chore(aws): migrate to autohive-integrations-sdk 2.0.0 by Shubhank-Jonnada · Pull Request #360 · Autohive-AI/autohive-integrations

Shubhank-Jonnada · 2026-06-10T06:12:35Z

Summary

Bump autohive-integrations-sdk to ~=2.0.0 in requirements.txt
Fix auth: flat context.auth.get() instead of nested credentials dict
Update helpers.py: error_result() now returns ActionError dataclass; success_result() drops result:True and adds cost_usd=0.0
Bump config.json version to 2.0.0; remove result/error/error_code fields from all 20 output schemas
Replace legacy tests/context.py + tests/test_aws.py with conftest.py + test_aws_unit.py + test_aws_integration.py

Test plan

25 unit tests, all 20 actions covered: pytest aws/tests/test_aws_unit.py
validate_integration.py autohive-integrations/aws - 0 errors, 0 warnings
check_code.py autohive-integrations/aws - all checks passed
Live integration tests require AWS credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY)

- Bump SDK to ~=2.0.0 in requirements.txt - Bump config.json version to 2.0.0 - Fix auth: flat context.auth.get() instead of nested credentials dict - Update helpers.py: error_result() now returns ActionError (not ActionResult) - Remove result/error/error_code fields from all 20 output schemas - Replace context.py + test_aws.py with conftest.py + unit + integration tests - All 20 actions covered by unit tests (25 tests, 25 passing) - Add AWS env vars to root .env.example

github-actions · 2026-06-10T06:13:24Z

🔍 Integration Validation Results

Commit: 479b6ab9bd8bd9dad6dc1c7b8fb14886986fb510 · fix(.env.example): rebuild from current master + own section only
Updated: 2026-06-17T19:13:50Z

Changed directories: aws

Check	Result
Structure	✅ Passed
Code	✅ Passed
Tests	✅ Passed
README	✅ Passed
Version	✅ Passed

✅ Structure Check output

Validating 1 integration(s)...

============================================================
Integration: aws
============================================================
✅ All checks passed!

============================================================
SUMMARY
============================================================
Integrations validated: 1
Total errors: 0
Total warnings: 0

✅ All validations passed!

✅ Code Check output

----------------------------------------
Checking: aws
----------------------------------------

📦 Installing dependencies...

🐍 Checking Python syntax...
   ✅ Syntax OK

📥 Checking imports...
   ✅ Imports OK

📄 Checking JSON files...
   ✅ JSON files OK

🔍 Linting with ruff...
   ✅ Lint OK

🎨 Checking formatting with ruff...
   ✅ Formatting OK

🔒 Scanning for security issues with bandit...
   ✅ Security OK

🛡️ Checking dependencies for vulnerabilities with pip-audit...
   ✅ Dependencies OK

🔗 Checking config-code sync...
   ✅ Config-code sync OK

🔄 Checking fetch patterns...
   ✅ Fetch patterns OK

========================================
✅ CODE CHECK PASSED
========================================

✅ Tests Check output


Integration   Tests  Coverage        Status
-------------------------------------------
aws     25/25       79%      ✅ Passed
-------------------------------------------
Total   25/25            ✅ All passed

✅ Tests passed: aws

✅ README Check output

========================================
✅ README CHECK PASSED
========================================

✅ Version Check output

✅ aws: 1.0.0 → 2.0.0 (major bump)

========================================
✅ VERSION CHECK PASSED
========================================

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f85b63da69

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Shubhank-Jonnada · 2026-06-10T06:59:29Z

All unit tests performed and passing. Live integration tests not yet run — AWS credentials required.

TheRealAgentK

Requesting changes for the AWS integration test blockers.

TheRealAgentK · 2026-06-10T09:56:50Z

Before approval or merge, we need a real integration test run with valid credentials, using the SDK 2 request path. The live tests must fail on ACTION_ERROR or VALIDATION_ERROR instead of accepting them as passing outcomes.

TheRealAgentK

Added a coverage follow-up.

In production SDK 2 contexts, custom auth fields land under context.auth['credentials']. Fall back to the flat context.auth dict so existing unit-test mocks that pass auth keys at the top level continue to work.

- Add pytest.mark.integration to pytestmark - Replace ResultType.SUCCESS (doesn't exist in SDK 2) with ResultType.ACTION - Assert result.type == ResultType.ACTION on all live-path tests - Add tests for all 13 previously missing actions: Security Hub: get_finding_details, get_insights, update_finding_workflow GuardDuty: list_guardduty_findings, get_guardduty_finding_details, archive_findings CloudWatch: get_metric_data, get_alarm_history, set_alarm_state CloudWatch Logs: filter_log_events, get_log_events CloudTrail: get_trail_status, get_event_selectors - Gate service-specific tests on env vars or chain from list actions - Mark destructive tests (update_finding_workflow, archive_findings, set_alarm_state) - Add AWS_ALARM_NAME and AWS_FINDING_ARN to .env.example

…r STS credentials

Shubhank-Jonnada · 2026-06-11T07:57:21Z

@TheRealAgentK

Live tests:

TheRealAgentK

Thanks for the AWS follow-up work — this is much closer now. The integration test suite has been expanded to cover all 20 actions, destructive tests are marked, and the live-path assertions now fail on non-action results.

I left a few small comments before I’d call this fully clean: one CloudTrail live-test assertion checks the wrong output key, AWS_SESSION_TOKEN should be documented if tests support it, and session tokens should ideally come from context.auth rather than ambient process env.

TheRealAgentK · 2026-06-11T09:44:06Z

+    secret_key = creds.get("aws_secret_access_key")
    if not access_key or not secret_key:
        raise ValueError("AWS credentials are missing: aws_access_key_id and aws_secret_access_key are required")
+    session_token = creds.get("aws_session_token") or os.environ.get("AWS_SESSION_TOKEN")


Could we avoid falling back to the process environment here? Pulling AWS_SESSION_TOKEN from ambient env can mix a user’s configured access key/secret with an unrelated runtime token. It would be cleaner and safer to make aws_session_token an optional auth field in config.json and only pass it to boto3 when it comes from context.auth.

Fixed in 38b8f48 - removed the os.environ.get("AWS_SESSION_TOKEN") fallback. Session token now comes exclusively from context.auth.get("aws_session_token"), and the import os was removed from helpers.py since it's no longer needed.

…is_logging)

…viron fallback

TheRealAgentK · 2026-06-12T11:12:47Z

Follow-up from re-review: aws/helpers.py now reads aws_session_token from context.auth, and .env.example documents AWS_SESSION_TOKEN for live tests, but aws/config.json does not expose aws_session_token as an optional custom-auth field. If temporary AWS credentials are intended to be supported in production, please add aws_session_token to the custom auth schema as an optional password/text field. Otherwise the integration tests can inject it, but connected users cannot configure it through the integration auth UI.

Exposes aws_session_token as an optional password field in the auth UI so users can configure temporary STS credentials without needing to inject them via environment variables.

…merge conflicts

…etical position

…rmalize dash style

Shubhank-Jonnada · 2026-06-19T08:51:27Z

live test results:
Tested again; all read-only actions passed. Some actions require additional subscriptions to test so skipped them

chatgpt-codex-connector Bot reviewed Jun 10, 2026

View reviewed changes

Comment thread aws/helpers.py Outdated

TheRealAgentK requested changes Jun 10, 2026

View reviewed changes

Comment thread aws/tests/test_aws_integration.py Outdated

Comment thread aws/tests/test_aws_integration.py Outdated

Comment thread aws/tests/test_aws_integration.py Outdated

TheRealAgentK reviewed Jun 10, 2026

View reviewed changes

Comment thread aws/tests/test_aws_integration.py Outdated

Shubhank-Jonnada added 3 commits June 11, 2026 12:04

fix(aws): read credentials from context.auth['credentials'] wrapper

701c068

In production SDK 2 contexts, custom auth fields land under context.auth['credentials']. Fall back to the flat context.auth dict so existing unit-test mocks that pass auth keys at the top level continue to work.

fix(aws): pass session_token to boto3, fix import and live_context fo…

d43f57a

…r STS credentials

Shubhank-Jonnada requested a review from TheRealAgentK June 11, 2026 07:58

TheRealAgentK reviewed Jun 11, 2026

View reviewed changes

Shubhank-Jonnada added 4 commits June 12, 2026 10:20

fix(aws): assert trail_status key in get_trail_status live test (not …

41ea8a3

…is_logging)

fix(aws): read aws_session_token only from context.auth; remove os.en…

38b8f48

…viron fallback

fix(aws): document AWS_SESSION_TOKEN in .env.example

282dc39

chore(aws): merge master

870f8bf

Shubhank-Jonnada requested a review from TheRealAgentK June 12, 2026 05:14

Merge branch 'master' into sj/aws-migration-2.0.0

3156b55

Shubhank-Jonnada and others added 7 commits June 16, 2026 08:51

Merge branch 'master' into sj/aws-migration-2.0.0

3727bee

feat(aws): add optional aws_session_token to custom auth schema

01b77ce

Exposes aws_session_token as an optional password field in the auth UI so users can configure temporary STS credentials without needing to inject them via environment variables.

fix(.env.example): sort integration sections alphabetically to avoid …

375239f

…merge conflicts

fix(.env.example): only add own integration section in correct alphab…

a230d06

…etical position

fix(.env.example): rebuild from current master + own section only, no…

5728e5f

…rmalize dash style

Merge remote-tracking branch 'origin/master' into sj/aws-migration-2.0.0

08196f5

fix(.env.example): rebuild from current master + own section only

479b6ab

TheRealAgentK approved these changes Jun 19, 2026

View reviewed changes

TheRealAgentK merged commit 99b7c24 into master Jun 19, 2026
3 checks passed

TheRealAgentK deleted the sj/aws-migration-2.0.0 branch June 19, 2026 09:19

Uh oh!

Conversation

Shubhank-Jonnada commented Jun 10, 2026

Summary

Test plan

Uh oh!

github-actions Bot commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Integration Validation Results

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Shubhank-Jonnada commented Jun 10, 2026

Uh oh!

TheRealAgentK left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

TheRealAgentK commented Jun 10, 2026

Uh oh!

TheRealAgentK left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Shubhank-Jonnada commented Jun 11, 2026

Live tests:

Uh oh!

TheRealAgentK left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

TheRealAgentK Jun 11, 2026

Choose a reason for hiding this comment

Uh oh!

Shubhank-Jonnada Jun 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

TheRealAgentK commented Jun 12, 2026

Uh oh!

Shubhank-Jonnada commented Jun 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented Jun 10, 2026 •

edited

Loading

Shubhank-Jonnada Jun 12, 2026 •

edited

Loading