Skip to content

Commit b2f757e

Browse files
bnusunnybnusunny
authored
ci: split pipeline into PR, Merge, and Release workflows (#642)
- PR: test + build validation only (no deploys) - Merge: test, build, beta deploy, e2e tests - Release: test, build, gamma, prod, public ECR publish Additional improvements: - Replace sccache with Swatinem/rust-cache - Use prebuilt cargo-nextest binary - Trim unnecessary musl targets from test jobs - Consolidate load-matrix jobs in release workflow - Bump Python from 3.8 to 3.13 - Normalize download-artifact to @v4 - Remove unused env vars - Fix paths-ignore globs - Replace docker import with docker build
1 parent 40e78a9 commit b2f757e

3 files changed

Lines changed: 522 additions & 474 deletions

File tree

‎.github/workflows/merge.yaml‎

Lines changed: 382 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,382 @@
1+
name: Merge
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
paths-ignore:
8+
- "docs/**"
9+
- "examples/**"
10+
11+
permissions:
12+
id-token: write
13+
contents: read
14+
15+
env:
16+
CARGO_TERM_COLOR: always
17+
SAM_TEMPLATE_X86_64: template-x86_64.yaml
18+
SAM_TEMPLATE_ARM64: template-arm64.yaml
19+
GITHUB_RUNNER_ROLE: arn:aws:iam::621808641063:role/GitHubRunnerRole
20+
BETA_STACK_NAME: lambda-adapter-beta
21+
BETA_PIPELINE_EXECUTION_ROLE: arn:aws:iam::477159140107:role/aws-sam-cli-managed-beta-pip-PipelineExecutionRole-13NXRWTRTHDCJ
22+
BETA_CLOUDFORMATION_EXECUTION_ROLE: arn:aws:iam::477159140107:role/aws-sam-cli-managed-beta-CloudFormationExecutionR-132I77VBFOWQ2
23+
BETA_ARTIFACTS_BUCKET: aws-sam-cli-managed-beta-pipeline-artifactsbucket-889nlo0z1nt0
24+
BETA_IMAGE_REPOSITORY: 477159140107.dkr.ecr.ap-northeast-1.amazonaws.com/aws-sam-cli-managed-beta-pipeline-resources-imagerepository-0hbn3hxi9pcm
25+
BETA_REGION: ap-northeast-1
26+
RUST_BACKTRACE: full
27+
28+
jobs:
29+
test:
30+
runs-on: ubuntu-24.04
31+
steps:
32+
- name: Checkout sources
33+
uses: actions/checkout@v4
34+
35+
- name: Configure Rust cache
36+
uses: Swatinem/rust-cache@v2
37+
38+
- name: Install cargo-nextest
39+
run: curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ${CARGO_HOME:-~/.cargo}/bin
40+
41+
- name: linting
42+
run: |
43+
cargo fmt --all -- --check
44+
cargo clippy -- -Dwarnings
45+
46+
- name: run unit and integration tests
47+
run: cargo nextest run --profile ci
48+
49+
build:
50+
needs: [test]
51+
runs-on: ubuntu-24.04
52+
steps:
53+
- uses: actions/checkout@v4
54+
55+
- uses: actions/setup-python@v4
56+
with:
57+
python-version: "3.13"
58+
59+
- uses: aws-actions/setup-sam@v2
60+
with:
61+
use-installer: true
62+
token: ${{ secrets.GITHUB_TOKEN }}
63+
64+
- name: Install stable toolchain
65+
run: |
66+
rustup target add x86_64-unknown-linux-musl
67+
rustup target add aarch64-unknown-linux-musl
68+
69+
- name: Install cargo lambda
70+
run: pip3 install cargo-lambda
71+
72+
- name: Configure Rust cache
73+
uses: Swatinem/rust-cache@v2
74+
75+
- name: Add cargo pkg version to env vars
76+
run: |
77+
echo "CARGO_PKG_VERSION=$(cargo metadata --no-deps --format-version=1 | jq -r '.packages[0].version')" >> $GITHUB_ENV
78+
79+
- name: Build x86_64 Layer
80+
run: sam build --template ${SAM_TEMPLATE_X86_64} --parameter-overrides CargoPkgVersion=${CARGO_PKG_VERSION} -b build-x86_64
81+
82+
- name: Tar files
83+
run: tar -cvf build-x86_64.tar build-x86_64
84+
85+
- uses: actions/upload-artifact@v4
86+
with:
87+
name: aws-sam-build-x86_64
88+
path: build-x86_64.tar
89+
90+
- name: Build arm64 Layer
91+
run: sam build --template ${SAM_TEMPLATE_ARM64} --parameter-overrides CargoPkgVersion=${CARGO_PKG_VERSION} -b build-arm64
92+
93+
- name: Tar files
94+
run: tar -cvf build-arm64.tar build-arm64
95+
96+
- uses: actions/upload-artifact@v4
97+
with:
98+
name: aws-sam-build-arm64
99+
path: build-arm64.tar
100+
101+
package-beta:
102+
needs: [build]
103+
runs-on: ubuntu-24.04
104+
steps:
105+
- uses: actions/checkout@v4
106+
- uses: actions/setup-python@v4
107+
with:
108+
python-version: "3.13"
109+
- uses: aws-actions/setup-sam@v2
110+
with:
111+
use-installer: true
112+
token: ${{ secrets.GITHUB_TOKEN }}
113+
114+
- name: Assume the github runner role
115+
uses: aws-actions/configure-aws-credentials@v4
116+
with:
117+
aws-region: ${{ env.BETA_REGION }}
118+
role-to-assume: ${{ env.GITHUB_RUNNER_ROLE }}
119+
120+
- name: Assume the beta pipeline user role
121+
uses: aws-actions/configure-aws-credentials@v4
122+
with:
123+
aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
124+
aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
125+
aws-session-token: ${{ env.AWS_SESSION_TOKEN }}
126+
role-skip-session-tagging: true
127+
aws-region: ${{ env.BETA_REGION }}
128+
role-to-assume: ${{ env.BETA_PIPELINE_EXECUTION_ROLE }}
129+
130+
- uses: actions/download-artifact@v4
131+
with:
132+
name: aws-sam-build-x86_64
133+
134+
- name: extract build_x86_64
135+
run: |
136+
tar -xvf build-x86_64.tar
137+
138+
- name: Upload x86_64 layer to beta artifact buckets
139+
run: |
140+
sam package \
141+
--template build-x86_64/template.yaml \
142+
--s3-bucket ${BETA_ARTIFACTS_BUCKET} \
143+
--image-repository ${BETA_IMAGE_REPOSITORY} \
144+
--region ${BETA_REGION} \
145+
--output-template-file packaged-beta-x86_64.yaml
146+
147+
- uses: actions/upload-artifact@v4
148+
with:
149+
name: packaged-beta-x86_64.yaml
150+
path: packaged-beta-x86_64.yaml
151+
152+
- uses: actions/download-artifact@v4
153+
with:
154+
name: aws-sam-build-arm64
155+
156+
- name: extract build_arm64
157+
run: |
158+
tar -xvf build-arm64.tar
159+
160+
- name: Upload arm64 layer to beta artifact buckets
161+
run: |
162+
sam package \
163+
--template build-arm64/template.yaml \
164+
--s3-bucket ${BETA_ARTIFACTS_BUCKET} \
165+
--image-repository ${BETA_IMAGE_REPOSITORY} \
166+
--region ${BETA_REGION} \
167+
--output-template-file packaged-beta-arm64.yaml
168+
169+
- uses: actions/upload-artifact@v4
170+
with:
171+
name: packaged-beta-arm64.yaml
172+
path: packaged-beta-arm64.yaml
173+
174+
- name: Create and push the x86_64 docker image to beta ecr repo
175+
run: |
176+
aws ecr get-login-password --region ap-northeast-1 | docker login --username AWS --password-stdin 477159140107.dkr.ecr.ap-northeast-1.amazonaws.com
177+
printf 'FROM scratch\nADD build-x86_64/LambdaAdapterLayerX86/extensions/. /\n' | docker build --provenance=false --platform=linux/amd64 -t 477159140107.dkr.ecr.ap-northeast-1.amazonaws.com/awsguru/aws-lambda-adapter:latest-x86_64 -f- .
178+
docker push 477159140107.dkr.ecr.ap-northeast-1.amazonaws.com/awsguru/aws-lambda-adapter:latest-x86_64
179+
180+
- name: Create and push the arm64 docker image to beta ecr repo
181+
run: |
182+
printf 'FROM scratch\nADD build-arm64/LambdaAdapterLayerArm64/extensions/. /\n' | docker build --provenance=false --platform=linux/arm64 -t 477159140107.dkr.ecr.ap-northeast-1.amazonaws.com/awsguru/aws-lambda-adapter:latest-aarch64 -f- .
183+
docker push 477159140107.dkr.ecr.ap-northeast-1.amazonaws.com/awsguru/aws-lambda-adapter:latest-aarch64
184+
185+
- name: create and push the multi-arch manifest to beta ecr repo
186+
run: |
187+
docker manifest create 477159140107.dkr.ecr.ap-northeast-1.amazonaws.com/awsguru/aws-lambda-adapter:latest \
188+
477159140107.dkr.ecr.ap-northeast-1.amazonaws.com/awsguru/aws-lambda-adapter:latest-x86_64 \
189+
477159140107.dkr.ecr.ap-northeast-1.amazonaws.com/awsguru/aws-lambda-adapter:latest-aarch64
190+
docker manifest push 477159140107.dkr.ecr.ap-northeast-1.amazonaws.com/awsguru/aws-lambda-adapter:latest
191+
192+
deploy-beta:
193+
needs: [package-beta]
194+
runs-on: ubuntu-24.04
195+
steps:
196+
- uses: actions/checkout@v4
197+
- uses: actions/setup-python@v4
198+
with:
199+
python-version: "3.13"
200+
- uses: aws-actions/setup-sam@v2
201+
with:
202+
use-installer: true
203+
token: ${{ secrets.GITHUB_TOKEN }}
204+
205+
- name: Assume the github runner role
206+
uses: aws-actions/configure-aws-credentials@v4
207+
with:
208+
aws-region: ${{ env.BETA_REGION }}
209+
role-to-assume: ${{ env.GITHUB_RUNNER_ROLE }}
210+
211+
- name: Assume the beta pipeline user role
212+
uses: aws-actions/configure-aws-credentials@v4
213+
with:
214+
aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
215+
aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
216+
aws-session-token: ${{ env.AWS_SESSION_TOKEN }}
217+
role-skip-session-tagging: true
218+
aws-region: ${{ env.BETA_REGION }}
219+
role-to-assume: ${{ env.BETA_PIPELINE_EXECUTION_ROLE }}
220+
221+
- name: Add cargo pkg version to env vars
222+
run: |
223+
echo "CARGO_PKG_VERSION=$(cargo metadata --no-deps --format-version=1 | jq -r '.packages[0].version')" >> $GITHUB_ENV
224+
225+
- uses: actions/download-artifact@v4
226+
with:
227+
name: packaged-beta-x86_64.yaml
228+
229+
- name: Deploy x86_64 layer to beta account
230+
run: |
231+
sam deploy --stack-name ${BETA_STACK_NAME}-x86 \
232+
--template packaged-beta-x86_64.yaml \
233+
--parameter-overrides CargoPkgVersion=${CARGO_PKG_VERSION} \
234+
--capabilities CAPABILITY_IAM \
235+
--region ${BETA_REGION} \
236+
--s3-bucket ${BETA_ARTIFACTS_BUCKET} \
237+
--image-repository ${BETA_IMAGE_REPOSITORY} \
238+
--no-fail-on-empty-changeset \
239+
--role-arn ${BETA_CLOUDFORMATION_EXECUTION_ROLE}
240+
241+
- uses: actions/download-artifact@v4
242+
with:
243+
name: packaged-beta-arm64.yaml
244+
245+
- name: Deploy arm64 layer to beta account
246+
run: |
247+
sam deploy --stack-name ${BETA_STACK_NAME}-arm64 \
248+
--template packaged-beta-arm64.yaml \
249+
--parameter-overrides CargoPkgVersion=${CARGO_PKG_VERSION} \
250+
--capabilities CAPABILITY_IAM \
251+
--region ${BETA_REGION} \
252+
--s3-bucket ${BETA_ARTIFACTS_BUCKET} \
253+
--image-repository ${BETA_IMAGE_REPOSITORY} \
254+
--no-fail-on-empty-changeset \
255+
--role-arn ${BETA_CLOUDFORMATION_EXECUTION_ROLE}
256+
257+
e2e-test-zip:
258+
needs: [deploy-beta]
259+
runs-on: ubuntu-24.04
260+
steps:
261+
- uses: actions/checkout@v4
262+
263+
- name: Install stable toolchain
264+
run: |
265+
rustup target add x86_64-unknown-linux-musl
266+
267+
- name: Install cargo lambda
268+
run: pip3 install cargo-lambda
269+
270+
- name: Configure Rust cache
271+
uses: Swatinem/rust-cache@v2
272+
273+
- name: Install cargo-nextest
274+
run: curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ${CARGO_HOME:-~/.cargo}/bin
275+
276+
- uses: actions/setup-python@v4
277+
with:
278+
python-version: "3.13"
279+
280+
- uses: aws-actions/setup-sam@v2
281+
with:
282+
use-installer: true
283+
token: ${{ secrets.GITHUB_TOKEN }}
284+
285+
- name: Assume the github runner role
286+
uses: aws-actions/configure-aws-credentials@v4
287+
with:
288+
aws-region: ${{ env.BETA_REGION }}
289+
role-to-assume: ${{ env.GITHUB_RUNNER_ROLE }}
290+
291+
- name: Assume the beta pipeline user role
292+
uses: aws-actions/configure-aws-credentials@v4
293+
with:
294+
aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
295+
aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
296+
aws-session-token: ${{ env.AWS_SESSION_TOKEN }}
297+
role-skip-session-tagging: true
298+
aws-region: ${{ env.BETA_REGION }}
299+
role-to-assume: ${{ env.BETA_PIPELINE_EXECUTION_ROLE }}
300+
301+
- name: deploy the zip x86 integration test stacks for the beta environment
302+
working-directory: ./tests/e2e_tests/fixtures/go-httpbin-zip
303+
run: |
304+
sam build
305+
sam deploy --stack-name ${BETA_STACK_NAME}-zip-x86 \
306+
--capabilities CAPABILITY_IAM \
307+
--region ${BETA_REGION} \
308+
--s3-bucket ${BETA_ARTIFACTS_BUCKET} \
309+
--image-repository ${BETA_IMAGE_REPOSITORY} \
310+
--no-fail-on-empty-changeset \
311+
--role-arn ${BETA_CLOUDFORMATION_EXECUTION_ROLE}
312+
313+
- name: run e2e tests
314+
run: |
315+
API_ENDPOINT=https://httpbin-rest-zip.beta.adapter.awsguru.dev/ API_AUTH_TYPE="open" cargo nextest run --run-ignored ignored-only --profile ci
316+
API_ENDPOINT=https://httpbin-http-zip.beta.adapter.awsguru.dev/ API_AUTH_TYPE="open" cargo nextest run --run-ignored ignored-only --profile ci
317+
API_ENDPOINT=https://httpbin-alb-zip.beta.adapter.awsguru.dev/ API_AUTH_TYPE="open" cargo nextest run --run-ignored ignored-only --profile ci
318+
API_ENDPOINT=https://c26abn6izvm4xvbfs5baaflifm0hqvsn.lambda-url.ap-northeast-1.on.aws/ API_AUTH_TYPE="iam" cargo nextest run --run-ignored ignored-only --profile ci
319+
320+
e2e-test-oci:
321+
needs: [deploy-beta]
322+
runs-on: ubuntu-24.04
323+
steps:
324+
- uses: actions/checkout@v4
325+
326+
- name: Install stable toolchain
327+
run: |
328+
rustup target add x86_64-unknown-linux-musl
329+
330+
- name: Install cargo lambda
331+
run: pip3 install cargo-lambda
332+
333+
- name: Configure Rust cache
334+
uses: Swatinem/rust-cache@v2
335+
336+
- name: Install cargo-nextest
337+
run: curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ${CARGO_HOME:-~/.cargo}/bin
338+
339+
- uses: actions/setup-python@v4
340+
with:
341+
python-version: "3.13"
342+
343+
- uses: aws-actions/setup-sam@v2
344+
with:
345+
use-installer: true
346+
token: ${{ secrets.GITHUB_TOKEN }}
347+
348+
- name: Assume the github runner role
349+
uses: aws-actions/configure-aws-credentials@v4
350+
with:
351+
aws-region: ${{ env.BETA_REGION }}
352+
role-to-assume: ${{ env.GITHUB_RUNNER_ROLE }}
353+
354+
- name: Assume the beta pipeline user role
355+
uses: aws-actions/configure-aws-credentials@v4
356+
with:
357+
aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
358+
aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
359+
aws-session-token: ${{ env.AWS_SESSION_TOKEN }}
360+
role-skip-session-tagging: true
361+
aws-region: ${{ env.BETA_REGION }}
362+
role-to-assume: ${{ env.BETA_PIPELINE_EXECUTION_ROLE }}
363+
364+
- name: deploy the oci x86 integration test stacks for the beta environment
365+
working-directory: ./tests/e2e_tests/fixtures/go-httpbin
366+
run: |
367+
aws ecr get-login-password --region ap-northeast-1 | docker login --username AWS --password-stdin 477159140107.dkr.ecr.ap-northeast-1.amazonaws.com
368+
sam build
369+
sam deploy --stack-name ${BETA_STACK_NAME}-oci-x86 \
370+
--capabilities CAPABILITY_IAM \
371+
--region ${BETA_REGION} \
372+
--s3-bucket ${BETA_ARTIFACTS_BUCKET} \
373+
--image-repository ${BETA_IMAGE_REPOSITORY} \
374+
--no-fail-on-empty-changeset \
375+
--role-arn ${BETA_CLOUDFORMATION_EXECUTION_ROLE}
376+
377+
- name: run e2e tests
378+
run: |
379+
API_ENDPOINT=https://httpbin-rest-oci.beta.adapter.awsguru.dev/ API_AUTH_TYPE="open" cargo nextest run --run-ignored ignored-only --profile ci
380+
API_ENDPOINT=https://httpbin-http-oci.beta.adapter.awsguru.dev/ API_AUTH_TYPE="open" cargo nextest run --run-ignored ignored-only --profile ci
381+
API_ENDPOINT=https://httpbin-alb-oci.beta.adapter.awsguru.dev/ API_AUTH_TYPE="open" cargo nextest run --run-ignored ignored-only --profile ci
382+
API_ENDPOINT=https://3w6rb56t3lzefztvndn4zg3xru0taszm.lambda-url.ap-northeast-1.on.aws/ API_AUTH_TYPE="iam" cargo nextest run --run-ignored ignored-only --profile ci

0 commit comments

Comments
 (0)