feat: Add region build release workflow for Java Lambda layer#1355
feat: Add region build release workflow for Java Lambda layer#1355wangzlei merged 3 commits intoaws-observability:mainfrom
Conversation
viw-test1
force-pushed
the
region-build-release
branch
2 times, most recently
from
875fac1 to
80ad1f5
Compare
viw-test1
force-pushed
the
region-build-release
branch
from
50e26b4 to
e96cb52
Compare
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1355 +/- ##
=============================================
- Coverage 85.71% 69.39% -16.33%
- Complexity 19 704 +685
=============================================
Files 3 63 +60
Lines 49 3437 +3388
Branches 5 487 +482
=============================================
+ Hits 42 2385 +2343
- Misses 3 861 +858
- Partials 4 191 +187 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| SIGNED=$(aws signer describe-signing-job --job-id "$JOB_ID" --query 'signedObject.s3.key' --output text 2>/dev/null) | ||
| echo "SIGNED value: '$SIGNED'" | ||
| if [ -n "$SIGNED" ]; then | ||
| aws s3 mv "s3://${{ env.BUCKET_NAME }}/$SIGNED" "s3://${{ env.BUCKET_NAME }}/${{ env.LAYER_ARTIFACT_NAME }} --clobber" |
There was a problem hiding this comment.
Bug (High): --clobber is inside the quoted S3 path, making it part of the key name instead of a CLI flag.
The closing double-quote is misplaced. --clobber becomes part of the S3 destination key (e.g. s3://bucket/aws-opentelemetry-java-layer.zip --clobber). The signed layer is NOT placed at the expected key, so the subsequent "Publish Layer Version" step publishes the unsigned layer.
Fix: move the closing quote before --clobber:
aws s3 mv "s3://$BUCKET/$SIGNED" "s3://$BUCKET/$ARTIFACT" --clobber
Note: The same bug exists in release-build.yml at line 325.
| name: layer.zip | ||
|
|
||
| - name: Upload to S3 and Sign | ||
| continue-on-error: true |
There was a problem hiding this comment.
Security concern (Medium): continue-on-error: true silently masks signing failures, allowing unsigned layers to be published.
Because of continue-on-error: true, if the signing step fails entirely (not just individual sub-steps that already exit 0), the workflow continues to "Publish Layer Version" and publishes an unsigned layer without any warning. Combined with the --clobber quoting bug on line 138, even a successful signing run will publish an unsigned layer.
Consider removing continue-on-error: true or at minimum setting an output/env variable to indicate whether signing succeeded, so downstream steps can make an informed decision.
| LEGACY_COMMERCIAL_REGIONS_ARRAY=(${LEGACY_COMMERCIAL_REGIONS//,/ }) | ||
| FOUND=false | ||
| for REGION in "${LEGACY_COMMERCIAL_REGIONS_ARRAY[@]}"; do | ||
| if [[ "$REGION" == "${{ matrix.aws_region }}" ]]; then |
There was a problem hiding this comment.
Security (Low): Direct use of ${{ matrix.aws_region }} in run: scripts risks script injection.
matrix.aws_region is derived from user-supplied workflow_dispatch input. Direct interpolation into shell scripts via ${{ }} can allow script injection if a malicious value is provided. While workflow_dispatch is restricted to users with write access, best practice is to pass the value through an environment variable instead:
env:
REGION: ${{ matrix.aws_region }}
run: |
if [[ "$REGION" == ... ]]; thenThis pattern also applies to lines 86, 89-90, 103, 159-161, and 186-187.
| # Legacy list of commercial regions to deploy to. New regions should NOT be added here, and instead should be added to the `aws_region` default input to the workflow. | ||
| LEGACY_COMMERCIAL_REGIONS: us-east-1, us-east-2, us-west-1, us-west-2, ap-south-1, ap-northeast-3, ap-northeast-2, ap-southeast-1, ap-southeast-2, ap-northeast-1, ca-central-1, eu-central-1, eu-west-1, eu-west-2, eu-west-3, eu-north-1, sa-east-1 | ||
| LAYER_NAME: AWSOpenTelemetryDistroJava | ||
| VERSION: ${{ github.event.inputs.version }} |
There was a problem hiding this comment.
Code quality: The version input and VERSION env var are declared but never used anywhere in the workflow.
The workflow accepts a version input and stores it in env.VERSION, but no step references it. The PR description mentions creating a "draft GitHub release" and a publish-github job, but neither exists in this workflow.
Was the publish-github job accidentally omitted? If so, this workflow does not actually create a GitHub release as described in the PR.
| runs-on: ubuntu-latest | ||
| needs: publish-layer-prod | ||
| outputs: | ||
| layer-note: ${{ steps.layer-note.outputs.layer-note }} |
There was a problem hiding this comment.
Code quality: generate-lambda-release-note declares a layer-note output but no downstream job consumes it.
This job outputs layer-note, generates a Terraform file, and CDK constants, but the workflow ends here with no publish-github job to use these artifacts. The generated tf and CDK files are also not uploaded as artifacts, so they are lost when the job completes.
| env: | ||
| AWS_REGIONS: ${{ env.AWS_REGION }} | ||
| run: | | ||
| IFS=',' read -ra REGIONS <<< "$AWS_REGIONS" |
There was a problem hiding this comment.
Bug (Low): If aws_region input is empty (the default), the matrix generation produces a single empty-string entry.
The input has a default of empty string and required: true, but an empty string still passes GitHub Actions validation. The loop will produce a JSON array with one empty string element, causing the publish job to run once with an empty aws_region. This will break the AWS credential configuration and all subsequent AWS CLI calls. Consider adding input validation at the start of the workflow.
3 participants
Issue #, if available:
N/A
Description of changes:
Add a standalone region-build-release.yml workflow for deploying the Java Lambda layer to specific regions. This is needed for region build releases where we need to build and publish the Lambda layer independently from the full SDK release.
The workflow:
This was previously part of a separate Lambda release workflow before it was merged into release-build.yml in PR #461. Re-adding it as a dedicated workflow to support region-specific deployments without triggering a full SDK release.
V2:
Key difference from previous version:
ey differences:
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.