Merge branch 'aws:develop' into move_rust_outof_experimental

Author: bnusunny

.github/workflows/automated-updates-to-sam-cli.yml

@@ -13,6 +13,16 @@ jobs:
     if: github.repository == 'aws/aws-sam-cli'
     runs-on: ubuntu-latest
     steps:
+      - name: Check if PR already exists
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          PR_COUNT=$(gh pr list --repo aws/aws-sam-cli --head update_app_templates_hash --json id --jq length)
+          if [ "$PR_COUNT" -ge 1 ]; then
+            echo "PR already exists for update_app_templates_hash, skipping workflow"
+            exit 1
+          fi
+
       - name: Checkout App Templates
         uses: actions/checkout@v6
         with:
@@ -58,6 +68,16 @@ jobs:
     if: github.repository == 'aws/aws-sam-cli'
     runs-on: ubuntu-latest
     steps:
+      - name: Check if PR already exists
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          PR_COUNT=$(gh pr list --repo aws/aws-sam-cli --head update_sam_transform_version --json id --jq length)
+          if [ "$PR_COUNT" -ge 1 ]; then
+            echo "PR already exists for update_sam_transform_version, skipping workflow"
+            exit 1
+          fi
+
       - name: Checkout SAM
         uses: actions/checkout@v6
         with:
@@ -72,6 +92,13 @@ jobs:
           repository: aws/aws-sam-cli
           path: aws-sam-cli
 
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+
       - name: Update aws-sam-translator & commit
         run: |
           git config --global user.email "action@github.com"
@@ -86,6 +113,7 @@ jobs:
           git reset --hard develop
           sed -i "s/$SAM_T_PRE_VERSION/aws-sam-translator==$SAM_T_CUR_VERSION/g" requirements/base.txt
           cp -r ../serverless-application-model/tests/translator/input ./tests/functional/commands/validate/lib/models
+          make update-reproducible-reqs-uv
           git status
           git diff --quiet && exit 0 # exit if there is no change
           echo "is_new_sam_t=1" >> $GITHUB_ENV # set env variable for next step run decision
@@ -109,6 +137,16 @@ jobs:
     if: github.repository == 'aws/aws-sam-cli'
     runs-on: ubuntu-latest
     steps:
+      - name: Check if PR already exists
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          PR_COUNT=$(gh pr list --repo aws/aws-sam-cli --head update_lambda_builders_version --json id --jq length)
+          if [ "$PR_COUNT" -ge 1 ]; then
+            echo "PR already exists for update_lambda_builders_version, skipping workflow"
+            exit 1
+          fi
+
       - name: Checkout Lambda Builders
         uses: actions/checkout@v6
         with:
@@ -123,6 +161,13 @@ jobs:
           repository: aws/aws-sam-cli
           path: aws-sam-cli
 
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+
       - name: Upgrade aws_lambda_builders & commit
         run: |
           git config --global user.email "action@github.com"
@@ -136,6 +181,7 @@ jobs:
           echo "Lambda Builders pre version is $BUILDERS_PRE_VERSION"
           git reset --hard develop
           sed -i "s/$BUILDERS_PRE_VERSION/aws_lambda_builders==$BUILDERS_CUR_VERSION/g" requirements/base.txt
+          make update-reproducible-reqs-uv
           git status
           git diff --quiet && exit 0 # exit if there is no change
           echo "is_new_lambda_builders=1" >> $GITHUB_ENV # set env variable for next step run decision

.github/workflows/build.yml

@@ -130,14 +130,20 @@ jobs:
           #- "delete"
           #- "deploy"
           - name: "integ-all-other"
-            params: "-n 2 --reruns 3 tests/integration/init tests/integration/local tests/integration/pipeline tests/integration/root tests/integration/scripts tests/integration/telemetry tests/integration/docs"
+            params: "-n 2 --reruns 3 tests/integration/init tests/integration/local tests/integration/pipeline tests/integration/root tests/integration/scripts tests/integration/telemetry tests/integration/docs --ignore=tests/integration/local/invoke/test_invoke_durable.py --ignore=tests/integration/local/start_api/test_start_api_durable.py --ignore=tests/integration/local/start_lambda/test_start_lambda_durable.py"
+          - name: "durable-functions"
+            params: "--reruns 3 tests/integration/local/invoke/test_invoke_durable.py tests/integration/local/start_api/test_start_api_durable.py tests/integration/local/start_lambda/test_start_lambda_durable.py"
           #- "list"
           #- "logs"
           #- "package"
           #- "publish"
           #- "sync"
           #- "traces"
           #- "validate"
+        exclude:
+          - os: windows-latest
+            tests_config:
+              name: "durable-functions"
     steps:
       - uses: actions/checkout@v6
       - name: Set TEMP to D:/Temp
@@ -197,6 +203,8 @@ jobs:
         run: uv pip install --system --python python3.12 --upgrade pip setuptools
       - name: Run integration tests for ${{ matrix.tests_config.name }}
         run: pytest -vv ${{ matrix.tests_config.params }}
+        env:
+          FORCE_RUN_DOCKER_TEST: ${{ matrix.tests_config.name == 'durable-functions' && '1' || '' }}
 
   smoke-and-functional-tests:
     name: ${{ matrix.tests_config.name }} / ${{ matrix.tests_config.os }} / ${{ matrix.python }}

.github/workflows/integration-tests.yml

@@ -24,7 +24,7 @@ env:
   CARGO_LAMBDA_VERSION: "v0.17.1"
   NOSE_PARAMETERIZED_NO_WARN: 1
   BY_CANARY: true
-  UV_PYTHON: python3.9
+  UV_PYTHON: python3.11
   CREDENTIAL_DISTRIBUTION_LAMBDA_ARN: ${{ secrets.CREDENTIAL_DISTRIBUTION_LAMBDA_ARN }}
   ACCOUNT_RESET_LAMBDA_ARN: ${{ secrets.ACCOUNT_RESET_LAMBDA_ARN }}
 
@@ -51,7 +51,6 @@ jobs:
           - local-invoke
           - local-start1
           - local-start2
-          - durable-functions
           - other-and-e2e
         exclude:
           # no-container mode only applies to build-integ test suites
@@ -67,8 +66,6 @@ jobs:
             test_suite: local-start1
           - container_runtime: no-container
             test_suite: local-start2
-          - container_runtime: no-container
-            test_suite: durable-functions
           - container_runtime: no-container
             test_suite: other-and-e2e
 
@@ -108,7 +105,7 @@ jobs:
           fi
 
       - name: Configure AWS credentials via OIDC
-        uses: aws-actions/configure-aws-credentials@v5
+        uses: aws-actions/configure-aws-credentials@v6
         with:
           role-to-assume: ${{ secrets.OIDC_ROLE_ARN }}
           aws-region: us-east-1
@@ -139,7 +136,7 @@ jobs:
 
       - name: Set up Go
         if: contains(fromJSON('["build-integ", "build-integ-java-python-provided", "build-integ-arm64"]'), matrix.test_suite) && matrix.container_runtime == 'no-container'
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: '1.25'
 
@@ -297,33 +294,52 @@ jobs:
       - name: Get testing resources and credentials
         run: |
           # Try with skip_role_deletion parameter first
-          test_env_var=$(python3.9 tests/get_testing_resources.py skip_role_deletion)
+          test_env_var=$(python3.11 tests/get_testing_resources.py skip_role_deletion)
           
           if [ $? -ne 0 ]; then
             echo "First attempt with skip_role_deletion failed, trying without parameter..."
-            test_env_var=$(python3.9 tests/get_testing_resources.py)
+            test_env_var=$(python3.11 tests/get_testing_resources.py)
             
             if [ $? -ne 0 ]; then
               echo "get_testing_resources failed. Failed to acquire credentials or test resources."
               exit 1
             fi
           fi
           
-          # Save current credentials for account reset later
+          # Save current credentials for account reset later (mask them first)
+          echo "::add-mask::$AWS_ACCESS_KEY_ID"
+          echo "::add-mask::$AWS_SECRET_ACCESS_KEY"
+          echo "::add-mask::$AWS_SESSION_TOKEN"
           echo "CI_ACCESS_ROLE_AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID" >> $GITHUB_ENV
           echo "CI_ACCESS_ROLE_AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY" >> $GITHUB_ENV
           echo "CI_ACCESS_ROLE_AWS_SESSION_TOKEN=$AWS_SESSION_TOKEN" >> $GITHUB_ENV
           
-          # Set test credentials
-          echo "AWS_ACCESS_KEY_ID=$(echo "$test_env_var" | jq -j ".accessKeyID")" >> $GITHUB_ENV
-          echo "AWS_SECRET_ACCESS_KEY=$(echo "$test_env_var" | jq -j ".secretAccessKey")" >> $GITHUB_ENV
-          echo "AWS_SESSION_TOKEN=$(echo "$test_env_var" | jq -j ".sessionToken")" >> $GITHUB_ENV
-          echo "TASK_TOKEN=$(echo "$test_env_var" | jq -j ".taskToken")" >> $GITHUB_ENV
+          # Extract test credentials and mask them before setting as env vars
+          TEST_ACCESS_KEY_ID=$(echo "$test_env_var" | jq -j ".accessKeyID")
+          TEST_SECRET_ACCESS_KEY=$(echo "$test_env_var" | jq -j ".secretAccessKey")
+          TEST_SESSION_TOKEN=$(echo "$test_env_var" | jq -j ".sessionToken")
+          TEST_TASK_TOKEN=$(echo "$test_env_var" | jq -j ".taskToken")
+          
+          # Mask sensitive credentials so they don't appear in logs
+          echo "::add-mask::$TEST_ACCESS_KEY_ID"
+          echo "::add-mask::$TEST_SECRET_ACCESS_KEY"
+          echo "::add-mask::$TEST_SESSION_TOKEN"
+          echo "::add-mask::$TEST_TASK_TOKEN"
+          
+          # Set test credentials as environment variables
+          echo "AWS_ACCESS_KEY_ID=$TEST_ACCESS_KEY_ID" >> $GITHUB_ENV
+          echo "AWS_SECRET_ACCESS_KEY=$TEST_SECRET_ACCESS_KEY" >> $GITHUB_ENV
+          echo "AWS_SESSION_TOKEN=$TEST_SESSION_TOKEN" >> $GITHUB_ENV
+          echo "TASK_TOKEN=$TEST_TASK_TOKEN" >> $GITHUB_ENV
+          
+          # Set other test resources (non-sensitive)
           echo "AWS_S3_TESTING=$(echo "$test_env_var" | jq -j ".TestBucketName")" >> $GITHUB_ENV
           echo "AWS_ECR_TESTING=$(echo "$test_env_var" | jq -j ".TestECRURI")" >> $GITHUB_ENV
           echo "AWS_KMS_KEY=$(echo "$test_env_var" | jq -j ".TestKMSKeyArn")" >> $GITHUB_ENV
           echo "AWS_SIGNING_PROFILE_NAME=$(echo "$test_env_var" | jq -j ".TestSigningProfileName")" >> $GITHUB_ENV
           echo "AWS_SIGNING_PROFILE_VERSION_ARN=$(echo "$test_env_var" | jq -j ".TestSigningProfileARN")" >> $GITHUB_ENV
+          echo "LMI_SUBNET_ID=$(echo "$test_env_var" | jq -j ".LMISubnetId")" >> $GITHUB_ENV
+          echo "LMI_SECURITY_GROUP_ID=$(echo "$test_env_var" | jq -j ".LMISecurityGroupId")" >> $GITHUB_ENV
 
       - name: Login to Public ECR
         if: matrix.container_runtime != 'no-container' && env.BY_CANARY == 'true'
@@ -368,13 +384,13 @@ jobs:
               pytest -vv -n 2 --reruns 3 tests/integration/buildcmd/test_build_cmd_arm64.py -m 'java' -k "${CONTAINER_FILTER}" --json-report --json-report-file=TEST_REPORT-integration-buildcmd-arm64-java-${{ matrix.container_runtime }}.json
               ;;
             "terraform-build")
-              pytest -vv -n 4 --reruns 4 tests/integration/buildcmd/test_build_terraform_applications.py tests/integration/buildcmd/test_build_terraform_applications_other_cases.py --json-report --json-report-file=TEST_REPORT-integration-terraform-${{ matrix.container_runtime }}.json
+              pytest -vv -n 4 --reruns 3 tests/integration/buildcmd/test_build_terraform_applications.py tests/integration/buildcmd/test_build_terraform_applications_other_cases.py --json-report --json-report-file=TEST_REPORT-integration-terraform-${{ matrix.container_runtime }}.json
               ;;
             "package-delete-deploy")
               pytest -vv tests/integration/package tests/integration/delete tests/integration/deploy --dist=loadgroup -n 6 --reruns 4 --json-report --json-report-file=TEST_REPORT-integration-package-delete-deploy-${{ matrix.container_runtime }}.json
               ;;
             "sync")
-              pytest -vv tests/integration/sync -n 6 --reruns 3 --dist loadscope --json-report --json-report-file=TEST_REPORT-integration-sync-${{ matrix.container_runtime }}.json
+              pytest -vv tests/integration/sync -n 4 --reruns 3 --dist loadscope --json-report --json-report-file=TEST_REPORT-integration-sync-${{ matrix.container_runtime }}.json
               ;;
             "local-invoke")
               pytest -vv --reruns 3 tests/integration/local/invoke tests/integration/local/generate_event --ignore tests/integration/local/invoke/test_invoke_durable.py --json-report --json-report-file=TEST_REPORT-integration-local-invoke-${{ matrix.container_runtime }}.json
@@ -383,14 +399,10 @@ jobs:
               pytest -vv --reruns 3 tests/integration/local/start_api --ignore tests/integration/local/start_api/test_start_api_with_terraform_application.py --ignore tests/integration/local/start_api/test_start_api_durable.py --json-report --json-report-file=TEST_REPORT-integration-local-start1-${{ matrix.container_runtime }}.json
               ;;
             "local-start2")
-              pytest -vv --reruns 3 tests/integration/local/start_lambda tests/integration/local/start_api/test_start_api_with_terraform_application.py --ignore tests/integration/local/start_lambda/test_start_lambda_durable.py --json-report --json-report-file=TEST_REPORT-integration-local-start2-${{ matrix.container_runtime }}.json
-              ;;
-            "durable-functions")
-              pytest -vv --reruns 3 tests/integration/local/invoke/test_invoke_durable.py tests/integration/local/start_api/test_start_api_durable.py tests/integration/local/start_lambda/test_start_lambda_durable.py tests/integration/local/callback/test_callback.py tests/integration/local/execution/test_execution.py --json-report --json-report-file=TEST_REPORT-integration-durable-functions-${{ matrix.container_runtime }}.json
+              pytest -vv --reruns 3 tests/integration/local/start_lambda tests/integration/local/start_api/test_start_api_with_terraform_application.py tests/integration/local/callback/test_callback.py tests/integration/local/execution/test_execution.py --ignore tests/integration/local/start_lambda/test_start_lambda_durable.py --json-report --json-report-file=TEST_REPORT-integration-local-start2-${{ matrix.container_runtime }}.json
               ;;
             "other-and-e2e")
-              pytest -vv -n 4 --reruns 4 --dist loadgroup tests/integration tests/end_to_end --ignore=tests/integration/buildcmd --ignore=tests/integration/delete --ignore=tests/integration/deploy --ignore=tests/integration/package --ignore=tests/integration/sync --ignore=tests/integration/local --json-report --json-report-file=TEST_REPORT-integration-others-${{ matrix.container_runtime }}.json
-              pytest -vv --reruns 3 tests/regression --json-report --json-report-file=TEST_REPORT-regression-${{ matrix.container_runtime }}.json
+              pytest -vv -n 4 --reruns 3 --dist loadgroup tests/integration tests/end_to_end tests/regression --ignore=tests/integration/buildcmd --ignore=tests/integration/delete --ignore=tests/integration/deploy --ignore=tests/integration/package --ignore=tests/integration/sync --ignore=tests/integration/local --json-report --json-report-file=TEST_REPORT-integration-others-${{ matrix.container_runtime }}.json
               ;;
           esac
 

.github/workflows/notify-slack.yml

@@ -0,0 +1,35 @@
+name: Slack Notifications
+
+on:
+  pull_request:
+    types: [labeled]
+  issues:
+    types: [opened]
+
+jobs:
+  notify-slack:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Wait for label to be applied
+        run: sleep 10s
+        shell: bash
+      - name: Send External PR Notification
+        if: github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'pr/external')
+        uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2
+        env:
+          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_URL }}
+          SLACK_TITLE: 'PR Created: ${{ github.event.pull_request.title }} by ${{ github.event.pull_request.user.login }}'
+          SLACK_FOOTER: ''
+          MSG_MINIMAL: true
+          SLACK_MESSAGE: '${{ github.event.pull_request.html_url }}'
+      - name: Send New Issue Notification
+        if: github.event_name == 'issue'
+        uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2
+        env:
+          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_URL }}
+          SLACK_TITLE: 'Issue Created: ${{ github.event.issue.title }} by ${{ github.event.issue.user.login }}'
+          SLACK_FOOTER: ''
+          MSG_MINIMAL: true
+          SLACK_MESSAGE: '${{ github.event.issue.html_url }}'

.github/workflows/update-reproducibles.yml

@@ -15,32 +15,23 @@ jobs:
       pull-requests: write
       contents: write
     if: github.repository_owner == 'aws'
-    strategy:
-      matrix:
-        include:
-          - os: ubuntu-latest
-            python: 3.11
-            target: update-reproducible-linux-reqs
-          - os: macos-latest
-            python: 3.11
-            target: update-reproducible-mac-reqs
-          - os: windows-latest
-            python: 3.12
-            target: update-reproducible-win-reqs
-      max-parallel: 1
-    runs-on: ${{ matrix.os }}
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
         with:
           ref: ${{ github.head_ref }}
       - uses: actions/setup-python@v6
         with:
-          python-version: ${{ matrix.python }}
-      - run: make ${{ matrix.target }}
+          python-version: "3.11"
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+      - name: Update all reproducible requirements
+        run: make update-reproducible-reqs-uv
       - name: Push changes
         run: |
           git config --global user.email "action@github.com"
           git config --global user.name "GitHub Action"
           git remote set-url origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}
-          git commit -am "Update reproducibles: ${{ matrix.target }}" || echo "nothing to commit"
+          git add requirements/reproducible-*.txt
+          git commit -m "Update reproducible requirements" || echo "nothing to commit"
           git push

.gitignore

@@ -407,6 +407,7 @@ cov.xml
 coverage.xml
 
 # Temporary scratch directory used by the tests
+tests/integration/*/tmp/*
 tests/integration/buildcmd/scratch
 tests/integration/testdata/buildcmd/Dotnet*/bin
 tests/integration/testdata/buildcmd/Dotnet*/obj
@@ -425,4 +426,4 @@ samcli/lib/init/templates/cookiecutter-aws-sam-hello-java-gradle/**/.gradle/
 mise.toml
 
 # Durable executions
-**/.durable-executions-local/
+**/.durable-executions-local/

Makefile

@@ -87,3 +87,10 @@ update-reproducible-win-reqs:
 
 
 update-reproducible-reqs: update-reproducible-linux-reqs update-reproducible-mac-reqs
+
+# Update all reproducible requirements using uv (can run from any platform)
+update-reproducible-reqs-uv:
+	@command -v uv >/dev/null 2>&1 || pip install uv
+	uv pip compile setup.py --generate-hashes --output-file requirements/reproducible-linux.txt --python-platform linux --python-version 3.11 --no-cache --no-strip-extras
+	uv pip compile setup.py --generate-hashes --output-file requirements/reproducible-mac.txt --python-platform macos --python-version 3.11 --no-cache --no-strip-extras
+	uv pip compile setup.py --generate-hashes --output-file requirements/reproducible-win.txt --python-platform windows --python-version 3.12 --no-cache --no-strip-extras