DO NOT MERGE: Flex Checksums #9848
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. | |
| # SPDX-License-Identifier: Apache-2.0 | |
| # This workflow runs CI and the PR Bot on pull requests that are not from forked repositories. | |
| name: CI | |
| on: | |
| pull_request: | |
| # Allow one instance of this workflow per pull request, and cancel older runs when new changes are pushed | |
| concurrency: | |
| group: ci-yaml-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| ecr_repository: public.ecr.aws/w0m4q9l7/github-awslabs-smithy-rs-ci | |
| jobs: | |
| # This job will, if possible, save a docker login password to the job outputs. The token will | |
| # be encrypted with the passphrase stored as a GitHub secret. The login password expires after 12h. | |
| # The login password is encrypted with the repo secret DOCKER_LOGIN_TOKEN_PASSPHRASE | |
| save-docker-login-token: | |
| name: Save a docker login token | |
| timeout-minutes: 10 | |
| if: ${{ github.event.pull_request.head.repo.full_name == 'smithy-lang/smithy-rs' }} | |
| outputs: | |
| docker-login-password: ${{ steps.set-token.outputs.docker-login-password }} | |
| permissions: | |
| id-token: write | |
| contents: read | |
| continue-on-error: true | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Attempt to load a docker login password | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| role-to-assume: ${{ secrets.SMITHY_RS_PUBLIC_ECR_PUSH_ROLE_ARN }} | |
| role-session-name: GitHubActions | |
| aws-region: us-west-2 | |
| - name: Save the docker login password to the output | |
| id: set-token | |
| run: | | |
| ENCRYPTED_PAYLOAD=$( | |
| gpg --symmetric --batch --passphrase "${{ secrets.DOCKER_LOGIN_TOKEN_PASSPHRASE }}" --output - <(aws ecr-public get-login-password --region us-east-1) | base64 -w0 | |
| ) | |
| echo "docker-login-password=$ENCRYPTED_PAYLOAD" >> $GITHUB_OUTPUT | |
| # This job detects if the PR made changes to build tools. If it did, then it builds a new | |
| # build Docker image. Otherwise, it downloads a build image from Public ECR. In both cases, | |
| # it uploads the image as a build artifact for other jobs to download and use. | |
| acquire-base-image: | |
| name: Acquire Base Image | |
| timeout-minutes: 60 | |
| needs: save-docker-login-token | |
| if: ${{ github.event.pull_request.head.repo.full_name == 'smithy-lang/smithy-rs' }} | |
| runs-on: smithy_ubuntu-latest_8-core | |
| env: | |
| ENCRYPTED_DOCKER_PASSWORD: ${{ needs.save-docker-login-token.outputs.docker-login-password }} | |
| DOCKER_LOGIN_TOKEN_PASSPHRASE: ${{ secrets.DOCKER_LOGIN_TOKEN_PASSPHRASE }} | |
| permissions: | |
| id-token: write | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| path: smithy-rs | |
| - name: Acquire base image | |
| id: acquire | |
| env: | |
| DOCKER_BUILDKIT: 1 | |
| run: ./smithy-rs/.github/scripts/acquire-build-image | |
| - name: Acquire credentials | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| role-to-assume: ${{ secrets.SMITHY_RS_PUBLIC_ECR_PUSH_ROLE_ARN }} | |
| role-session-name: GitHubActions | |
| aws-region: us-west-2 | |
| - name: Upload image | |
| run: | | |
| IMAGE_TAG="$(./smithy-rs/.github/scripts/docker-image-hash)" | |
| docker tag "smithy-rs-base-image:${IMAGE_TAG}" "${{ env.ecr_repository }}:${IMAGE_TAG}" | |
| aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws | |
| docker push "${{ env.ecr_repository }}:${IMAGE_TAG}" | |
| # Run shared CI after the Docker build image has either been rebuilt or found in ECR | |
| ci: | |
| needs: | |
| - save-docker-login-token | |
| - acquire-base-image | |
| if: ${{ github.event.pull_request.head.repo.full_name == 'smithy-lang/smithy-rs' }} | |
| uses: ./.github/workflows/ci.yml | |
| with: | |
| run_sdk_examples: true | |
| secrets: | |
| ENCRYPTED_DOCKER_PASSWORD: ${{ needs.save-docker-login-token.outputs.docker-login-password }} | |
| DOCKER_LOGIN_TOKEN_PASSPHRASE: ${{ secrets.DOCKER_LOGIN_TOKEN_PASSPHRASE }} | |
| CANARY_GITHUB_ACTIONS_ROLE_ARN: ${{ secrets.CANARY_GITHUB_ACTIONS_ROLE_ARN }} | |
| CANARY_STACK_CDK_OUTPUTS_BUCKET_NAME: ${{ secrets.CANARY_STACK_CDK_OUTPUTS_BUCKET_NAME }} | |
| # The PR bot requires a Docker build image, so make it depend on the `acquire-base-image` job. | |
| pr_bot: | |
| name: PR Bot | |
| if: ${{ github.event.pull_request.head.repo.full_name == 'smithy-lang/smithy-rs' }} | |
| needs: acquire-base-image | |
| uses: ./.github/workflows/pull-request-bot.yml | |
| with: | |
| issue_number: ${{ github.event.number }} | |
| base_revision: ${{ github.event.pull_request.base.sha }} | |
| head_revision: ${{ github.event.pull_request.head.sha }} | |
| secrets: | |
| SMITHY_RS_PULL_REQUEST_CDN_S3_BUCKET_NAME: ${{ secrets.SMITHY_RS_PULL_REQUEST_CDN_S3_BUCKET_NAME }} | |
| SMITHY_RS_PULL_REQUEST_CDN_ROLE_ARN: ${{ secrets.SMITHY_RS_PULL_REQUEST_CDN_ROLE_ARN }} | |
| semver-checks: | |
| name: Check PR semver compliance | |
| runs-on: smithy_ubuntu-latest_8-core | |
| timeout-minutes: 20 | |
| needs: | |
| - save-docker-login-token | |
| - acquire-base-image | |
| # We need `always` here otherwise this job won't run if the previous job has been skipped | |
| # See https://samanpavel.medium.com/github-actions-conditional-job-execution-e6aa363d2867 | |
| if: | | |
| always() && | |
| !contains(needs.*.result, 'failure') && | |
| !contains(needs.*.result, 'cancelled') | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| path: smithy-rs | |
| ref: ${{ inputs.git_ref }} | |
| - name: Get PR info | |
| id: check-breaking-label | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| const response = await github.rest.pulls.get({ | |
| pull_number: context.issue.number, | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| }); | |
| const labels = response.data.labels.map(l => l.name); | |
| const isBreaking = labels.includes("breaking-change"); | |
| const data = { | |
| labels, | |
| isBreaking | |
| }; | |
| console.log("data:", data); | |
| return data; | |
| - name: Run semver check | |
| uses: ./smithy-rs/.github/actions/docker-build | |
| with: | |
| action: check-semver | |
| action-arguments: ${{ github.event.pull_request.base.sha }} ${{ fromJSON(steps.check-breaking-label.outputs.result).isBreaking }} | |
| - name: Print help message | |
| if: failure() | |
| run: echo "::error::This pull request either contains breaking changes, or has cross-crate changes that may be backwards compatible, but that cargo-semver-checks cannot verify. Please scrutinize the change for backwards compatibility." |