diff --git a/.github/workflows/telemetry-conformance-tests.yml b/.github/workflows/telemetry-conformance-tests.yml new file mode 100644 index 000000000..b2ace1c80 --- /dev/null +++ b/.github/workflows/telemetry-conformance-tests.yml @@ -0,0 +1,62 @@ +name: Telemetry Conformance Tests + +# SDK handlers and builds live here. The shared workflow deploys and validates them. + +on: + pull_request: + branches: [main] + paths: + - "packages/aws-durable-execution-sdk-python/**" + - "packages/aws-durable-execution-sdk-python-telemetry-exporter/**" + - "packages/aws-durable-execution-sdk-python-conformance-tests-telemetry/**" + - ".github/workflows/telemetry-conformance-tests.yml" + push: + branches: [main] + paths: + - "packages/aws-durable-execution-sdk-python/**" + - "packages/aws-durable-execution-sdk-python-telemetry-exporter/**" + - "packages/aws-durable-execution-sdk-python-conformance-tests-telemetry/**" + - ".github/workflows/telemetry-conformance-tests.yml" + workflow_dispatch: + inputs: + aws_region: + description: AWS region + required: true + default: us-west-2 + type: string + conformance_test_ref: + description: Optional conformance test commit SHA or branch name. Empty uses the shared workflow commit. + required: false + type: string + default: "" + +permissions: {} + +jobs: + telemetry: + # 1. Run for non-PR events, such as pushes and manual invocations. + # 2. For PRs, run only same-repo branches from non-Dependabot actors. Forked PRs and Dependabot cannot read secrets. + if: github.event_name != 'pull_request' || (github.actor != 'dependabot[bot]' && github.event.pull_request.head.repo.full_name == github.repository) + permissions: + contents: read + id-token: write + # The pinned SHA also selects the runner and telemetry-extension revision the shared + # workflow installs, so it must be reachable from a branch. It is the merge commit of + # aws-durable-execution-conformance-tests PR #150 on that repository's main branch. That + # commit exports PYTHON_SDK_REF and installs pip for the SAM makefile build. + uses: aws/aws-durable-execution-conformance-tests/.github/workflows/telemetry-suite.yml@d4b7df927ea7eb7022bcca339d2cddd387d3d650 + with: + language: python + resource_prefix: python + sdk_repository: aws/aws-durable-execution-sdk-python + sdk_ref: ${{ github.event.pull_request.head.sha || github.sha }} + # Path relative to the conformance workspace, where this repo is checked out at .build/durable-sdk. + examples_dir: .build/durable-sdk/packages/aws-durable-execution-sdk-python-conformance-tests-telemetry + conformance_test_ref: ${{ inputs.conformance_test_ref }} + aws_region: ${{ inputs.aws_region || 'us-west-2' }} + runs_on: codebuild-github-actions-runner-${{ github.run_id }}-${{ github.run_attempt }} + timeout_minutes: 30 + secrets: + CONFORMANCE_TEST_ROLE_ARN: ${{ secrets.TEST_ROLE_ARN }} + CONFORMANCE_TEST_ACCOUNT_ID: ${{ secrets.TEST_ACCOUNT_ID }} + CONFORMANCE_TEST_LAMBDA_EXECUTION_ROLE_ARN: ${{ secrets.TEST_LAMBDA_EXECUTION_ROLE_ARN }} diff --git a/packages/aws-durable-execution-sdk-python-conformance-tests-telemetry/README.md b/packages/aws-durable-execution-sdk-python-conformance-tests-telemetry/README.md index c7c66ab11..10df8164e 100644 --- a/packages/aws-durable-execution-sdk-python-conformance-tests-telemetry/README.md +++ b/packages/aws-durable-execution-sdk-python-conformance-tests-telemetry/README.md @@ -77,4 +77,18 @@ durable-execution-conformance \ --parameter-overrides LambdaExecutionRoleArn= ``` -A caller GitHub workflow is a follow-on. +## CI + +[`.github/workflows/telemetry-conformance-tests.yml:5–63`](../../.github/workflows/telemetry-conformance-tests.yml#L5-L63) +runs on pull requests and pushes to `main` that touch the SDK, telemetry +exporter, this package, or the workflow file. It also supports manual dispatch. + +It calls the conformance repository's reusable telemetry workflow at a pinned +SHA. `sdk_ref` selects the PR head commit, and `examples_dir` points to this +package. CI builds the handlers with `sam build`, which installs the SDK and +exporter from git at that commit. It then deploys the template and validates +the `telemetry` suite. Reports and execution histories are uploaded as +artifacts. + +CI assumes AWS credentials through OIDC using the repository's existing test +secrets. Fork and Dependabot pull requests skip the cloud job.