release-build.yml

name: Release Build
on:
  workflow_dispatch:
    inputs:
      version:
        description: The version to tag the release with, e.g., 1.2.0
        required: true
      aws_region:
        description: 'Deploy lambda layer to aws regions'
        required: true
        default: 'us-east-1, us-east-2, us-west-1, us-west-2, ap-south-1, ap-northeast-3, ap-northeast-2, ap-southeast-1, ap-southeast-2, ap-northeast-1, ca-central-1, eu-central-1, eu-west-1, eu-west-2, eu-west-3, eu-north-1, sa-east-1, af-south-1, ap-east-1, ap-south-2, ap-southeast-3, ap-southeast-4, eu-central-2, eu-south-1, eu-south-2, il-central-1, me-central-1, me-south-1, ap-southeast-5, ap-southeast-7, mx-central-1, ca-west-1, cn-north-1, cn-northwest-1'

env:
  VERSION: ${{ env.VERSION }}

  AWS_DEFAULT_REGION: us-east-1
  AWS_PUBLIC_ECR_REGION: us-east-1
  AWS_PRIVATE_ECR_REGION: us-west-2
  RELEASE_PUBLIC_REPOSITORY: public.ecr.aws/aws-observability/adot-autoinstrumentation-python
  RELEASE_PRIVATE_REPOSITORY: 020628701572.dkr.ecr.us-west-2.amazonaws.com/adot-autoinstrumentation-python
  RELEASE_PRIVATE_REGISTRY: 020628701572.dkr.ecr.us-west-2.amazonaws.com
  PACKAGE_NAME: aws-opentelemetry-distro
  ARTIFACT_NAME: aws_opentelemetry_distro-${{ env.VERSION }}-py3-none-any.whl
  # Legacy list of commercial regions to deploy to. New regions should NOT be added here, and instead should be added to the `aws_region` default input to the workflow.
  LEGACY_COMMERCIAL_REGIONS: us-east-1, us-east-2, us-west-1, us-west-2, ap-south-1, ap-northeast-3, ap-northeast-2, ap-southeast-1, ap-southeast-2, ap-northeast-1, ca-central-1, eu-central-1, eu-west-1, eu-west-2, eu-west-3, eu-north-1, sa-east-1
  LAYER_NAME: AWSOpenTelemetryDistroPython

permissions:
  id-token: write
  contents: write

jobs:
  build-sdk:
    environment: Release
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repo @ SHA - ${{ github.sha }}
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0

      - name: Check main build status
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          WORKFLOW_ID=$(gh api repos/${{ github.repository }}/actions/workflows --jq '.workflows[] | select(.name=="Python Instrumentation Main Build") | .id')
          LATEST_RUN=$(gh api repos/${{ github.repository }}/actions/workflows/$WORKFLOW_ID/runs --jq '[.workflow_runs[] | select(.head_branch=="${{ github.ref_name }}")] | sort_by(.created_at) | .[-1] | {conclusion, status}')
          STATUS=$(echo "$LATEST_RUN" | jq -r '.status')
          CONCLUSION=$(echo "$LATEST_RUN" | jq -r '.conclusion')
          
          if [ "$STATUS" = "in_progress" ] || [ "$STATUS" = "queued" ]; then
            echo "Main build is still running (status: $STATUS). Cannot proceed with release."
            exit 1
          elif [ "$CONCLUSION" != "success" ]; then
            echo "Latest main build on branch ${{ github.ref_name }} conclusion: $CONCLUSION"
            exit 1
          fi
          echo "Main build succeeded, proceeding with release"

      - name: Build Wheel and Image Files
        uses: ./.github/actions/artifacts_build
        with:
          image_uri_with_tag: "adot-autoinstrumentation-python:test"
          push_image: false
          load_image: true
          python_version: "3.10"
          package_name: aws-opentelemetry-distro
          os: ubuntu-latest

      # TODO: Add some sort of smoke/integration testing before we go
      # release the artifacts. adot java for reference:
      # https://github.com/aws-observability/aws-otel-java-instrumentation/tree/93870a550ac30988fbdd5d3bf1e8f9f1b37916f5/smoke-tests

      - name: Upload SDK artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 #v4.6.2
        with:
          name: ${{ env.ARTIFACT_NAME }}
          path: dist/${{ env.ARTIFACT_NAME }}
  
  build-layer:
    needs: build-sdk
    runs-on: ubuntu-latest
    outputs:
      aws_regions_json: ${{ steps.set-matrix.outputs.aws_regions_json }}
    steps:
      - name: Set up regions matrix
        id: set-matrix
        env:
          AWS_REGIONS: ${{ env.AWS_REGIONS }}
        run: |
          IFS=',' read -ra REGIONS <<< "$AWS_REGIONS"
          MATRIX="["
          for region in "${REGIONS[@]}"; do
            trimmed_region=$(echo "$region" | xargs)
            MATRIX+="\"$trimmed_region\","
          done
          MATRIX="${MATRIX%,}]"
          echo ${MATRIX}
          echo "aws_regions_json=${MATRIX}" >> $GITHUB_OUTPUT
      - name: Checkout Repo @ SHA - ${{ github.sha }}
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
      - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c #v6.0.0
        with:
          python-version: '3.x'
      - name: Build layers
        working-directory: lambda-layer/src
        run: |
          ./build-lambda-layer.sh
          pip install tox
          tox
      - name: upload layer
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 #v4.6.2
        with:
          name: layer.zip
          path: lambda-layer/src/build/aws-opentelemetry-python-layer.zip

  publish-sdk:
    needs: [build-sdk, build-layer]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repo @ SHA - ${{ github.sha }}
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0

      - name: Configure AWS credentials for PyPI secrets
        uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838 #v5.0.0
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN_SECRETS_MANAGER }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
      
      - name: Get PyPI secrets
        uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 #v2.0.10
        id: pypi_secrets
        with:
          secret-ids: |
            PROD_PYPI_TOKEN,${{ secrets.PYPI_PROD_TOKEN_SECRET_ARN }}
            TEST_PYPI_TOKEN,${{ secrets.PYPI_TEST_TOKEN_SECRET_ARN }}
          parse-json-secrets: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 #3.11.1

      - name: Configure AWS credentials for private ECR
        uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838 #v5.0.0
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN_ECR_RELEASE }}
          aws-region: ${{ env.AWS_PRIVATE_ECR_REGION }}

      - name: Log in to AWS private ECR
        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 #v3.5.0
        with:
          registry: ${{ env.RELEASE_PRIVATE_REGISTRY }}

      - name: Configure AWS credentials for public ECR
        uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838 #v5.0.0
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN_ECR_RELEASE }}
          aws-region: ${{ env.AWS_PUBLIC_ECR_REGION }}

      - name: Log in to AWS public ECR
        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 #v3.5.0
        with:
          registry: public.ecr.aws

      # The step below publishes to testpypi in order to catch any issues
      # with the package configuration that would cause a failure to upload to pypi.
      - name: Install twine
        run: pip install twine==5.1.1
      
      - name: Download SDK artifact
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 #v5.0.0
        with:
          name: ${{ env.ARTIFACT_NAME }}
      
      - name: Publish to TestPyPI
        env:
          TWINE_USERNAME: '__token__'
          TWINE_PASSWORD: ${{ env.TEST_PYPI_TOKEN_API_TOKEN }}
        run: |
          twine upload --repository testpypi --skip-existing --verbose ${{ env.ARTIFACT_NAME }}

      # Publish to prod PyPI
      - name: Publish to PyPI
        env:
          TWINE_USERNAME: '__token__'
          TWINE_PASSWORD: ${{ env.PROD_PYPI_TOKEN_API_TOKEN }}
        run: |
          twine upload --skip-existing --verbose ${{ env.ARTIFACT_NAME }}

      # Publish to public ECR
      - name: Build and push public ECR image
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 #v6.18.0
        with:
          push: true
          context: .
          file: ./Dockerfile
          platforms: linux/amd64,linux/arm64
          tags: |
            ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION }}

      # Publish to private ECR
      - name: Build and push private ECR image
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 #v6.18.0
        with:
          push: true
          context: .
          file: ./Dockerfile
          platforms: linux/amd64,linux/arm64
          tags: |
            ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION }}
  
  publish-layer-prod:
    runs-on: ubuntu-latest
    needs: [build-layer, publish-sdk]
    strategy:
      matrix:
        aws_region: ${{ fromJson(needs.build-layer.outputs.aws_regions_json) }}
    steps:
      - name: role arn
        env:
          LEGACY_COMMERCIAL_REGIONS: ${{ env.LEGACY_COMMERCIAL_REGIONS }}
        run: |
          LEGACY_COMMERCIAL_REGIONS_ARRAY=(${LEGACY_COMMERCIAL_REGIONS//,/ })
          FOUND=false
          for REGION in "${LEGACY_COMMERCIAL_REGIONS_ARRAY[@]}"; do
            if [[ "$REGION" == "${{ matrix.aws_region }}" ]]; then
              FOUND=true
              break
            fi
          done
          if [ "$FOUND" = true ]; then
            echo "Found ${{ matrix.aws_region }} in LEGACY_COMMERCIAL_REGIONS"
            SECRET_KEY="LAMBDA_LAYER_RELEASE"
          else
            echo "Not found ${{ matrix.aws_region }} in LEGACY_COMMERCIAL_REGIONS"
            SECRET_KEY="${{ matrix.aws_region }}_LAMBDA_LAYER_RELEASE"
          fi
          SECRET_KEY=${SECRET_KEY//-/_}
          echo "SECRET_KEY=${SECRET_KEY}" >> $GITHUB_ENV
      - uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838 #v5.0.0
        with:
          role-to-assume: ${{ secrets[env.SECRET_KEY] }}
          role-duration-seconds: 1200
          aws-region: ${{ matrix.aws_region }}
      - name: Get s3 bucket name for release 
        run: |
          echo BUCKET_NAME=python-lambda-layer-${{ github.run_id }}-${{ matrix.aws_region }} | tee --append $GITHUB_ENV
      - name: download layer.zip
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 #v5.0.0
        with:
          name: layer.zip
      - name: publish
        run: |
          aws s3 mb s3://${{ env.BUCKET_NAME }}
          aws s3 cp aws-opentelemetry-python-layer.zip s3://${{ env.BUCKET_NAME }}
          layerARN=$(
            aws lambda publish-layer-version \
              --layer-name ${{ env.LAYER_NAME }} \
              --content S3Bucket=${{ env.BUCKET_NAME }},S3Key=aws-opentelemetry-python-layer.zip \
              --compatible-runtimes python3.10 python3.11 python3.12 python3.13 \
              --compatible-architectures "arm64" "x86_64" \
              --license-info "Apache-2.0" \
              --description "AWS Distro of OpenTelemetry Lambda Layer for Python Runtime" \
              --query 'LayerVersionArn' \
              --output text
          )
          echo $layerARN
          echo "LAYER_ARN=${layerARN}" >> $GITHUB_ENV
          mkdir ${{ env.LAYER_NAME }}
          echo $layerARN > ${{ env.LAYER_NAME }}/${{ matrix.aws_region }}
          cat ${{ env.LAYER_NAME }}/${{ matrix.aws_region }}
      - name: public layer
        run: |
          layerVersion=$(
            aws lambda list-layer-versions \
              --layer-name ${{ env.LAYER_NAME }} \
              --query 'max_by(LayerVersions, &Version).Version'
          )
          aws lambda add-layer-version-permission \
            --layer-name ${{ env.LAYER_NAME }} \
            --version-number $layerVersion \
            --principal "*" \
            --statement-id publish \
            --action lambda:GetLayerVersion
      - name: upload layer arn artifact
        if: ${{ success() }}
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 #v4.6.2
        with:
          name: ${{ env.LAYER_NAME }}-${{ matrix.aws_region }}
          path: ${{ env.LAYER_NAME }}/${{ matrix.aws_region }}
      - name: clean s3
        if: always()
        run: |
          aws s3 rb --force s3://${{ env.BUCKET_NAME }}

  generate-lambda-release-note:
    runs-on: ubuntu-latest
    needs: publish-layer-prod
    outputs:
      layer-note: ${{ steps.layer-note.outputs.layer-note }}
    steps:
      - name: Checkout Repo @ SHA - ${{ github.sha }}
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
      - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd #v3.1.2
      - name: download layerARNs
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 #v5.0.0
        with:
          pattern: ${{ env.LAYER_NAME }}-*
          path: ${{ env.LAYER_NAME }}
          merge-multiple: true
      - name: show layerARNs
        run: |
          for file in ${{ env.LAYER_NAME }}/*
          do
          echo $file
          cat $file
          done
      - name: generate layer-note
        id: layer-note
        working-directory: ${{ env.LAYER_NAME }}
        run: |
          echo "| Region | Layer ARN |" >> ../layer-note
          echo "|  ----  | ----  |" >> ../layer-note
          for file in *
          do
          read arn < $file
          echo "| " $file " | " $arn " |" >> ../layer-note
          done
          cd ..
          {
            echo "layer-note<<EOF"
            cat layer-note
            echo "EOF"
          } >> $GITHUB_OUTPUT
          cat layer-note
      - name: generate tf layer
        working-directory: ${{ env.LAYER_NAME }}
        run: |
          echo "locals {" >> ../layer_arns.tf
          echo "  sdk_layer_arns = {" >> ../layer_arns.tf
          for file in *
          do
          read arn < $file
          echo "    \""$file"\" = \""$arn"\"" >> ../layer_arns.tf
          done
          cd ..
          echo "  }" >> layer_arns.tf
          echo "}" >> layer_arns.tf
          terraform fmt layer_arns.tf
          cat layer_arns.tf
      - name: generate layer ARN constants for CDK
        working-directory: ${{ env.LAYER_NAME }}
        run: |
          echo "{" > ../layer_cdk
          for file in *; do
            read arn < "$file"
            echo "    \"$file\": \"$arn\"," >> ../layer_cdk
          done
          echo "}" >> ../layer_cdk
          cat ../layer_cdk

  publish-github:
    needs: generate-lambda-release-note
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repo @ SHA - ${{ github.sha }}
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
      
      - name: Download SDK artifact
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 #v5.0.0
        with:
          name: ${{ env.ARTIFACT_NAME }}
      
      - name: Download layer.zip artifact
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 #v5.0.0
        with:
          name: layer.zip

      - name: Rename layer file
        run: |
          cp aws-opentelemetry-python-layer.zip layer.zip

      # Publish to GitHub releases
      - name: Create GH release
        id: create_release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VERSION: ${{ env.VERSION }}
        run: |
          # Extract all dependencies from pyproject.toml
          DEPS=$(python3 -c "
          import re
          with open('aws-opentelemetry-distro/pyproject.toml', 'r') as f:
              content = f.read()
          deps_match = re.search(r'dependencies\s*=\s*\[(.*?)\]', content, re.DOTALL)
          if deps_match:
              deps_content = deps_match.group(1)
              dep_lines = re.findall(r'\"([^\"]+)\"', deps_content)
              formatted_deps = []
              for dep_line in dep_lines:
                  if ' == ' in dep_line:
                      package, version = dep_line.split(' == ', 1)
                      formatted_deps.append(f'- \`{package}\` - {version}')
                  else:
                      formatted_deps.append(f'- \`{dep_line}\`')
              print('\n'.join(formatted_deps))
          ")

          # Extract CHANGELOG entries for this version
          CHANGELOG_ENTRIES=$(python3 -c "
          import re, os
          version = os.environ['VERSION']
          with open('CHANGELOG.md', 'r') as f:
              content = f.read()
          version_pattern = rf'## v{re.escape(version)}.*?\n(.*?)(?=\n## |\Z)'
          version_match = re.search(version_pattern, content, re.DOTALL)
          if version_match:
              entries = version_match.group(1).strip()
              if entries:
                  print(entries)
          ")

          # Create release notes
          cat > release_notes.md << EOF
          $(if [ -n "$CHANGELOG_ENTRIES" ]; then echo "## What's Changed"; echo "$CHANGELOG_ENTRIES"; echo ""; fi)

          ## Upstream Components

          $DEPS

          ## Release Artifacts

          This release publishes to public ECR and PyPi.
          * See ADOT Python auto-instrumentation Docker image v$VERSION in our public ECR repository:
          https://gallery.ecr.aws/aws-observability/adot-autoinstrumentation-python
          * See version $VERSION in our PyPi repository:
          https://pypi.org/project/aws-opentelemetry-distro/

          ## Lambda Layer

          This release includes the AWS OpenTelemetry Lambda Layer for Python version $VERSION-$(echo $GITHUB_SHA | cut -c1-7).

          Lambda Layer ARNs:
          ${{ needs.generate-lambda-release-note.outputs.layer-note }}
          EOF

          shasum -a 256 ${{ env.ARTIFACT_NAME }} > ${{ env.ARTIFACT_NAME }}.sha256
          shasum -a 256 layer.zip > layer.zip.sha256

          gh release create --target "$GITHUB_REF_NAME" \
             --title "Release v$VERSION" \
             --notes-file release_notes.md \
             --draft \
             "v$VERSION" \
             ${{ env.ARTIFACT_NAME }} \
             ${{ env.ARTIFACT_NAME }}.sha256 \
             layer.zip \
             layer.zip.sha256