chore: sync from internal (rie-private-to-public) (aws#181)

* Update from upstream - 2026-03-18

* Update from upstream - 2026-03-18

* Update from upstream - 2026-03-18

* Update from upstream - 2026-03-19

* Update from upstream - 2026-03-19

* Potential fix for code scanning alert no. 7: Workflow does not contain permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* Update from upstream - 2026-03-27

* Update from upstream - 2026-03-30

* Update from upstream - 2026-04-01

* Update from upstream - 2026-07-13

---------

Co-authored-by: lambda-tooling+rie <lambda-tooling+rie@amazon.com>
Co-authored-by: tobixlea <tobixlea@amazon.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Roger Zhang <ruojiazh@amazon.com>

Author: 5 people

.github/workflows/validate-branch-into-main.yaml

@@ -10,8 +10,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check source branch
+        env:
+          SOURCE_BRANCH: ${{ github.head_ref }}
         run: |
-          SOURCE_BRANCH="${{ github.head_ref }}"
           if [[ "$SOURCE_BRANCH" != "develop" ]]; then
             echo "Error: Only pull requests from develop branch are allowed into main"
             echo "Current source branch ($SOURCE_BRANCH)."

internal/lambda-managed-instances/aws-lambda-rie/internal/app_test.go

@@ -79,7 +79,7 @@ func TestApp_ServeHTTP(t *testing.T) {
 			defer mockApp.AssertExpectations(t)
 			mockApp.On("Init", mock.Anything, mock.Anything, mock.Anything).Return(tt.initResponse)
 			if tt.initResponse == nil {
-				mockApp.On("Invoke", mock.Anything, mock.Anything, mock.Anything).Return(tt.invokeErr, tt.responseSent)
+				mockApp.On("Invoke", mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return(tt.invokeErr, tt.responseSent, false)
 			}
 
 			initMsg := intmodel.InitRequestMessage{

internal/lambda-managed-instances/aws-lambda-rie/internal/run.go

@@ -75,7 +75,7 @@ func Run(supv supvmodel.ProcessSupervisor, args []string, fileUtil utils.FileUti
 	}
 
 	rieApp := NewHTTPHandler(raptorApp, initMsg)
-	s, err := raptor.StartServer(raptorApp, rieApp, &raptor.TCPAddress{AddrPort: rieAddr})
+	s, err := raptor.StartServer(raptorApp, rieApp, &raptor.TCPAddress{AddrPort: rieAddr}, false)
 	if err != nil {
 		return nil, nil, nil, fmt.Errorf("could not start RIE server: %w", err)
 	}

internal/lambda-managed-instances/aws-lambda-rie/internal/telemetry/README.md

@@ -253,6 +253,7 @@ type EEStaticData struct {
 	XRayTracingMode    intmodel.XrayTracingMode
 	ArtefactType       intmodel.ArtefactType
 	RuntimeVersion     string
+	RuntimeRelease     string
 	AmiId              string
 	AvailabilityZoneId string
 }

internal/lambda-managed-instances/aws-lambda-rie/main.go

@@ -27,6 +27,10 @@ const (
 	ShutdownWaitAllProcessesDuration          = "WaitCustomerProcessesExitDuration"
 	ShutdownRuntimeServerDuration             = "StopRuntimeServerDuration"
 
+	RuntimeNextCountMetric = "RuntimeNextCount"
+
+	RuntimeWorkerCountMetric = "RuntimeWorkerCount"
+
 	ClientErrorMetric           = "ClientError"
 	ClientErrorReasonTemplate   = "ClientErrorReason-%s"
 	CustomerErrorMetric         = "CustomerError"

internal/lambda-managed-instances/interop/sandbox_model.go

@@ -195,6 +195,12 @@ func (ir *InvokeRouter) GetRuntimePoolCounts() RuntimePoolCounts {
 func (ir *InvokeRouter) ReserveIdleRuntime(ctx context.Context, invokeID interop.InvokeID, timeout time.Duration) (interop.ReserveIdleRuntimeResponse, model.AppError) {
 	logging.Debug(ctx, "InvokeRouter: reserving idle runtime")
 
+	if _, exists := ir.runningInvokes.Get(invokeID); exists {
+		logging.Warn(ctx, "InvokeRouter: reservation collides with in-flight invoke")
+		return interop.ReserveIdleRuntimeFailureResponse{ErrorType: model.ErrorDuplicatedInvokeId},
+			model.NewClientError(ErrInvokeIdAlreadyExists, model.ErrorSeverityError, model.ErrorDuplicatedInvokeId)
+	}
+
 	err := ir.runtimePool.Reserve(invokeID, timeout, func() {
 		if ir.runtimePool.ExpireReservation(invokeID) {
 			logging.Info(ctx, "InvokeRouter: reservation expired")

internal/lambda-managed-instances/interop/service_log_values.go

@@ -399,6 +399,29 @@ func TestReserveIdleRuntime_DuplicateInvokeID(t *testing.T) {
 	assert.Equal(t, model.ErrorDuplicatedInvokeId, appErr.ErrorType())
 }
 
+func TestReserveIdleRuntime_DuplicateAgainstRunningInvoke(t *testing.T) {
+	t.Parallel()
+
+	mocks, router := createMocksAndInitRouter()
+
+	_, err := router.RuntimeNext(mocks.ctx, mocks.runtimeNextRequest)
+	require.NoError(t, err)
+
+	const inFlightID = "reserve-vs-running"
+	router.runningInvokes.Set(inFlightID, &mocks.runnningInvoke)
+
+	resp, appErr := router.ReserveIdleRuntime(mocks.ctx, inFlightID, 100*time.Millisecond)
+
+	require.NotNil(t, appErr)
+	failResp, ok := resp.(interop.ReserveIdleRuntimeFailureResponse)
+	assert.True(t, ok, "expected ReserveIdleRuntimeFailureResponse")
+	assert.Equal(t, model.ErrorDuplicatedInvokeId, failResp.ErrorType)
+	assert.Equal(t, model.ErrorDuplicatedInvokeId, appErr.ErrorType())
+
+	assert.Equal(t, 0, router.runtimePool.ReservedCount(), "no reservation should have been recorded")
+	assert.Equal(t, 1, router.GetRuntimePoolCounts().Idle, "idle runtime should still be available")
+}
+
 func TestReserveIdleRuntime_Expiration(t *testing.T) {
 	t.Parallel()
 

internal/lambda-managed-instances/invoke/invoke_router.go

@@ -13,11 +13,13 @@ import (
 )
 
 const (
-	ReserveSuccessMetric = "ReserveSuccess"
-	ReserveFailedMetric  = "ReserveFailed"
+	ReserveSuccessMetric       = "ReserveSuccess"
+	ReserveFailedMetric        = "ReserveFailed"
+	ReserveParseDurationMetric = "ReserveParseDuration"
+	ReserveLogicDurationMetric = "ReserveLogicDuration"
 )
 
-func ReserveServiceLog(logger servicelogs.Logger, opStart time.Time, invokeID string, appErr model.AppError) {
+func ReserveServiceLog(logger servicelogs.Logger, opStart time.Time, invokeID string, appErr model.AppError, parseDuration, reserveDuration time.Duration) {
 	props := []servicelogs.Property{
 		{Name: "invoke_id", Value: invokeID},
 	}
@@ -43,6 +45,11 @@ func ReserveServiceLog(logger servicelogs.Logger, opStart time.Time, invokeID st
 		servicelogs.Counter(ReserveFailedMetric, failed),
 		servicelogs.Counter(interop.ClientErrorMetric, clientErrCnt),
 		servicelogs.Counter(interop.NonCustomerErrorMetric, nonCustomerErrCnt),
+		servicelogs.Timer(ReserveParseDurationMetric, parseDuration),
+	}
+
+	if reserveDuration > 0 {
+		metrics = append(metrics, servicelogs.Timer(ReserveLogicDurationMetric, reserveDuration))
 	}
 
 	if appErr != nil {