Merge branch 'main' into dependabot/npm_and_yarn/examples/datadog/expressjs/lambda-asset/src/multi-c6f6658ed3

Author: seshubaws

.gitallowed

@@ -1 +1 @@
-* @awslabs/aws-lambda-adapter-maintainers
+* @aws/aws-lambda-tooling

.github/CODEOWNERS

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+#
+# Verify that an example's HTTP endpoint serves the expected response.
+#
+# Unlike a plain liveness check (any 2xx-4xx == "OK"), this asserts that a
+# specific route returns an exact status code and, optionally, that the body
+# contains a known substring. This catches broken routing and apps that boot
+# but serve the wrong (or empty) content.
+#
+# Usage:
+#   verify-http.sh <base_url> <path> <expect_status> [expect_body]
+#
+#   base_url      e.g. http://127.0.0.1:3000
+#   path          request path, e.g. / or /healthz
+#   expect_status comma-separated acceptable status codes, e.g. "200" or "200,307"
+#   expect_body   optional substring that must appear in the response body
+#
+# Waits up to 90s (wall-clock) for the endpoint to satisfy BOTH conditions
+# (the app may still be warming up), then exits 0 on success or 1 with
+# diagnostics. Uses a wall-clock deadline plus a short per-request timeout
+# (curl -m 5) so a hanging endpoint can't multiply the wait window.
+
+set -uo pipefail
+
+BASE_URL="${1:?base_url required}"
+REQ_PATH="${2:-/}"
+EXPECT_STATUS="${3:-200}"
+EXPECT_BODY="${4:-}"
+
+URL="${BASE_URL%/}${REQ_PATH}"
+IFS=',' read -ra ACCEPT <<< "$EXPECT_STATUS"
+
+status_ok() {
+  local s="$1"
+  for code in "${ACCEPT[@]}"; do
+    [ "$s" = "$code" ] && return 0
+  done
+  return 1
+}
+
+echo "Verifying ${URL} (expect status ${EXPECT_STATUS}${EXPECT_BODY:+, body contains \"${EXPECT_BODY}\"})"
+
+last_status=""
+last_body=""
+START=$SECONDS
+DEADLINE=$((START + 90))
+while [ $SECONDS -lt $DEADLINE ]; do
+  resp="$(curl -s -m 5 -w $'\n%{http_code}' "$URL" 2>/dev/null || true)"
+  last_status="${resp##*$'\n'}"
+  last_body="${resp%$'\n'*}"
+  if status_ok "$last_status"; then
+    if [ -z "$EXPECT_BODY" ] || grep -qF -- "$EXPECT_BODY" <<< "$last_body"; then
+      echo "OK after $((SECONDS - START))s: status ${last_status}${EXPECT_BODY:+, body contains \"${EXPECT_BODY}\"}"
+      exit 0
+    fi
+  fi
+  sleep 1
+done
+
+echo "FAIL: expectation not met within 90s (elapsed $((SECONDS - START))s)"
+echo "  last status: ${last_status:-<none>} (expected ${EXPECT_STATUS})"
+[ -n "$EXPECT_BODY" ] && echo "  expected body substring: ${EXPECT_BODY}"
+echo "--- last response body (first 30 lines) ---"
+printf '%s\n' "$last_body" | head -30
+exit 1

.github/scripts/verify-http.sh

@@ -0,0 +1,108 @@
+name: Commit Lint Comment
+
+# Privileged follow-up to commitlint.yaml. Triggered by completion of the
+# unprivileged Commit Lint workflow; downloads the lint output artifact and
+# posts it as a PR comment. This split is the recommended pattern for safely
+# performing privileged operations in response to fork PRs:
+# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
+#
+# Security: this workflow does not check out PR code. The PR number is
+# resolved from the trusted workflow_run event payload (not the artifact),
+# and the commitlint text output is rendered inside a dynamically sized
+# code fence so embedded backticks cannot escape it.
+on:
+  workflow_run:
+    workflows: ["Commit Lint"]
+    types:
+      - completed
+
+permissions:
+  contents: read
+  pull-requests: write
+  actions: read
+
+jobs:
+  comment:
+    name: Comment on PR
+    if: >
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'failure'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download lint artifact
+        id: download
+        uses: actions/download-artifact@v4
+        with:
+          name: commitlint-failure
+          path: lint-artifact
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+        continue-on-error: true
+
+      - name: Skip if no artifact
+        if: steps.download.outcome != 'success'
+        run: |
+          echo "No commitlint-failure artifact uploaded by the Commit Lint run; nothing to comment."
+
+      - name: Resolve PR number from workflow_run
+        if: steps.download.outcome == 'success'
+        id: pr
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
+          REPO: ${{ github.repository }}
+        shell: bash
+        run: |
+          # Derive PR number from trusted GitHub event data, not the artifact.
+          # The artifact is produced by an unprivileged pull_request workflow
+          # whose workflow file PR authors control on fork PRs, so any value
+          # they write into the artifact could be used to spoof comments onto
+          # a different PR. head_sha on the workflow_run event is GitHub-set
+          # and trustworthy.
+          pr=$(gh api "repos/$REPO/commits/$HEAD_SHA/pulls" \
+                 --jq '.[] | select(.state=="open") | .number' | head -n1)
+          if ! [[ "$pr" =~ ^[0-9]+$ ]]; then
+            echo "No open PR found for head SHA $HEAD_SHA; nothing to comment."
+            exit 0
+          fi
+          echo "pr_number=$pr" >> "$GITHUB_OUTPUT"
+
+      - name: Post comment
+        if: steps.download.outcome == 'success' && steps.pr.outputs.pr_number != ''
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ steps.pr.outputs.pr_number }}
+          REPO: ${{ github.repository }}
+        shell: bash
+        run: |
+          # The artifact contents are untrusted PR-author-controlled commit
+          # text. Pick a code-fence length that is at least one backtick
+          # longer than the longest backtick run in the file, so the author
+          # cannot escape the fence by embedding ``` in a commit message.
+          max_ticks=$(grep -oE '`+' lint-artifact/commitlint-output.txt 2>/dev/null \
+                        | awk '{ if (length > m) m = length } END { print m+0 }')
+          fence_len=$((max_ticks + 1))
+          [ "$fence_len" -lt 3 ] && fence_len=3
+          fence=$(printf '`%.0s' $(seq 1 "$fence_len"))
+          {
+            echo "## Commit message lint failed"
+            echo ""
+            echo "One or more commit messages don't follow the [Conventional Commits](https://www.conventionalcommits.org) format required by this project."
+            echo ""
+            echo "<details><summary>commitlint output</summary>"
+            echo ""
+            echo "$fence"
+            cat lint-artifact/commitlint-output.txt
+            echo "$fence"
+            echo ""
+            echo "</details>"
+            echo ""
+            echo "**Required format:** \`<type>: <description>\` (max 120 chars for the header)"
+            echo ""
+            echo "**Allowed types:** \`feat\`, \`fix\`, \`docs\`, \`example\`, \`examples\`, \`chore\`, \`refactor\`, \`perf\`, \`test\`, \`ci\`, \`revert\`"
+            echo ""
+            echo "To fix the most recent commit: \`git commit --amend\`"
+            echo ""
+            echo "To reword older commits: \`git rebase -i origin/main\`"
+          } > comment.md
+          gh pr comment "$PR_NUMBER" --repo "$REPO" --body-file comment.md

.github/workflows/commitlint-comment.yaml

@@ -17,21 +17,32 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
           node-version: 20
 
       - name: Install commitlint
-        run: npm install --save-dev @commitlint/{cli,config-conventional}
+        run: npm install --ignore-scripts --save-dev @commitlint/{cli,config-conventional}
 
       - name: Lint commits
         id: lint
+        shell: bash
         run: |
+          set -o pipefail
           npx commitlint --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose 2>&1 | tee commitlint-output.txt
         continue-on-error: true
 
+      - name: Upload lint output
+        if: steps.lint.outcome == 'failure'
+        uses: actions/upload-artifact@v4
+        with:
+          name: commitlint-failure
+          path: commitlint-output.txt
+          retention-days: 1
+
       - name: Show help on failure
         if: steps.lint.outcome == 'failure'
         run: |