chore(agentcore-harness): correct managed memory ARN in Terraform role policy #3947
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: PR | |
| on: | |
| pull_request: | |
| branches: [main] | |
| env: | |
| CI: "true" | |
| NX_DAEMON: "true" | |
| # Smithy projects resolve the Smithy CLI through mise, which reads release | |
| # metadata from the GitHub API. Unauthenticated requests share a per-IP rate | |
| # limit that a runner exhausts, failing the install with a 403 — so give mise | |
| # the token every job already has. | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| pull-requests: write | |
| issues: write | |
| statuses: write | |
| checks: write | |
| contents: write | |
| actions: read | |
| pages: write | |
| id-token: write | |
| jobs: | |
| package: | |
| name: Package | |
| runs-on: codebuild-nx-plugin-for-aws-runner-${{ github.run_id }}-${{ github.run_attempt }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| fetch-depth: 0 | |
| - uses: ./.github/actions/init-monorepo | |
| with: | |
| aws-docker-login-role-arn: ${{ secrets.AWS_DOCKER_LOGIN_ROLE_ARN }} | |
| setup-bun: "false" | |
| setup-terraform: "false" | |
| - name: Package plugins | |
| run: pnpm package:all --output-style=stream | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: build-artifact | |
| path: dist | |
| build: | |
| name: Build | |
| runs-on: codebuild-nx-plugin-for-aws-runner-${{ github.run_id }}-${{ github.run_attempt }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| fetch-depth: 0 | |
| - uses: ./.github/actions/init-monorepo | |
| with: | |
| aws-docker-login-role-arn: ${{ secrets.AWS_DOCKER_LOGIN_ROLE_ARN }} | |
| container-tools: "false" | |
| setup-bun: "false" | |
| setup-terraform: "false" | |
| - name: Lint | |
| run: pnpm nx run-many --target lint --all --output-style=stream | |
| - name: Docs Unit Tests | |
| run: pnpm nx run docs:test --output-style=stream | |
| - name: Build docs | |
| run: pnpm nx run docs:build --output-style=stream | |
| - name: Check for mutations | |
| run: git diff --ignore-space-at-eol --exit-code -- ':!**/LICENSE-THIRD-PARTY' | |
| unit_tests: | |
| name: Unit Tests - ${{ matrix.shard }} | |
| runs-on: codebuild-nx-plugin-for-aws-runner-${{ github.run_id }}-${{ github.run_attempt }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| shard: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| fetch-depth: 0 | |
| - uses: ./.github/actions/init-monorepo | |
| with: | |
| aws-docker-login-role-arn: ${{ secrets.AWS_DOCKER_LOGIN_ROLE_ARN }} | |
| container-tools: "false" | |
| setup-bun: "false" | |
| setup-terraform: "false" | |
| - name: Unit Tests (shard ${{ matrix.shard }}/10) | |
| run: pnpm nx run @aws/nx-plugin:test --output-style=stream --shard=${{ matrix.shard }}/10 | |
| - name: Upload coverage reports to Codecov | |
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7 | |
| with: | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| smoke_tests: | |
| name: Smoke Tests - ${{matrix.smoke_test}} | |
| runs-on: codebuild-nx-plugin-for-aws-runner-${{ github.run_id }}-${{ github.run_attempt }} | |
| needs: package | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| smoke_test: | |
| - npm | |
| - yarn-classic | |
| - yarn-4 | |
| - pnpm-10 | |
| - pnpm-11 | |
| - bun | |
| - create-workspace | |
| - dungeon-adventure | |
| - terraform | |
| - rdb | |
| - trpc-api | |
| - fast-api | |
| - smithy-api | |
| - react-website | |
| - infra-none | |
| - existing-workspace | |
| - idempotency | |
| - license-sync | |
| - license-check | |
| - mcp-server | |
| - nx-plugin | |
| - test-matrix | |
| - local-dev | |
| - git-secrets | |
| - audit | |
| - finch | |
| - trivy | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Download build artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| name: build-artifact | |
| path: dist | |
| - uses: ./.github/actions/init-monorepo | |
| with: | |
| aws-docker-login-role-arn: ${{ secrets.AWS_DOCKER_LOGIN_ROLE_ARN }} | |
| # local-dev (and other) smoke tests spawn many uv dev servers that | |
| # are killed mid-run; the post-job `uv cache prune` can then hang and | |
| # fail the job even when all tests passed. The cache buys little here. | |
| enable-uv-cache: "false" | |
| - name: Smoke Test - ${{ matrix.smoke_test }} | |
| run: pnpm nx run @aws/nx-plugin-e2e:smoke-test --name=${{ matrix.smoke_test }} | |
| # The migrate smoke test upgrades a workspace generated by each of the last few | |
| # released versions to the local build. Every hop creates a workspace on that | |
| # release, scaffolds the whole test matrix into it, migrates, then syncs and | |
| # builds — so the hops are spread across machines rather than run back to back | |
| # (NX_E2E_SHARD=<index>/<total>). | |
| smoke_tests_migrate: | |
| name: Smoke Tests - migrate (${{matrix.shard}}/5) | |
| runs-on: codebuild-nx-plugin-for-aws-runner-${{ github.run_id }}-${{ github.run_attempt }} | |
| needs: package | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| shard: [1, 2, 3, 4, 5] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Download build artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| name: build-artifact | |
| path: dist | |
| - uses: ./.github/actions/init-monorepo | |
| with: | |
| aws-docker-login-role-arn: ${{ secrets.AWS_DOCKER_LOGIN_ROLE_ARN }} | |
| enable-uv-cache: "false" | |
| - name: Smoke Test - migrate (shard ${{ matrix.shard }}/5) | |
| env: | |
| NX_E2E_SHARD: ${{ matrix.shard }}/5 | |
| run: pnpm nx run @aws/nx-plugin-e2e:smoke-test --name=migrate | |
| # The standalone smoke test generates and builds every generator, component and | |
| # connection permutation in its own workspace. Each case's build saturates the | |
| # machine's cores, so cases run sequentially within a shard and parallelism | |
| # comes from sharding across machines (NX_E2E_SHARD=<index>/<total>). | |
| smoke_tests_standalone: | |
| name: Smoke Tests - standalone (${{matrix.shard}}/6) | |
| runs-on: codebuild-nx-plugin-for-aws-runner-${{ github.run_id }}-${{ github.run_attempt }} | |
| needs: package | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| shard: [1, 2, 3, 4, 5, 6] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Download build artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| name: build-artifact | |
| path: dist | |
| - uses: ./.github/actions/init-monorepo | |
| with: | |
| aws-docker-login-role-arn: ${{ secrets.AWS_DOCKER_LOGIN_ROLE_ARN }} | |
| enable-uv-cache: 'false' | |
| - name: Smoke Test - standalone (shard ${{ matrix.shard }}/6) | |
| env: | |
| NX_E2E_SHARD: ${{ matrix.shard }}/6 | |
| run: pnpm nx run @aws/nx-plugin-e2e:smoke-test --name=standalone | |
| smoke_tests_windows: | |
| name: Windows Smoke Tests - ${{matrix.smoke_test}} | |
| runs-on: windows-latest | |
| needs: package | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| smoke_test: | |
| - dungeon-adventure | |
| - git-secrets | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Disable Windows Defender real-time monitoring | |
| shell: pwsh | |
| run: | | |
| # Defender may not be running/ready on the runner; best-effort speed optimization. | |
| try { Set-MpPreference -DisableRealtimeMonitoring $true } catch { } | |
| - name: Download build artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| name: build-artifact | |
| path: dist | |
| - uses: ./.github/actions/init-monorepo | |
| - name: Windows Smoke Test - ${{ matrix.smoke_test }} | |
| run: pnpm nx run @aws/nx-plugin-e2e:smoke-test --name=${{ matrix.smoke_test }} | |
| # Runs on CodeBuild Windows runners. NX_E2E_CODEBUILD_WINDOWS skips the cases | |
| # that runner can't build (see standalone.spec.ts); they stay covered on the | |
| # Linux standalone leg and the windows-latest dungeon-adventure test. | |
| smoke_tests_windows_standalone: | |
| name: Windows Smoke Tests - standalone (${{matrix.shard}}/6) | |
| runs-on: codebuild-nx-plugin-for-aws-windows-runner-${{ github.run_id }}-${{ github.run_attempt }} | |
| needs: package | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| shard: [1, 2, 3, 4, 5, 6] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Disable Windows Defender real-time monitoring | |
| shell: pwsh | |
| run: | | |
| # Not present on every Windows image; best-effort. | |
| try { Set-MpPreference -DisableRealtimeMonitoring $true } catch { } | |
| - name: Download build artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| name: build-artifact | |
| path: dist | |
| - uses: ./.github/actions/init-monorepo | |
| with: | |
| # No Docker on this runner; standalone workspaces use CDK, not Terraform. | |
| container-tools: "false" | |
| setup-bun: "false" | |
| setup-terraform: "false" | |
| # Smithy projects build with the Smithy CLI, which mise cannot install | |
| # on Windows — see .github/actions/init-monorepo. | |
| setup-smithy: "true" | |
| - name: Windows Smoke Test - standalone (shard ${{ matrix.shard }}/6) | |
| env: | |
| NX_E2E_SHARD: ${{ matrix.shard }}/6 | |
| NX_E2E_CODEBUILD_WINDOWS: "true" | |
| run: pnpm nx run @aws/nx-plugin-e2e:smoke-test --name=standalone |