Repository navigation
refactor(plugin): create one plugin instance per invocation #613
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Conformance Tests | |
| # Full-integration conformance run: discovers suites from template_<suite>.yaml, | |
| # builds the Python handlers against the local monorepo SDK, and runs each suite | |
| # as its own parallel matrix job with the pinned language-agnostic runner. | |
| on: | |
| push: | |
| branches: ["main"] | |
| pull_request: | |
| branches: ["main"] | |
| paths: | |
| - "packages/aws-durable-execution-sdk-python/**" | |
| - "packages/aws-durable-execution-sdk-python-conformance-tests/**" | |
| - ".github/workflows/conformance-tests.yml" | |
| workflow_dispatch: | |
| inputs: | |
| region: | |
| description: "AWS Region for deploying and running conformance tests" | |
| required: false | |
| default: us-west-2 | |
| type: string | |
| env: | |
| AWS_REGION: ${{ github.event.inputs.region || 'us-west-2' }} | |
| concurrency: | |
| # Global lock: every branch/PR deploys to the same per-suite stacks | |
| # (conf-py-<suite>), so only one conformance run may execute at a time | |
| # across the whole repo. Queue rather than cancel: aborting a mid-deploy | |
| # run can leave a CloudFormation update in progress that breaks the next | |
| # run against the shared stack. | |
| group: conformance-tests-global | |
| cancel-in-progress: false | |
| queue: max | |
| permissions: | |
| contents: read | |
| jobs: | |
| discover_suites: | |
| name: discover conformance suites | |
| # 1. Run for non-PR events, such as scheduled runs and manual invocations | |
| # 2. For PRs, run only same-repo branches from non-Dependabot actors; forked PRs or Dependabot should not access secrets. | |
| if: github.event_name != 'pull_request' || (github.actor != 'dependabot[bot]' && github.event.pull_request.head.repo.full_name == github.repository) | |
| # CodeBuild-hosted runner in the Python testing account (Lambda compute, | |
| # Amazon Linux python3.13 image). Fork PRs are already excluded by the `if:` | |
| # above, so the plain label is safe here. The label must match the CodeBuild | |
| # project name exactly. | |
| runs-on: | |
| - codebuild-github-actions-runner-${{ github.run_id }}-${{ github.run_attempt }} | |
| outputs: | |
| suites: ${{ steps.discover.outputs.suites }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Discover suites from templates | |
| id: discover | |
| working-directory: packages/aws-durable-execution-sdk-python-conformance-tests | |
| run: echo "suites=$(python3 scripts/discover_suites.py)" >> "$GITHUB_OUTPUT" | |
| conformance: | |
| name: conformance (${{ matrix.suite }}) | |
| needs: discover_suites | |
| # CodeBuild-hosted runner in the Python testing account (Lambda compute, | |
| # Amazon Linux python3.13 image). Each matrix entry gets its own runner; the | |
| # discover_suites gate already excludes fork PRs, so the plain label is safe. | |
| runs-on: | |
| - codebuild-github-actions-runner-${{ github.run_id }}-${{ github.run_attempt }} | |
| permissions: | |
| contents: read | |
| id-token: write # Required for AWS OIDC credentials | |
| env: | |
| # The runner image ships /etc/pip.conf with `[global] target = | |
| # /tmp/opt/python/site-packages` on PYTHONPATH; ignore both so the uv venv | |
| # and the conformance runner install stay isolated. | |
| PIP_CONFIG_FILE: /dev/null | |
| PYTHONPATH: "" | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| suite: ${{ fromJSON(needs.discover_suites.outputs.suites) }} | |
| defaults: | |
| run: | |
| working-directory: packages/aws-durable-execution-sdk-python-conformance-tests | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Setup Python | |
| # The runner image is Amazon Linux; actions/setup-python only ships Ubuntu | |
| # builds, so uv provides the Python 3.14 interpreter and activates a venv. | |
| uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 | |
| with: | |
| python-version: "3.14" | |
| activate-environment: true | |
| - name: Configure AWS credentials | |
| uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 | |
| with: | |
| role-to-assume: "${{ secrets.TEST_ROLE_ARN }}" | |
| role-session-name: pythonConformanceTest | |
| aws-region: ${{ env.AWS_REGION }} | |
| - name: Verify AWS test account | |
| env: | |
| TEST_ACCOUNT_ID: ${{ secrets.TEST_ACCOUNT_ID }} | |
| run: | | |
| ACTUAL_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text) | |
| if [ "$ACTUAL_ACCOUNT_ID" != "$TEST_ACCOUNT_ID" ]; then | |
| echo "Expected AWS account $TEST_ACCOUNT_ID but assumed into $ACTUAL_ACCOUNT_ID" | |
| exit 1 | |
| fi | |
| echo "Using AWS test account $ACTUAL_ACCOUNT_ID" | |
| - name: Setup SAM CLI | |
| uses: aws-actions/setup-sam@89ddb14d60e682855e3fea4be85b3c56485de310 # v3 | |
| - name: Build conformance handlers | |
| run: python3 scripts/build_examples.py | |
| - name: Install conformance runner | |
| run: uv pip install "git+https://github.com/aws/aws-durable-execution-conformance-tests.git@main#subdirectory=packages/aws-durable-execution-conformance-tests" | |
| - name: Inject Lambda execution role into template | |
| env: | |
| ROLE_ARN: ${{ secrets.TEST_LAMBDA_EXECUTION_ROLE_ARN }} | |
| run: | | |
| if [ -z "$ROLE_ARN" ]; then | |
| echo "TEST_LAMBDA_EXECUTION_ROLE_ARN not set; template will create its own role." | |
| exit 0 | |
| fi | |
| python3 scripts/inject_execution_role.py \ | |
| --template template_${{ matrix.suite }}.yaml \ | |
| --role-arn "$ROLE_ARN" | |
| - name: Compute stack-safe suite slug | |
| run: | | |
| # CloudFormation stack names allow only [a-zA-Z][-a-zA-Z0-9]*; | |
| # suite names like wait_for_callback contain underscores. | |
| echo "SUITE_SLUG=$(echo '${{ matrix.suite }}' | tr '_' '-')" >> "$GITHUB_ENV" | |
| - name: Run conformance suite | |
| run: | | |
| # Stable per-suite stack name (no run id): every workflow run updates | |
| # the same stack, and --no-cleanup leaves it deployed afterwards so | |
| # failures can be inspected in the account. The next run's sam deploy | |
| # updates the stack in place. | |
| python -m aws_durable_execution_conformance_tests.app \ | |
| --template template_${{ matrix.suite }}.yaml \ | |
| --language python \ | |
| --suite ${{ matrix.suite }} \ | |
| --name conf-py-${SUITE_SLUG} \ | |
| --no-cleanup \ | |
| --region ${{ env.AWS_REGION }} \ | |
| --history-dir history-${{ matrix.suite }} \ | |
| --report junit \ | |
| --report-file report-${{ matrix.suite }} | |
| - name: Upload conformance report | |
| if: always() | |
| uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 | |
| with: | |
| name: conformance-report-${{ matrix.suite }} | |
| path: | | |
| packages/aws-durable-execution-sdk-python-conformance-tests/report-${{ matrix.suite }}.xml | |
| packages/aws-durable-execution-sdk-python-conformance-tests/history-${{ matrix.suite }}/ | |
| if-no-files-found: warn |