aws-database-encryption-sdk-dynamodb/.github/workflows/nightly.yml at main · aws/aws-database-encryption-sdk-dynamodb · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
# This workflow invokes other workflows with the nightly Dafny build
name: Dafny Nightly

on:
  schedule:
    # Nightly build against Dafny's nightly prereleases,
    # for early warning of verification issues or regressions.
    # Timing chosen to be adequately after Dafny's own nightly build,
    # but this might need to be tweaked:
    # https://github.com/dafny-lang/dafny/blob/master/.github/workflows/deep-tests.yml#L16
    - cron: "30 16 * * *"

jobs:
  getVersion:
    permissions:
      contents: read
      pull-requests: write
      id-token: write
    uses: ./.github/workflows/dafny_version.yml
  dafny-nightly-format:
    permissions:
      contents: read
      pull-requests: write
      id-token: write
    # Don't run the cron builds on forks
    if: github.event_name != 'schedule' || github.repository_owner == 'aws'
    uses: ./.github/workflows/library_format.yml
    with:
      dafny: "nightly-latest"
      regenerate-code: true
  dafny-nightly-verification:
    permissions:
      contents: read
      pull-requests: write
      id-token: write
    # Don't run the cron builds on forks
    if: github.event_name != 'schedule' || github.repository_owner == 'aws'
    uses: ./.github/workflows/library_dafny_verification.yml
    with:
      dafny: "nightly-latest"
      regenerate-code: true
  dafny-nightly-test-vector-verification:
    permissions:
      contents: read
      pull-requests: write
      id-token: write
    # Don't run the cron builds on forks
    if: github.event_name != 'schedule' || github.repository_owner == 'aws'
    uses: ./.github/workflows/test_vector_verification.yml
    with:
      dafny: "nightly-latest"
      regenerate-code: true
  dafny-nightly-java:
    permissions:
      contents: read
      pull-requests: write
      id-token: write
    if: github.event_name != 'schedule' || github.repository_owner == 'aws'
    uses: ./.github/workflows/ci_test_java.yml
    with:
      dafny: "nightly-latest"
      regenerate-code: true
  dafny-nightly-test-vectors-java:
    permissions:
      contents: read
      pull-requests: write
      id-token: write
    if: github.event_name != 'schedule' || github.repository_owner == 'aws'
    uses: ./.github/workflows/ci_test_vector_java.yml
    with:
      dafny: "nightly-latest"
      regenerate-code: true
  dafny-nightly-net:
    permissions:
      contents: read
      pull-requests: write
      id-token: write
    if: github.event_name != 'schedule' || github.repository_owner == 'aws'
    uses: ./.github/workflows/ci_test_net.yml
    with:
      dafny: "nightly-latest"
      regenerate-code: true
  dafny-nightly-rust:
    permissions:
      contents: read
      pull-requests: write
      id-token: write
    if: github.event_name != 'schedule' || github.repository_owner == 'aws'
    uses: ./.github/workflows/library_rust_tests.yml
    with:
      dafny: "nightly-latest"
      regenerate-code: true
  dafny-nightly-test-vectors-net:
    permissions:
      contents: read
      pull-requests: write
      id-token: write
    if: github.event_name != 'schedule' || github.repository_owner == 'aws'
    uses: ./.github/workflows/ci_test_vector_net.yml
    with:
      dafny: "nightly-latest"
      regenerate-code: true

  cut-issue-on-failure:
    runs-on: ubuntu-22.04
    permissions:
      id-token: write
      contents: read
    needs:
      [
        dafny-nightly-format,
        dafny-nightly-verification,
        dafny-nightly-java,
        dafny-nightly-net,
      ]
    if: ${{ always() && contains(needs.*.result, 'failure') }}
    steps:
      # We need access to the role that is able to get CI Bot Creds
      - name: Configure AWS Credentials for Release
        uses: aws-actions/configure-aws-credentials@v6
        with:
          aws-region: us-west-2
          role-to-assume: arn:aws:iam::587316601012:role/GitHub-CI-CI-Bot-Credential-Access-Role-us-west-2
          role-session-name: Dafny_Issue_Blocker
          special-characters-workaround: "true" # Some environments (example: windowsOS) cannot tolerate special characters in a secret key.

      # Use AWS Secrets Manger GHA to retrieve CI Bot Creds
      - name: Get CI Bot Creds Secret
        uses: aws-actions/aws-secretsmanager-get-secrets@v2
        with:
          secret-ids: Github/aws-crypto-tools-ci-bot
          parse-json-secrets: true

      - name: Create release blocker on dafny-lang/dafny
        env:
          GH_TOKEN: ${{ env.GITHUB_AWS_CRYPTO_TOOLS_CI_BOT_ESDK_RELEASE_TOKEN }}
        run: |
          id=$(gh search issues -R dafny-lang/dafny --match title "[PRERELEASE REGRESSION] Dafny prerelease regression from ${{ github.repository }}" --json number,state -q '[.[] | select( .state=="open" )][0].number')
           if [ -n "$id" ]; then
             gh issue comment -R dafny-lang/dafny $id \
               -b "Another failure in ${{ github.workflow_ref }}. \
                 See ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
           else
             gh issue create -R dafny-lang/dafny \
               -t "[PRERELEASE REGRESSION] Dafny prerelease regression from ${{ github.repository }}" \
               -b "Failure in ${{ github.workflow_ref }}. \
                 See ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
           fi