chore(deps): bump the aws-cdk group across 1 directory with 3 updates #3164
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: E2E Tests | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| aws_region: | |
| description: 'AWS region for deployment' | |
| default: 'us-east-1' | |
| cdk_branch: | |
| description: 'CDK repo branch to build from (default: main)' | |
| default: 'main' | |
| pull_request_target: | |
| branches: [main, feat/**] | |
| # Skip E2E on changes that can't affect agent behavior (e.g. docs-only PRs). | |
| # Only run when CLI source, e2e/browser tests, packaging, or the e2e | |
| # workflows themselves change. | |
| paths: | |
| - 'src/**' | |
| - 'e2e-tests/**' | |
| - 'browser-tests/**' | |
| - 'package.json' | |
| - 'package-lock.json' | |
| - 'npm-shrinkwrap.json' | |
| - 'vitest.config.*' | |
| # Build inputs that produce the `agentcore` binary E2E installs globally: | |
| # TS compiler config, the esbuild bundler config, and scripts/** (which | |
| # includes bundle/copy-assets/generate-schema and the check-old-cli.mjs | |
| # postinstall hook — a bug there breaks `npm install -g` in the E2E job). | |
| - 'tsconfig*.json' | |
| - 'esbuild.config.*' | |
| - 'scripts/**' | |
| - '.github/workflows/e2e*' | |
| concurrency: | |
| group: e2e-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| authorize: | |
| runs-on: codebuild-agentcore-e2e-${{ github.run_id }}-${{ github.run_attempt }} | |
| if: github.event_name == 'workflow_dispatch' || github.event_name == 'pull_request_target' | |
| permissions: | |
| id-token: write | |
| contents: read | |
| outputs: | |
| is_authorized: ${{ steps.check.outputs.is_authorized }} | |
| steps: | |
| # Manual workflow_dispatch is always authorized and never consults the | |
| # allowlist, so only fetch AUTHORIZED_USERS / run the gate for PR events. | |
| - name: Fetch secrets from Secrets Manager | |
| if: github.event_name == 'pull_request_target' | |
| uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@31aa3b031a86664e29861d68956e44b07cf21a74 | |
| with: | |
| role-arn: ${{ secrets.WORKFLOW_SECRETS_READER_ROLE_ARN }} | |
| repo: AUTHORIZED_USERS | |
| - name: Check authorization | |
| id: authz | |
| if: github.event_name == 'pull_request_target' | |
| uses: aws/agentcore-devx-devtools/.github/actions/check-authorized-user@31aa3b031a86664e29861d68956e44b07cf21a74 | |
| with: | |
| subject: ${{ github.event.pull_request.user.login }} | |
| authorized-users: ${{ env.AUTHORIZED_USERS }} | |
| - name: Determine authorization | |
| id: check | |
| env: | |
| EVENT_NAME: ${{ github.event_name }} | |
| IS_AUTHORIZED: ${{ steps.authz.outputs.is-authorized }} | |
| # Gate on the PR AUTHOR (whose code this is), NOT github.actor (who triggered the run). | |
| # On pull_request_target a trusted actor (e.g. a maintainer pushing to a fork PR) triggering | |
| # a run must NOT cause an untrusted author's fork code to execute with our AWS role/secrets. | |
| PR_AUTHOR: ${{ github.event.pull_request.user.login }} | |
| run: | | |
| if [[ "$EVENT_NAME" == "workflow_dispatch" ]]; then | |
| echo "✅ Manual workflow dispatch — authorized" | |
| echo "is_authorized=true" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| if [[ "$IS_AUTHORIZED" == "true" ]]; then | |
| echo "✅ PR author ${PR_AUTHOR} is authorized" | |
| echo "is_authorized=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "⏭️ PR author ${PR_AUTHOR} is not in AUTHORIZED_USERS — skipping E2E tests." | |
| echo "ℹ️ External contributors: a maintainer can run the E2E tests via workflow_dispatch after reviewing the code." | |
| echo "is_authorized=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| e2e: | |
| needs: authorize | |
| if: needs.authorize.outputs.is_authorized == 'true' | |
| permissions: | |
| id-token: write # OIDC - lets this job assume the E2E AWS role. | |
| contents: read | |
| # Run on our AWS CodeBuild-hosted runner instead of a GitHub-hosted runner. | |
| # GitHub-hosted runner IPs rotate through shared pools whose reputation trips | |
| # the service WAF (403s before the request reaches service code); dedicated | |
| # CodeBuild compute inside AWS avoids that and cuts runner-pickup latency. | |
| # Label format: codebuild-<project>-${{ github.run_id }}-${{ github.run_attempt }} | |
| # backed by the `agentcore-e2e` project in the CI account (us-east-1). | |
| runs-on: codebuild-agentcore-e2e-${{ github.run_id }}-${{ github.run_attempt }} | |
| environment: e2e-testing | |
| timeout-minutes: 30 | |
| env: | |
| AGENTCORE_TELEMETRY_DISABLED: '1' | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| fetch-depth: 0 | |
| # Safe because the `authorize` job above gates on the PR AUTHOR being in AUTHORIZED_USERS: | |
| # external authors skip at the gate, so only trusted authors' code is ever checked out here. | |
| # Needed because authorized maintainers routinely open PRs from their own forks, and | |
| # checkout@v7 otherwise refuses fork-PR checkout in pull_request_target. | |
| allow-unsafe-pr-checkout: true | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: '20.x' | |
| cache: 'npm' | |
| - name: Configure git | |
| run: | | |
| git config --global user.email "ci@amazon.com" | |
| git config --global user.name "CI" | |
| - uses: astral-sh/setup-uv@v7 | |
| - name: Fetch secrets from Secrets Manager | |
| uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@31aa3b031a86664e29861d68956e44b07cf21a74 | |
| with: | |
| role-arn: ${{ secrets.WORKFLOW_SECRETS_READER_ROLE_ARN }} | |
| shared: CDK_REPO_NAME | |
| repo: | |
| E2E_AWS_ROLE_ARN, E2E_ANTHROPIC_API_KEY, E2E_OPENAI_API_KEY, E2E_GEMINI_API_KEY, E2E_EFS_ACCESS_POINT_ARN, | |
| E2E_S3_ACCESS_POINT_ARN, E2E_FILESYSTEM_SUBNET_ID, E2E_FILESYSTEM_SECURITY_GROUP_ID, E2E_CDP_API_KEY_ID, | |
| E2E_CDP_API_KEY_SECRET, E2E_CDP_WALLET_SECRET | |
| - name: Configure AWS credentials | |
| uses: aws-actions/configure-aws-credentials@v6 | |
| with: | |
| role-to-assume: ${{ env.E2E_AWS_ROLE_ARN }} | |
| aws-region: ${{ inputs.aws_region || 'us-east-1' }} | |
| unset-current-credentials: true | |
| - name: Get AWS Account ID | |
| id: aws | |
| run: echo "account_id=$(aws sts get-caller-identity --query Account --output text)" >> "$GITHUB_OUTPUT" | |
| - name: Resolve private CDK repository | |
| id: cdk-repo | |
| env: | |
| CDK_REPO: ${{ env.CDK_REPO_NAME }} | |
| run: | | |
| owner="${CDK_REPO%%/*}" | |
| repository="${CDK_REPO#*/}" | |
| if [[ -z "$owner" || -z "$repository" || "$repository" == */* || "$owner/$repository" != "$CDK_REPO" ]]; then | |
| echo "::error::CDK_REPO_NAME must use the owner/repository format" | |
| exit 1 | |
| fi | |
| echo "owner=$owner" >> "$GITHUB_OUTPUT" | |
| echo "repository=$repository" >> "$GITHUB_OUTPUT" | |
| - name: Generate repository-scoped GitHub App token | |
| id: app-token | |
| uses: actions/create-github-app-token@v3 | |
| with: | |
| app-id: ${{ vars.APP_ID }} | |
| private-key: ${{ secrets.APP_PRIVATE_KEY }} | |
| owner: ${{ steps.cdk-repo.outputs.owner }} | |
| repositories: ${{ steps.cdk-repo.outputs.repository }} | |
| permission-contents: read | |
| skip-token-revoke: true | |
| # Clone CDK repo for bundle script (requires App token for private repo access) | |
| - name: Clone CDK repo | |
| run: | | |
| CDK_BRANCH="${INPUT_CDK_BRANCH:-main}" | |
| echo "Cloning CDK from branch: $CDK_BRANCH" | |
| git clone --depth 1 --branch "$CDK_BRANCH" "https://x-access-token:${CDK_REPO_TOKEN}@github.com/${CDK_REPO}.git" /tmp/cdk-repo | |
| git -C /tmp/cdk-repo remote remove origin | |
| env: | |
| INPUT_CDK_BRANCH: ${{ inputs.cdk_branch }} | |
| CDK_REPO_TOKEN: ${{ steps.app-token.outputs.token }} | |
| CDK_REPO: ${{ env.CDK_REPO_NAME }} | |
| - name: Revoke GitHub App token | |
| if: always() && steps.app-token.outputs.token != '' | |
| env: | |
| CDK_REPO_TOKEN: ${{ steps.app-token.outputs.token }} | |
| GITHUB_API_URL: ${{ github.api_url }} | |
| run: | | |
| curl --fail-with-body --silent --show-error \ | |
| --request DELETE \ | |
| --header "Accept: application/vnd.github+json" \ | |
| --header "Authorization: Bearer ${CDK_REPO_TOKEN}" \ | |
| --header "X-GitHub-Api-Version: 2022-11-28" \ | |
| "${GITHUB_API_URL}/installation/token" | |
| - run: npm ci | |
| - name: Bundle tarball | |
| run: | | |
| npm run bundle | |
| TARBALL=$(ls aws-agentcore-*.tgz | head -1) | |
| echo "TARBALL=$PWD/$TARBALL" >> "$GITHUB_ENV" | |
| env: | |
| AGENTCORE_CDK_PATH: /tmp/cdk-repo | |
| - name: Install CLI globally | |
| run: npm install -g "$TARBALL" | |
| - name: Detect changed e2e test files | |
| id: changed | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha || 'HEAD~1' }} | |
| run: | | |
| # If any helper file changed, run all e2e tests | |
| HELPERS_CHANGED=$(git diff --name-only "$BASE_SHA"..HEAD -- 'e2e-tests/*.ts' \ | |
| | grep -v '\.test\.ts$' | head -1) | |
| if [ -n "$HELPERS_CHANGED" ]; then | |
| GA_EXTRA=$(find e2e-tests -name '*.test.ts' \ | |
| | grep -v '^e2e-tests/strands-bedrock\.test\.ts$' \ | |
| | grep -v '^e2e-tests/payment-strands-bedrock\.test\.ts$' \ | |
| | grep -v '^e2e-tests/harness-' \ | |
| | tr '\n' ' ') | |
| HARNESS_EXTRA=$(find e2e-tests -name 'harness-*.test.ts' \ | |
| | grep -v '^e2e-tests/harness-bedrock\.test\.ts$' \ | |
| | tr '\n' ' ') | |
| else | |
| GA_EXTRA=$(git diff --name-only "$BASE_SHA"..HEAD -- 'e2e-tests/*.test.ts' \ | |
| | grep -v '^e2e-tests/strands-bedrock\.test\.ts$' \ | |
| | grep -v '^e2e-tests/payment-strands-bedrock\.test\.ts$' \ | |
| | grep -v '^e2e-tests/harness-' \ | |
| | tr '\n' ' ') | |
| HARNESS_EXTRA=$(git diff --name-only "$BASE_SHA"..HEAD -- 'e2e-tests/harness-*.test.ts' \ | |
| | grep -v '^e2e-tests/harness-bedrock\.test\.ts$' \ | |
| | tr '\n' ' ') | |
| fi | |
| echo "ga_extra=$GA_EXTRA" >> "$GITHUB_OUTPUT" | |
| echo "harness_extra=$HARNESS_EXTRA" >> "$GITHUB_OUTPUT" | |
| echo "GA extra tests: ${GA_EXTRA:-none}" | |
| echo "Harness extra tests: ${HARNESS_EXTRA:-none}" | |
| - name: Run E2E tests (GA) | |
| env: | |
| AWS_ACCOUNT_ID: ${{ steps.aws.outputs.account_id }} | |
| AWS_REGION: ${{ inputs.aws_region || 'us-east-1' }} | |
| ANTHROPIC_API_KEY: ${{ env.E2E_ANTHROPIC_API_KEY }} | |
| OPENAI_API_KEY: ${{ env.E2E_OPENAI_API_KEY }} | |
| GEMINI_API_KEY: ${{ env.E2E_GEMINI_API_KEY }} | |
| E2E_EFS_ACCESS_POINT_ARN: ${{ env.E2E_EFS_ACCESS_POINT_ARN }} | |
| E2E_S3_ACCESS_POINT_ARN: ${{ env.E2E_S3_ACCESS_POINT_ARN }} | |
| E2E_FILESYSTEM_SUBNET_ID: ${{ env.E2E_FILESYSTEM_SUBNET_ID }} | |
| E2E_FILESYSTEM_SECURITY_GROUP_ID: ${{ env.E2E_FILESYSTEM_SECURITY_GROUP_ID }} | |
| # CoinbaseCDP testnet creds for payment-strands-bedrock.test.ts. Sourced from | |
| # the same E2E secret (keys CDP_API_KEY_ID / CDP_API_KEY_SECRET / CDP_WALLET_SECRET), | |
| # which parse-json-secrets surfaces as E2E_CDP_*; remapped here to the unprefixed | |
| # names the test reads. Absent on forks -> test self-skips via its hasCdpCreds gate. | |
| CDP_API_KEY_ID: ${{ env.E2E_CDP_API_KEY_ID }} | |
| CDP_API_KEY_SECRET: ${{ env.E2E_CDP_API_KEY_SECRET }} | |
| CDP_WALLET_SECRET: ${{ env.E2E_CDP_WALLET_SECRET }} | |
| GA_EXTRA: ${{ steps.changed.outputs.ga_extra }} | |
| # GA_EXTRA is a space-separated test-file list; left unquoted intentionally so it word-splits into vitest args. | |
| # --reporter=verbose keeps the sanitized console log; the custom JUnit reporter adds a | |
| # machine-readable report without copying console streams into the public artifact. | |
| run: | |
| npx vitest run --project e2e --reporter=verbose --reporter=./scripts/safe-junit-reporter.ts | |
| --outputFile.junit=test-results/e2e-ga.junit.xml e2e-tests/strands-bedrock.test.ts | |
| e2e-tests/payment-strands-bedrock.test.ts $GA_EXTRA | |
| - name: Run E2E tests (harness) | |
| env: | |
| AWS_ACCOUNT_ID: ${{ steps.aws.outputs.account_id }} | |
| AWS_REGION: ${{ inputs.aws_region || 'us-east-1' }} | |
| ANTHROPIC_API_KEY: ${{ env.E2E_ANTHROPIC_API_KEY }} | |
| OPENAI_API_KEY: ${{ env.E2E_OPENAI_API_KEY }} | |
| GEMINI_API_KEY: ${{ env.E2E_GEMINI_API_KEY }} | |
| E2E_EFS_ACCESS_POINT_ARN: ${{ env.E2E_EFS_ACCESS_POINT_ARN }} | |
| E2E_S3_ACCESS_POINT_ARN: ${{ env.E2E_S3_ACCESS_POINT_ARN }} | |
| E2E_FILESYSTEM_SUBNET_ID: ${{ env.E2E_FILESYSTEM_SUBNET_ID }} | |
| E2E_FILESYSTEM_SECURITY_GROUP_ID: ${{ env.E2E_FILESYSTEM_SECURITY_GROUP_ID }} | |
| HARNESS_EXTRA: ${{ steps.changed.outputs.harness_extra }} | |
| # HARNESS_EXTRA is a space-separated test-file list; left unquoted intentionally so it word-splits into vitest args. | |
| # Separate --outputFile from the GA step so the two vitest runs don't clobber each other's report. | |
| run: | |
| npx vitest run --project e2e --reporter=verbose --reporter=./scripts/safe-junit-reporter.ts | |
| --outputFile.junit=test-results/e2e-harness.junit.xml e2e-tests/harness-bedrock.test.ts $HARNESS_EXTRA | |
| - name: Sanitize E2E test reports | |
| id: sanitize-reports | |
| if: always() | |
| run: npm run test-artifacts:sanitize -- test-results/ | |
| - name: Verify E2E test reports contain no secrets | |
| id: scan-reports | |
| if: always() | |
| run: npm run test-artifacts:check -- test-results/ | |
| - name: Upload E2E test report | |
| if: always() && steps.sanitize-reports.outcome == 'success' && steps.scan-reports.outcome == 'success' | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: e2e-test-report | |
| path: test-results/ | |
| if-no-files-found: warn | |
| retention-days: 14 |