Repository navigation
Conversation
Route the pull_request and push jobs of ci.yml, cloud-tests.yml, conformance-tests.yml and codeql.yml to the CodeBuild-hosted GitHub Actions runner in the Rust testing account; pull requests from forks keep using ubuntu-latest. The CodeBuild image has no rustup, so a new composite action .github/actions/ensure-rustup installs a pinned rustup-init (1.29.1, sha256-verified) with no default toolchain when rustup is absent, and is a no-op on hosted runners. The free-disk-space step in the workspaces job is limited to GitHub-hosted runners.
Rust 1.99.0 (2026-09-28) deprecates AtomicUsize::fetch_update in favour of try_update and adds the assert_is_empty lint; with -D warnings both fail `cargo clippy` on stable, so CI has been red since the 1.99 release. try_update is only stable from 1.95 and the MSRV is 1.94.1, so the two fetch_update calls in test_util.rs keep fetch_update under #[allow(deprecated)] with a note to switch once the MSRV moves. The six assert!(x.is_empty()) / assert!(!x.is_empty()) test assertions become assert_eq!/assert_ne! against an empty Vec, as the lint asks, so the offending value is printed on failure. Verified: cargo fmt --check, cargo clippy --all-targets --all-features -D warnings and cargo test --lib (538 passed) on 1.99.0; cargo check --all-targets --all-features on 1.94.1.
yaythomas
added
the
changes-requested
| # must match the CodeBuild project name. Pull requests from forks are routed | ||
| # to GitHub-hosted runners. This is routing, not a trust boundary: the fork | ||
| # boundary is the repository's approval setting for fork workflows. | ||
| runs-on: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && 'ubuntu-latest' || format('codebuild-github-actions-runner-{0}-{1}', github.run_id, github.run_attempt) }} |
There was a problem hiding this comment.
Please include Dependabot in the hosted-runner condition. Dependabot branches belong to this repository, so the current expression runs updated dependency build scripts and procedural macros inside the CodeBuild account before maintainer review. Python PR 747 routes Dependabot builds to ubuntu-latest. Please add github.actor == 'dependabot[bot]' to this condition and the repeated conditions. The cloud and conformance workflows should instead skip fork and Dependabot PRs because those jobs require unavailable secrets.
| # must match the CodeBuild project name. Pull requests from forks are routed | ||
| # to GitHub-hosted runners. This is routing, not a trust boundary: the fork | ||
| # boundary is the repository's approval setting for fork workflows. | ||
| runs-on: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && 'ubuntu-latest' || format('codebuild-github-actions-runner-{0}-{1}', github.run_id, github.run_attempt) }} |
There was a problem hiding this comment.
This moves the job to a CodeBuild project with a stated 60-minute limit, but the next line retains timeout-minutes: 90. CodeBuild can terminate the runner before GitHub cancels the job. The if: always() teardown then cannot run, which can leave the three test stacks deployed. Please set the GitHub timeout below 60 minutes with enough cleanup time, move cleanup into a separate if: always() job, or raise the CodeBuild timeout above 90 minutes.
Summary
Goal: run this repository's CI, cloud tests, conformance tests and CodeQL on the CodeBuild-hosted GitHub Actions runner in the Rust testing account instead of the shared
ubuntu-latestpool, so a PR's checks start in seconds rather than waiting 0–74 minutes for a shared runner.Same change the other SDKs made (aws/aws-durable-execution-sdk-js#937, aws/aws-durable-execution-sdk-python#747, aws/aws-durable-execution-sdk-java#751, aws/aws-durable-execution-sdk-go#135). The runner is the
github-actions-runnerCodeBuild project (EC2standard:7.0, Ubuntu 22.04, 60-minute job limit, one fresh container per job); it has no access to test resources, and the jobs keep getting their AWS credentials through OIDC andTEST_ROLE_ARNexactly as before.What changed
ci.ymlcheck,msrv,dependencies,external-types,semver,feature-powerset,workspaces(2)cloud-tests.ymlexample-testsconformance-tests.ymldiscover_suites,build_handlers,conformance(12 suites)codeql.ymlanalyzeEach
runs-onis nowPull requests from forks are routed to
ubuntu-latestand behave exactly as today. This is routing, not a trust boundary: apull_requestevent runs the PR's own workflow file, so the fork boundary is the repository's "Approval for running fork pull request workflows" setting. No job gating was added or changed.rustupis not on the CodeBuild image. GitHub-hosted runners preinstall it;aws/codebuild/standard:7.0has norustup,cargoorrustc. The workflows callrustup toolchain install …at ten sites, so a new composite action,.github/actions/ensure-rustup, runs before each of them: a no-op whenrustupis present, otherwise it downloads rustup-init 1.29.1 for x86_64 fromstatic.rust-lang.org, verifies its published sha256, installs with--default-toolchain none --profile minimal, and adds~/.cargo/bintoGITHUB_PATH. The existingrustup toolchain installlines still decide which toolchain each job uses, so hosted and CodeBuild runs build with the same toolchains.The
free-disk-spacestep in theworkspacesjob now runs only whenrunner.environment == 'github-hosted': it exists because the hosted image is short on disk, and the CodeBuild image has a 317 GB volume (126 GB free) and a different package set.Left on GitHub-hosted runners:
notify.yml(a thin shell overaws-durable-execution-ci; itsruns-onlives in the reusable workflow and is handled with the other SDKs' shells in a follow-up).Verification
pull_request, so this PR's own checks are the end-to-end test: every job should show acodebuild-github-actions-runner-<run_id>-<attempt>label, and the ensure-rustup step should report an install on CodeBuild.mainruns fit the 60-minute limit:ci.ymljobs 0–3 min,example-tests15 min,build conformance handlers13 min, conformance suites 1–3 min,Analyze Rust9 min.168a1d92): no rustup/cargo/rustc, Python 3.9–3.14 via pyenv (theactions/setup-pythonstep still provisions its own), Docker 28.5, 317 GB volume.no linked issue: CI infrastructure change.
Also in this PR: clippy on Rust 1.99
mainhas been red since Rust 1.99.0 (2026-09-28):rustup toolchain install stablenow resolves to 1.99, which deprecatesAtomicUsize::fetch_updateand adds theassert_is_emptylint, and-D warningsturns both into errors incheck (sdk)andfeature powerset(same failure onubuntu-latestin run 37515503745). The second commit fixes that so this PR's CI can go green:src/test_util.rs: the twofetch_updatecalls stay (try_updateis only stable from 1.95; MSRV is 1.94.1) under#[allow(deprecated)]with a note to switch once the MSRV moves.assert!(x.is_empty())/assert!(!x.is_empty())test assertions becomeassert_eq!/assert_ne!against an emptyVec, as the lint asks.Checked locally:
cargo fmt --check,cargo clippy --all-targets --all-features -- -D warningsandcargo test --lib(538 passed) on 1.99.0;cargo check --all-targets --all-featureson 1.94.1.