Skip to content

Commit bd0e7fa

Browse files
HweinstockHweinstock
authored
ci: port refactor canary to main (#2519)
* ci: port refactor E2E reusable workflow to main * ci: add canary(refactor) scheduled workflow * ci: emit metrics for canary(refactor) * ci: test rc artifact with latest refactor E2E tests
1 parent be072a3 commit bd0e7fa

3 files changed

Lines changed: 222 additions & 0 deletions

File tree

‎.github/workflows/canary-refactor.yml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
name: canary(refactor)
2+
on:
3+
schedule:
4+
- cron: '*/20 * * * *'
5+
workflow_dispatch:
6+
7+
concurrency:
8+
group: canary-refactor
9+
cancel-in-progress: false
10+
11+
permissions:
12+
id-token: write
13+
contents: read
14+
15+
jobs:
16+
# Resolve the commit hash for the latest published @rc version.
17+
resolve_release:
18+
runs-on: ubuntu-latest
19+
outputs:
20+
ref: ${{ steps.resolve.outputs.ref }}
21+
steps:
22+
- uses: actions/setup-node@v4
23+
with:
24+
node-version: '24'
25+
- name: Resolve latest RC release commit
26+
id: resolve
27+
run: |
28+
version="$(npm view @aws/agentcore@rc version)"
29+
tag_ref="refs/tags/v${version}"
30+
# Resolve annotated tags to their commit hash when needed.
31+
ref="$(git ls-remote https://github.com/aws/agentcore-cli.git "${tag_ref}" "${tag_ref}^{}" | awk -v tag_ref="${tag_ref}" '
32+
$2 == tag_ref "^{}" { print $1; found = 1; exit }
33+
$2 == tag_ref { tag_sha = $1 }
34+
END { if (!found && tag_sha != "") print tag_sha }
35+
')"
36+
if [[ -z "${ref}" ]]; then
37+
echo "::error::No upstream tag found for @aws/agentcore@rc version ${version}"
38+
exit 1
39+
fi
40+
echo "ref=${ref}" >> "$GITHUB_OUTPUT"
41+
42+
e2e:
43+
needs: resolve_release
44+
uses: ./.github/workflows/refactor-e2e.yml
45+
with:
46+
artifactRef: ${{ needs.resolve_release.outputs.ref }}
47+
testRef: refactor
48+
tags: canary
49+
linuxOnly: true
50+
secrets:
51+
WORKFLOW_SECRETS_READER_ROLE_ARN: ${{ secrets.WORKFLOW_SECRETS_READER_ROLE_ARN }}

‎.github/workflows/refactor-e2e.yml‎

Lines changed: 153 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
name: e2e-test(refactor)
2+
on:
3+
workflow_call:
4+
inputs:
5+
artifactRef:
6+
description: git reference (commit, branch, or tag) to build the CLI from
7+
required: false
8+
type: string
9+
default: ''
10+
testRef:
11+
description: git reference (commit, branch, or tag) to run E2E tests from, defaults to artifactRef
12+
required: false
13+
type: string
14+
default: ''
15+
tags:
16+
description: Vitest tag expression, for example runtime || canary
17+
required: false
18+
type: string
19+
default: ''
20+
linuxOnly:
21+
description: Run E2E tests only on Linux
22+
required: false
23+
type: boolean
24+
default: false
25+
secrets:
26+
WORKFLOW_SECRETS_READER_ROLE_ARN:
27+
required: true
28+
workflow_dispatch:
29+
inputs:
30+
artifactRef:
31+
description: git reference (commit, branch, or tag) to build the CLI from
32+
type: string
33+
default: refactor
34+
testRef:
35+
description: git reference (commit, branch, or tag) to run E2E tests from, defaults to artifactRef
36+
type: string
37+
default: ''
38+
tags:
39+
description: Vitest tag expression, for example runtime || canary
40+
type: string
41+
default: ''
42+
linuxOnly:
43+
description: Run E2E tests only on Linux
44+
type: boolean
45+
default: false
46+
47+
concurrency:
48+
group:
49+
e2e-test-${{ inputs.artifactRef || 'refactor' }}-${{ inputs.testRef || inputs.artifactRef || 'refactor' }}-${{
50+
inputs.tags || 'all' }}-${{ inputs.linuxOnly && 'linux-only' || 'all-os' }}
51+
cancel-in-progress: false
52+
53+
env:
54+
AGENTCORE_TELEMETRY_DISABLED: '1'
55+
56+
jobs:
57+
authorize:
58+
runs-on: ubuntu-latest
59+
permissions:
60+
id-token: write
61+
contents: read
62+
outputs:
63+
is-authorized: ${{ github.workflow == 'canary(refactor)' || steps.check.outputs.is_authorized == 'true' }}
64+
steps:
65+
- name: Fetch secrets from Secrets Manager
66+
uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@75989f65f7f193deaf83c237c36572d1a8f800b2
67+
with:
68+
role-arn: ${{ secrets.WORKFLOW_SECRETS_READER_ROLE_ARN }}
69+
repo: AUTHORIZED_USERS
70+
- name: Check authorization
71+
id: authz
72+
uses: aws/agentcore-devx-devtools/.github/actions/check-authorized-user@31aa3b031a86664e29861d68956e44b07cf21a74
73+
with:
74+
subject: ${{ github.actor }}
75+
authorized-users: ${{ env.AUTHORIZED_USERS }}
76+
- name: Determine authorization
77+
id: check
78+
env:
79+
IS_AUTHORIZED: ${{ steps.authz.outputs.is-authorized }}
80+
ACTOR: ${{ github.actor }}
81+
run: |
82+
if [[ "$IS_AUTHORIZED" == "true" ]]; then
83+
echo "Actor ${ACTOR} is authorized"
84+
echo "is_authorized=true" >> "$GITHUB_OUTPUT"
85+
else
86+
echo "Actor ${ACTOR} is not in AUTHORIZED_USERS, skipping"
87+
echo "is_authorized=false" >> "$GITHUB_OUTPUT"
88+
fi
89+
90+
e2e:
91+
name: test (${{ matrix.name }})
92+
needs: authorize
93+
if: needs.authorize.outputs.is-authorized == 'true'
94+
runs-on: >-
95+
${{ fromJSON(
96+
matrix.name == 'Linux' &&
97+
format('["codebuild-agentcore-e2e-{0}-{1}","e2e-linux"]', github.run_id, github.run_attempt)
98+
|| matrix.name == 'Windows' &&
99+
format('["codebuild-agentcore-e2e-{0}-{1}","image:windows-1.0","e2e-windows"]', github.run_id,
100+
github.run_attempt)
101+
|| matrix.name == 'macOS' && '["macos-latest"]'
102+
) }}
103+
permissions:
104+
id-token: write
105+
contents: read
106+
strategy:
107+
fail-fast: false
108+
matrix:
109+
name: ${{ fromJSON(inputs.linuxOnly && '["Linux"]' || '["Linux","Windows","macOS"]') }}
110+
steps:
111+
- uses: actions/checkout@v7
112+
with:
113+
ref: ${{ inputs.testRef || inputs.artifactRef || 'refactor' }}
114+
persist-credentials: false
115+
- uses: actions/checkout@v7
116+
with:
117+
ref: ${{ inputs.artifactRef || 'refactor' }}
118+
path: artifact
119+
persist-credentials: false
120+
- uses: oven-sh/setup-bun@v2
121+
- uses: actions/setup-node@v4
122+
with:
123+
node-version: '24'
124+
- uses: astral-sh/setup-uv@v6
125+
- run: bun install --frozen-lockfile
126+
- run: bun install --frozen-lockfile
127+
working-directory: artifact
128+
- name: Fetch E2E role from Secrets Manager
129+
uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@75989f65f7f193deaf83c237c36572d1a8f800b2
130+
with:
131+
role-arn: ${{ secrets.WORKFLOW_SECRETS_READER_ROLE_ARN }}
132+
repo: E2E_AWS_ROLE_ARN
133+
- name: Configure AWS credentials
134+
uses: aws-actions/configure-aws-credentials@v6
135+
with:
136+
role-to-assume: ${{ env.E2E_AWS_ROLE_ARN }}
137+
aws-region: ${{ vars.E2E_REGION || 'us-east-1' }}
138+
unset-current-credentials: true
139+
- name: Build CLI
140+
working-directory: artifact
141+
run: bun run build
142+
- name: Run all E2E tests
143+
if: inputs.tags == ''
144+
env:
145+
AGENTCORE_CLI_PATH: node ${{ github.workspace }}/artifact/dist/index.js
146+
AWS_REGION: ${{ vars.E2E_REGION || 'us-east-1' }}
147+
run: bun run test:e2e
148+
- name: Run tagged E2E tests
149+
if: inputs.tags != ''
150+
env:
151+
AGENTCORE_CLI_PATH: node ${{ github.workspace }}/artifact/dist/index.js
152+
AWS_REGION: ${{ vars.E2E_REGION || 'us-east-1' }}
153+
run: bun run test:e2e -- --tagsFilter="${{ inputs.tags }}"

‎.github/workflows/workflow-metrics.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
name: Workflow Metrics
2+
on:
3+
workflow_run:
4+
workflows: ['canary(refactor)']
5+
types: [completed]
6+
7+
permissions:
8+
id-token: write
9+
10+
jobs:
11+
metrics:
12+
uses: aws/agentcore-devx-devtools/.github/workflows/workflow-metrics.yml@d145deb62f1adc8be63fa4879a488499e1128a46
13+
with:
14+
namespace: AgentCoreCLI/Workflows
15+
os: Linux
16+
role-secret-name: E2E_AWS_ROLE_ARN
17+
secrets:
18+
WORKFLOW_SECRETS_READER_ROLE_ARN: ${{ secrets.WORKFLOW_SECRETS_READER_ROLE_ARN }}

0 commit comments

Comments
 (0)