsTypeScriptV2.json $layer_output | column -t -s $'\t'

Diff for: ‎.github/workflows/layers_govcloud.yml

+145
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
name: Layer Deployment (GovCloud)
2+
3+
# GovCloud Layer Publish
4+
# ---
5+
# This workflow publishes a specific layer version in an AWS account based on the environment input.
6+
#
7+
# We pull each the version of the layer and store them as artifacts, the we upload them to each of the GovCloud AWS accounts.
8+
#
9+
# A number of safety checks are performed to ensure safety.
10+
11+
on:
12+
workflow_dispatch:
13+
inputs:
14+
environment:
15+
description: Deployment environment
16+
type: choice
17+
options:
18+
- Gamma
19+
- Prod
20+
required: true
21+
version:
22+
description: Layer version to duplicate
23+
type: string
24+
required: true
25+
workflow_call:
26+
inputs:
27+
environment:
28+
description: Deployment environment
29+
type: string
30+
required: true
31+
version:
32+
description: Layer version to duplicate
33+
type: string
34+
required: true
35+
36+
run-name: Layer Deployment (GovCloud) - ${{ inputs.environment }} / Version - ${{ inputs.version }}
37+
38+
permissions:
39+
contents: read
40+
41+
jobs:
42+
download:
43+
runs-on: ubuntu-latest
44+
permissions:
45+
id-token: write
46+
contents: read
47+
environment: Prod (Readonly)
48+
steps:
49+
- name: Configure AWS Credentials
50+
uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0
51+
with:
52+
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
53+
aws-region: us-east-1
54+
mask-aws-account-id: true
55+
- name: Grab Zip
56+
run: |
57+
aws --region us-east-1 lambda get-layer-version-by-arn --arn arn:aws:lambda:us-east-1:094274105915:layer:AWSLambdaPowertoolsTypeScriptV2:${{ inputs.version }} --query 'Content.Location' | xargs curl -L -o AWSLambdaPowertoolsTypeScriptV2.zip
58+
aws --region us-east-1 lambda get-layer-version-by-arn --arn arn:aws:lambda:us-east-1:094274105915:layer:AWSLambdaPowertoolsTypeScriptV2:${{ inputs.version }} > AWSLambdaPowertoolsTypeScriptV2.json
59+
- name: Store Zip
60+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
61+
with:
62+
name: AWSLambdaPowertoolsTypeScriptV2.zip
63+
path: AWSLambdaPowertoolsTypeScriptV2.zip
64+
retention-days: 1
65+
if-no-files-found: error
66+
- name: Store Metadata
67+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
68+
with:
69+
name: AWSLambdaPowertoolsTypeScriptV2.json
70+
path: AWSLambdaPowertoolsTypeScriptV2.json
71+
retention-days: 1
72+
if-no-files-found: error
73+
74+
copy:
75+
name: Copy
76+
needs: download
77+
runs-on: ubuntu-latest
78+
permissions:
79+
id-token: write
80+
contents: read
81+
environment: GovCloud ${{ inputs.environment }}
82+
strategy:
83+
matrix:
84+
region:
85+
- us-gov-east-1
86+
- us-gov-west-1
87+
steps:
88+
- name: Download Zip
89+
uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
90+
with:
91+
name: AWSLambdaPowertoolsTypeScriptV2.zip
92+
- name: Download Metadata
93+
uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
94+
with:
95+
name: AWSLambdaPowertoolsTypeScriptV2.json
96+
- name: Verify Layer Signature
97+
run: |
98+
SHA=$(jq -r '.Content.CodeSha256' 'AWSLambdaPowertoolsTypeScriptV2.json')
99+
test "$(openssl dgst -sha256 -binary AWSLambdaPowertoolsTypeScriptV2.zip | openssl enc -base64)" == "$SHA" && echo "SHA OK: ${SHA}" || exit 1
100+
- id: transform
101+
run: |
102+
echo 'CONVERTED_REGION=${{ matrix.region }}' | tr 'a-z\-' 'A-Z_' >> "$GITHUB_OUTPUT"
103+
- name: Configure AWS Credentials
104+
uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0
105+
with:
106+
role-to-assume: ${{ secrets[format('IAM_ROLE_{0}', steps.transform.outputs.CONVERTED_REGION)] }}
107+
aws-region: ${{ matrix.region}}
108+
mask-aws-account-id: true
109+
- name: Create Layer
110+
id: create-layer
111+
run: |
112+
cat AWSLambdaPowertoolsTypeScriptV2.json | jq '{"LayerName": "AWSLambdaPowertoolsTypeScriptV2", "Description": .Description, "CompatibleRuntimes": .CompatibleRuntimes, "LicenseInfo": .LicenseInfo}' > input.json
113+
114+
LAYER_VERSION=$(aws --region ${{ matrix.region}} lambda publish-layer-version \
115+
--zip-file fileb://./AWSLambdaPowertoolsTypeScriptV2.zip \
116+
--cli-input-json file://./input.json \
117+
--query 'Version' \
118+
--output text)
119+
120+
echo "LAYER_VERSION=$LAYER_VERSION" >> "$GITHUB_OUTPUT"
121+
122+
aws --region ${{ matrix.region}} lambda add-layer-version-permission \
123+
--layer-name 'AWSLambdaPowertoolsTypeScriptV2' \
124+
--statement-id 'PublicLayer' \
125+
--action lambda:GetLayerVersion \
126+
--principal '*' \
127+
--version-number "$LAYER_VERSION"
128+
- name: Verify Layer
129+
env:
130+
LAYER_VERSION: ${{ steps.create-layer.outputs.LAYER_VERSION }}
131+
run: |
132+
export layer_output='AWSLambdaPowertoolsTypeScriptV2-${{matrix.region}}.json'
133+
aws --region ${{ matrix.region}} lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:${{ matrix.region}}:${{ secrets[format('AWS_ACCOUNT_{0}', steps.transform.outputs.CONVERTED_REGION)] }}:layer:AWSLambdaPowertoolsTypeScriptV2:${{ env.LAYER_VERSION }}' > $layer_output
134+
REMOTE_SHA=$(jq -r '.Content.CodeSha256' $layer_output)
135+
LOCAL_SHA=$(jq -r '.Content.CodeSha256' AWSLambdaPowertoolsTypeScriptV2.json)
136+
test "$REMOTE_SHA" == "$LOCAL_SHA" && echo "SHA OK: ${LOCAL_SHA}" || exit 1
137+
jq -s -r '["Layer Arn", "Runtimes", "Version", "Description", "SHA256"], ([.[0], .[1]] | .[] | [.LayerArn, (.CompatibleRuntimes | join("/")), .Version, .Description, .Content.CodeSha256]) |@tsv' AWSLambdaPowertoolsTypeScriptV2.json $layer_output | column -t -s $'\t'
138+
139+
- name: Store Metadata - ${{ matrix.region }}
140+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
141+
with:
142+
name: AWSLambdaPowertoolsTypeScriptV2-${{ matrix.region }}.json
143+
path: AWSLambdaPowertoolsTypeScriptV2-${{ matrix.region }}.json
144+
retention-days: 1
145+
if-no-files-found: error

Diff for: ‎.github/workflows/ossf_scorecard.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -35,14 +35,14 @@ jobs:
3535
# repo_token: ${{ secrets.SCORECARD_TOKEN }} # read-only fine-grained token to read branch protection settings
3636

3737
- name: "Upload results"
38-
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
38+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
3939
with:
4040
name: SARIF file
4141
path: results.sarif
4242
retention-days: 5
4343

4444
# Upload the results to GitHub's code scanning dashboard.
4545
- name: "Upload to code-scanning"
46-
uses: github/codeql-action/upload-sarif@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
46+
uses: github/codeql-action/upload-sarif@1b549b9259bda1cb5ddde3b41741a82a2d15a841 # v3.28.13
4747
with:
4848
sarif_file: results.sarif

Diff for: ‎.github/workflows/publish_layer.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ jobs:
4545
- name: Zip output
4646
run: zip -r cdk.out.zip layers/cdk.out
4747
- name: Archive CDK artifacts
48-
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
48+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
4949
with:
5050
name: cdk-layer-artifact
5151
path: cdk.out.zip
@@ -97,7 +97,7 @@ jobs:
9797
with:
9898
ref: ${{ github.sha }}
9999
- name: Download CDK layer artifacts
100-
uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
100+
uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
101101
with:
102102
path: cdk-layer-stack
103103
pattern: cdk-layer-stack-* # merge all Layer artifacts created per region earlier (reusable_deploy_layer_stack.yml; step "Save Layer ARN artifact")

Diff for: ‎.github/workflows/record_pr.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ jobs:
5353
script: |
5454
const script = require('.github/scripts/save_pr_details.js')
5555
await script({github, context, core})
56-
- uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
56+
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
5757
with:
5858
name: pr
5959
path: pr.txt

Diff for: ‎.github/workflows/reusable_deploy_layer_stack.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ jobs:
8181
- name: Setup dependencies
8282
uses: aws-powertools/actions/.github/actions/cached-node-modules@29979bc5339bf54f76a11ac36ff67701986bb0f0
8383
- name: Download artifact
84-
uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
84+
uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
8585
with:
8686
name: ${{ inputs.artifact-name }}
8787
- name: Unzip artifact
@@ -96,7 +96,7 @@ jobs:
9696
cat cdk-layer-stack/${{ matrix.region }}-layer-version.txt
9797
- name: Save Layer ARN artifact
9898
if: ${{ inputs.stage == 'PROD' }}
99-
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
99+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
100100
with:
101101
name: cdk-layer-stack-${{ matrix.region }}
102102
path: ./cdk-layer-stack/* # NOTE: upload-artifact does not inherit working-directory setting.

Diff for: ‎.github/workflows/reusable_publish_docs.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ jobs:
5959
- name: Setup dependencies
6060
uses: aws-powertools/actions/.github/actions/cached-node-modules@29979bc5339bf54f76a11ac36ff67701986bb0f0
6161
- name: Set up Python
62-
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
62+
uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5.5.0
6363
with:
6464
python-version: "3.12"
6565
- name: Install doc generation dependencies
@@ -89,7 +89,7 @@ jobs:
8989
role-to-assume: ${{ secrets.AWS_DOCS_ROLE_ARN }}
9090
mask-aws-account-id: true
9191
- name: Create Artifact (Site)
92-
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
92+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
9393
with:
9494
name: site
9595
path: site

0 commit comments

Comments
 (0)