Skip to content

Commit 85c8c1f

Browse files
wangyb-AAlex Wangdurable-execution-devzhongkechen
authored
ci: run build/e2e/conformance on CodeBuild runner (#751)
* ci: run Spotless on the CodeBuild-hosted runner Move spotless-check from ubuntu-latest to the codebuild-github-actions-runner label (CodeBuild Lambda compute in the Java testing account). The corretto21 runner image ships Maven, and actions/setup-java downloads Corretto 17 directly, so only runs-on changes. * ci: run build/e2e/conformance on CodeBuild runner * ci: replace docker jacoco badge action with uv * test: clear ambient X-Ray env var for otel-plugin tests * ci: use curl for milestone badge (gh absent on runner) * ci: pin uv and jacoco-badge-generator versions The replaced cicirello/jacoco-badge-generator action was SHA-pinned; the uv-based replacement resolved the latest PyPI release on every run. Pin jacoco-badge-generator 2.12.1 and uv 0.12.22, the versions the last green build used. --------- Co-authored-by: Alex Wang <wangyb@amazon.com> Co-authored-by: durable-execution-dev <durable-execution-dev@amazon.com> Co-authored-by: Frank Chen <65260095+zhongkechen@users.noreply.github.com>
1 parent ac6a6f5 commit 85c8c1f

5 files changed

Lines changed: 72 additions & 14 deletions

File tree

‎.github/workflows/build.yml‎

Lines changed: 35 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,11 @@ permissions:
5353

5454
jobs:
5555
build:
56-
runs-on: ubuntu-latest
56+
# CodeBuild-hosted runner in the Java testing account (Lambda compute,
57+
# corretto21 image). Fork PRs stay on GitHub-hosted runners so untrusted
58+
# fork code never executes inside the testing account; same-repo PRs, push
59+
# and workflow_dispatch use the ephemeral CodeBuild runner.
60+
runs-on: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && 'ubuntu-latest' || format('codebuild-github-actions-runner-{0}-{1}', github.run_id, github.run_attempt) }}
5761
strategy:
5862
fail-fast: false
5963
matrix:
@@ -77,12 +81,27 @@ jobs:
7781
- name: Build and test
7882
run: mvn -B install --file pom.xml
7983

80-
- name: Generate JaCoCo Badge
84+
- name: Setup uv for coverage badge
8185
if: ${{ matrix.java == 17 }}
82-
uses: cicirello/jacoco-badge-generator@72266185b7ee48a6fd74eaf0238395cc8b14fef8 # v2
86+
# cicirello/jacoco-badge-generator is a Docker-based action; the
87+
# CodeBuild Lambda-compute runner has no docker, so run the same tool
88+
# from PyPI via uv instead. uv provides Python on the Amazon Linux image
89+
# (actions/setup-python ships only Ubuntu builds).
90+
uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
8391
with:
84-
jacoco-csv-file: coverage-report/target/site/jacoco-aggregate/jacoco.csv
85-
badges-directory: coverage-report/target/site/jacoco-aggregate
92+
version: "0.12.22"
93+
94+
- name: Generate JaCoCo Badge
95+
if: ${{ matrix.java == 17 }}
96+
# Equivalent to cicirello/jacoco-badge-generator@v2 with the two inputs
97+
# this workflow set (jacoco-csv-file, badges-directory); writes
98+
# jacoco.svg into the badges directory, matching the action's default.
99+
# The package version is pinned so this step stays reproducible, as the
100+
# SHA-pinned action was.
101+
run: |
102+
uv run --with jacoco-badge-generator==2.12.1 python -m jacoco_badge_generator \
103+
-j coverage-report/target/site/jacoco-aggregate/jacoco.csv \
104+
-d coverage-report/target/site/jacoco-aggregate
86105
87106
- name: Generate javadoc site
88107
if: ${{ matrix.java == 17 }}
@@ -95,8 +114,15 @@ jobs:
95114
run: |
96115
set -euo pipefail
97116
98-
TITLE=$(gh api repos/${{ github.repository }}/milestones \
99-
--jq '[.[] | select(.state == "open" and .due_on != null)] | sort_by(.due_on) | .[0].title // empty')
117+
# Use curl + jq rather than the GitHub CLI: gh is not preinstalled on
118+
# the CodeBuild runner image. GITHUB_API_URL/GH_TOKEN are provided by
119+
# Actions; the jq filter matches the previous `gh api --jq` behavior.
120+
TITLE=$(curl -sfL \
121+
-H "Authorization: Bearer ${GH_TOKEN}" \
122+
-H "Accept: application/vnd.github+json" \
123+
-H "X-GitHub-Api-Version: 2022-11-28" \
124+
"${GITHUB_API_URL}/repos/${{ github.repository }}/milestones?state=open&per_page=100" \
125+
| jq -r '[.[] | select(.state == "open" and .due_on != null)] | sort_by(.due_on) | .[0].title // empty')
100126
101127
if [ -z "$TITLE" ]; then
102128
URL="https://img.shields.io/badge/Next%20Milestone-No%20milestone-lightgrey"
@@ -131,7 +157,8 @@ jobs:
131157
deploy-pages:
132158
if: ${{ github.event_name == 'milestone' || github.ref == 'refs/heads/main' }}
133159
needs: build
134-
runs-on: ubuntu-latest
160+
# Never fork-reachable (main/milestone only); runs only actions/deploy-pages.
161+
runs-on: ${{ format('codebuild-github-actions-runner-{0}-{1}', github.run_id, github.run_attempt) }}
135162
environment:
136163
name: github-pages
137164
url: ${{ steps.deployment.outputs.page_url }}

‎.github/workflows/check-spotless.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,11 @@ permissions:
3030

3131
jobs:
3232
spotless-check:
33-
runs-on: ubuntu-latest
33+
# CodeBuild-hosted runner in the Java testing account (Lambda compute,
34+
# corretto21 image with Maven preinstalled). The label must match the
35+
# CodeBuild project name exactly. Fork PRs stay on GitHub-hosted runners so
36+
# untrusted fork code never executes inside the testing account.
37+
runs-on: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && 'ubuntu-latest' || format('codebuild-github-actions-runner-{0}-{1}', github.run_id, github.run_attempt) }}
3438
steps:
3539
- name: Checkout repository
3640
uses: actions/checkout@v7

‎.github/workflows/conformance-tests.yml‎

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,9 @@ jobs:
3737
# 2. For PRs, run only same-repo branches from non-Dependabot actors; forked PRs or Dependabot should not access secrets.
3838
# Skipping this job also skips the `conformance` matrix, which needs its output.
3939
if: github.event_name != 'pull_request' || (github.actor != 'dependabot[bot]' && github.event.pull_request.head.repo.full_name == github.repository)
40-
runs-on: ubuntu-latest
40+
# Job is already gated to same-repo, non-Dependabot actors above, so fork
41+
# code never runs here; use the plain CodeBuild runner label.
42+
runs-on: ${{ format('codebuild-github-actions-runner-{0}-{1}', github.run_id, github.run_attempt) }}
4143
outputs:
4244
suites: ${{ steps.discover.outputs.suites }}
4345
steps:
@@ -52,9 +54,16 @@ jobs:
5254
conformance:
5355
name: conformance (${{ matrix.suite }})
5456
needs: discover_suites
55-
runs-on: ubuntu-latest
57+
# discover_suites (its `needs`) is gated to same-repo, non-Dependabot actors,
58+
# which also gates this matrix; use the plain CodeBuild runner label.
59+
runs-on: ${{ format('codebuild-github-actions-runner-{0}-{1}', github.run_id, github.run_attempt) }}
5660
env:
5761
AWS_REGION: us-west-2
62+
# The runner image ships /etc/pip.conf with `[global] target =
63+
# /tmp/opt/python/site-packages` on PYTHONPATH; ignore both so the uv venv
64+
# and the conformance runner install stay isolated.
65+
PIP_CONFIG_FILE: /dev/null
66+
PYTHONPATH: ""
5867
strategy:
5968
fail-fast: false
6069
matrix:
@@ -83,12 +92,15 @@ jobs:
8392
run: mvn -B -q -Dmaven.test.skip=true install --file pom.xml
8493

8594
- name: Setup Python
86-
uses: actions/setup-python@v7
95+
# The runner image is Amazon Linux; actions/setup-python only ships Ubuntu
96+
# builds, so uv provides the Python 3.14 interpreter and activates a venv.
97+
uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
8798
with:
8899
python-version: "3.14"
100+
activate-environment: true
89101

90102
- name: Install conformance runner
91-
run: pip install "git+https://github.com/aws/aws-durable-execution-conformance-tests.git@main#subdirectory=packages/aws-durable-execution-conformance-tests"
103+
run: uv pip install "git+https://github.com/aws/aws-durable-execution-conformance-tests.git@main#subdirectory=packages/aws-durable-execution-conformance-tests"
92104

93105
- name: Configure AWS credentials
94106
uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0

‎.github/workflows/e2e-tests.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,9 @@ jobs:
4040
env:
4141
AWS_REGION: us-west-2
4242
E2E_TEST_PARALLELISM: 4
43-
runs-on: ubuntu-latest
43+
# Job is already gated to same-repo, non-Dependabot actors above, so fork
44+
# code never runs here; use the plain CodeBuild runner label.
45+
runs-on: ${{ format('codebuild-github-actions-runner-{0}-{1}', github.run_id, github.run_attempt) }}
4446
strategy:
4547
fail-fast: false
4648
matrix:

‎otel-plugin/pom.xml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,19 @@
100100
<plugin>
101101
<groupId>org.apache.maven.plugins</groupId>
102102
<artifactId>maven-surefire-plugin</artifactId>
103+
<configuration>
104+
<!--
105+
The X-Ray context extractor falls back to the ambient _X_AMZN_TRACE_ID
106+
environment variable. CI runners on Lambda/CodeBuild compute inject it,
107+
which flips the default-constructor plugins' sampling to NOT_SAMPLED and
108+
drops all spans, breaking hermetic unit tests. Clear it for the forked
109+
test JVM so these tests do not depend on the host environment (no effect
110+
on hosts where the variable is already absent).
111+
-->
112+
<environmentVariables>
113+
<_X_AMZN_TRACE_ID/>
114+
</environmentVariables>
115+
</configuration>
103116
</plugin>
104117
<plugin>
105118
<groupId>com.diffplug.spotless</groupId>

0 commit comments

Comments
 (0)