Improve update-reproducibles workflow: auto-push for internal PRs, verify for forks (aws#8714)

* update

* nit

* split output

* checkout nightly-builds branch for running nightly tests

Author: roger-zhangg

.github/workflows/integration-tests.yml

@@ -79,10 +79,27 @@ jobs:
           - tier1-finch
 
     steps:
+      - name: Determine test type
+        run: |
+          echo "CONTAINER_RUNTIME=${{ matrix.test_suite == 'tier1-finch' && 'finch' || 'docker' }}" >> $GITHUB_ENV
+          if [[ "${{ inputs.install_mode }}" == "nightly-release" ]] || \
+             [[ "${{ github.event.action }}" == "published" && "${{ github.event.release.prerelease }}" == "true" ]]; then
+            echo "TEST_TYPE=nightly-release" >> $GITHUB_ENV
+          elif [[ "${{ inputs.install_mode }}" == "latest-release" ]] || \
+               [[ "${{ github.event.action }}" == "published" && "${{ github.event.release.prerelease }}" != "true" ]]; then
+            echo "TEST_TYPE=latest-release" >> $GITHUB_ENV
+          elif [[ "${{ github.ref }}" == "refs/heads/master" ]]; then
+            echo "TEST_TYPE=master" >> $GITHUB_ENV
+          elif [[ "${{ github.event_name }}" == "schedule" ]] || [[ "${{ github.ref }}" == "refs/heads/develop" ]]; then
+            echo "TEST_TYPE=develop" >> $GITHUB_ENV
+          else
+            echo "TEST_TYPE=other" >> $GITHUB_ENV
+          fi
+
       - name: Checkout code
         uses: actions/checkout@v6
         with:
-          ref: ${{ github.event_name == 'schedule' && 'develop' || github.ref }}
+          ref: ${{ env.TEST_TYPE == 'nightly-release' && 'nightly-builds' || (github.event_name == 'schedule' && 'develop' || github.ref) }}
 
       - name: Free up disk space
         run: bash tests/free_disk_space.sh
@@ -196,23 +213,6 @@ jobs:
         if: "!contains(fromJSON('[\"build-x86-1\", \"build-x86-2\", \"build-x86-container-1\", \"build-x86-container-2\", \"tier1-finch\"]'), matrix.test_suite)"
         run: docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
 
-      - name: Determine test type
-        run: |
-          echo "CONTAINER_RUNTIME=${{ matrix.test_suite == 'tier1-finch' && 'finch' || 'docker' }}" >> $GITHUB_ENV
-          if [[ "${{ inputs.install_mode }}" == "nightly-release" ]] || \
-             [[ "${{ github.event.action }}" == "published" && "${{ github.event.release.prerelease }}" == "true" ]]; then
-            echo "TEST_TYPE=nightly-release" >> $GITHUB_ENV
-          elif [[ "${{ inputs.install_mode }}" == "latest-release" ]] || \
-               [[ "${{ github.event.action }}" == "published" && "${{ github.event.release.prerelease }}" != "true" ]]; then
-            echo "TEST_TYPE=latest-release" >> $GITHUB_ENV
-          elif [[ "${{ github.ref }}" == "refs/heads/master" ]]; then
-            echo "TEST_TYPE=master" >> $GITHUB_ENV
-          elif [[ "${{ github.event_name }}" == "schedule" ]] || [[ "${{ github.ref }}" == "refs/heads/develop" ]]; then
-            echo "TEST_TYPE=develop" >> $GITHUB_ENV
-          else
-            echo "TEST_TYPE=other" >> $GITHUB_ENV
-          fi
-
       - name: Initialize integration test
         if: env.TEST_TYPE == 'develop' || env.TEST_TYPE == 'master' || env.TEST_TYPE == 'other'
         run: |

.github/workflows/update-reproducibles.yml

@@ -10,16 +10,18 @@ on:
       - requirements/reproducible-win.txt
 
 jobs:
+  # For PRs from within the aws/aws-sam-cli repo: auto-update and push
   update-reqs:
     permissions:
       pull-requests: write
       contents: write
-    if: github.repository_owner == 'aws'
+    if: github.repository_owner == 'aws' && github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
         with:
           ref: ${{ github.head_ref }}
+          token: ${{ secrets.GITHUB_TOKEN }}
       - uses: actions/setup-python@v6
         with:
           python-version: "3.11"
@@ -31,7 +33,27 @@ jobs:
         run: |
           git config --global user.email "action@github.com"
           git config --global user.name "GitHub Action"
-          git remote set-url origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}
           git add requirements/reproducible-*.txt
           git commit -m "Update reproducible requirements" || echo "nothing to commit"
-          git push
+          git push
+
+  # For PRs from forks: verify requirements are up to date, fail with instructions if not
+  verify-up-to-date:
+    if: github.repository_owner == 'aws' && github.event.pull_request.head.repo.full_name != github.repository
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+      - name: Check reproducible requirements are up to date
+        run: make update-reproducible-reqs-uv
+      - name: Fail if requirements are out of date
+        run: |
+          if ! git diff --quiet requirements/reproducible-*.txt; then
+            echo "::error::Reproducible requirements are out of date. Please run 'make update-reproducible-reqs-uv' locally and commit the changes before raising a PR."
+            exit 1
+          fi
+          echo "Reproducible requirements are up to date."