chore(deps-dev): bump constructs from 10.6.0 to 10.7.2 #2575
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: PR Tarball | |
| on: | |
| pull_request_target: | |
| branches: [main, feat/**] | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| authorize: | |
| runs-on: codebuild-agentcore-e2e-${{ github.run_id }}-${{ github.run_attempt }} | |
| permissions: | |
| id-token: write | |
| contents: read | |
| outputs: | |
| is_authorized: ${{ steps.check.outputs.is_authorized }} | |
| steps: | |
| - name: Fetch secrets from Secrets Manager | |
| uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@31aa3b031a86664e29861d68956e44b07cf21a74 | |
| with: | |
| role-arn: ${{ secrets.WORKFLOW_SECRETS_READER_ROLE_ARN }} | |
| repo: AUTHORIZED_USERS | |
| - name: Check authorization | |
| id: authz | |
| uses: aws/agentcore-devx-devtools/.github/actions/check-authorized-user@31aa3b031a86664e29861d68956e44b07cf21a74 | |
| with: | |
| subject: ${{ github.event.pull_request.user.login }} | |
| authorized-users: ${{ env.AUTHORIZED_USERS }} | |
| - name: Determine authorization | |
| id: check | |
| env: | |
| IS_AUTHORIZED: ${{ steps.authz.outputs.is-authorized }} | |
| # Gate on the PR AUTHOR (whose code this npm build runs), NOT github.actor (who triggered the | |
| # run). Otherwise a trusted actor pushing to a fork PR would run untrusted fork npm scripts | |
| # with the contents:write GITHUB_TOKEN + App token in this job. | |
| PR_AUTHOR: ${{ github.event.pull_request.user.login }} | |
| run: | | |
| if [[ "$IS_AUTHORIZED" == "true" ]]; then | |
| echo "✅ PR author ${PR_AUTHOR} is authorized" | |
| echo "is_authorized=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "⏭️ PR author ${PR_AUTHOR} is not in AUTHORIZED_USERS — skipping." | |
| echo "is_authorized=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| pr-tarball: | |
| needs: authorize | |
| if: needs.authorize.outputs.is_authorized == 'true' | |
| runs-on: codebuild-agentcore-e2e-${{ github.run_id }}-${{ github.run_attempt }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| # Safe because the `authorize` job above gates on the PR AUTHOR being in AUTHORIZED_USERS: | |
| # external authors skip at the gate, so only trusted authors' code is ever checked out here. | |
| # Needed because authorized maintainers routinely open PRs from their own forks, and | |
| # checkout@v7 otherwise refuses fork-PR checkout in pull_request_target. | |
| allow-unsafe-pr-checkout: true | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: '20.x' | |
| cache: 'npm' | |
| - name: Configure git | |
| run: | | |
| git config --global user.email "bedrock-agentcore-npm+ci@amazon.com" | |
| git config --global user.name "CI" | |
| - uses: astral-sh/setup-uv@v7 | |
| - run: npm ci | |
| - run: npm run build --if-present | |
| - run: npm pack | |
| - name: Get tarball info | |
| id: tarball | |
| run: | | |
| TARBALL_NAME=$(ls *.tgz | head -1 | xargs basename) | |
| echo "name=$TARBALL_NAME" >> $GITHUB_OUTPUT | |
| - name: Generate GitHub App Token | |
| id: app-token | |
| uses: actions/create-github-app-token@v3 | |
| with: | |
| app-id: ${{ vars.APP_ID }} | |
| private-key: ${{ secrets.APP_PRIVATE_KEY }} | |
| - name: Create or update PR release | |
| id: release | |
| env: | |
| GH_TOKEN: ${{ steps.app-token.outputs.token }} | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| TARBALL_NAME: ${{ steps.tarball.outputs.name }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| REPOSITORY: ${{ github.repository }} | |
| run: | | |
| TAG="pr-${PR_NUMBER}-tarball" | |
| # Delete existing release if it exists (to update the tarball) | |
| gh release delete "$TAG" --yes --cleanup-tag 2>/dev/null || true | |
| # Create a new pre-release with the tarball | |
| gh release create "$TAG" \ | |
| "${TARBALL_NAME}" \ | |
| --title "PR #${PR_NUMBER} Tarball" \ | |
| --notes "Auto-generated tarball for PR #${PR_NUMBER}." \ | |
| --draft \ | |
| --target "$HEAD_SHA" | |
| DOWNLOAD_URL="https://github.com/${REPOSITORY}/releases/download/${TAG}/${TARBALL_NAME}" | |
| echo "url=$DOWNLOAD_URL" >> $GITHUB_OUTPUT | |
| - name: Comment on PR | |
| uses: marocchino/sticky-pull-request-comment@v3 | |
| with: | |
| header: tarball | |
| message: | | |
| ## Package Tarball | |
| **[${{ steps.tarball.outputs.name }}](${{ steps.release.outputs.url }})** | |
| ### How to install | |
| ```bash | |
| gh release download pr-${{ github.event.pull_request.number }}-tarball --repo ${{ github.repository }} --pattern "*.tgz" --dir /tmp/pr-tarball | |
| npm install -g /tmp/pr-tarball/${{ steps.tarball.outputs.name }} | |
| ``` |