diff --git a/.github/actions/configure-release-aws-credentials/action.yml b/.github/actions/configure-release-aws-credentials/action.yml index a02a1e9a4..6a34f6480 100644 --- a/.github/actions/configure-release-aws-credentials/action.yml +++ b/.github/actions/configure-release-aws-credentials/action.yml @@ -23,5 +23,6 @@ runs: aws-region: ${{ inputs.aws-region }} role-to-assume: ${{ inputs.role-to-assume }} role-session-name: ${{ inputs.role-session-name }} - # Short-lived: the job only needs the role briefly to read two secrets. - role-duration-seconds: 300 + # Kept short: the job only needs the role briefly to read two secrets. + # 900s is STS's minimum for assume-role; anything lower is rejected. + role-duration-seconds: 900 diff --git a/.github/workflows/release-runtime-interface-client.yml b/.github/workflows/release-runtime-interface-client.yml index 772b12cae..e41dcfc61 100644 --- a/.github/workflows/release-runtime-interface-client.yml +++ b/.github/workflows/release-runtime-interface-client.yml @@ -40,6 +40,11 @@ env: MAVEN_ARGS: "-B --no-transfer-progress" AWS_REGION: ${{ vars.AWS_REGION_MAVEN_RELEASE }} OIDC_ROLE_ARN: ${{ secrets.AWS_ROLE_MAVEN_RELEASE }} + # ECR pull-through cache used for the native JNI base images. ECR_REGISTRY is + # the login target; BASE_REGISTRY (with the /ecr-public prefix) is passed to + # the Dockerfiles as a build-arg. + ECR_REGISTRY: ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ vars.AWS_REGION_MAVEN_RELEASE }}.amazonaws.com + BASE_REGISTRY: ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ vars.AWS_REGION_MAVEN_RELEASE }}.amazonaws.com/ecr-public jobs: # Build each architecture's native libs (glibc + musl) on a native runner. @@ -79,6 +84,17 @@ jobs: echo "JAVA_HOME=$JAVA_8_HOME" >> "$GITHUB_ENV" echo "$JAVA_8_HOME/bin" >> "$GITHUB_PATH" "$JAVA_8_HOME/bin/java" -version + mkdir -p "$HOME/.m2" + cat > "$HOME/.m2/toolchains.xml" < + + + jdk + 8 + $JAVA_8_HOME + + + EOF # Route all mvn resolution through the CodeArtifact mirror. Must precede # resolve-release-version, which invokes `mvn help:evaluate`. Ambient @@ -92,6 +108,14 @@ jobs: module: ${{ env.MODULE }} release-version-override: ${{ env.RELEASE_VERSION_INPUT }} + # The native JNI build shells out to `docker build` against the ECR + # pull-through cache (see src/main/jni/Dockerfile.*). Authenticate first so + # the base-image pulls don't hit public.ecr.aws. Uses ambient runner creds. + - name: Log in to Amazon ECR (pull-through cache) + run: | + aws ecr get-login-password --region "$AWS_REGION" \ + | docker login --username AWS --password-stdin "$ECR_REGISTRY" + # -DskipTests: only installed so the module compiles, not released here. - name: Install intra-repo dependencies run: | @@ -149,6 +173,17 @@ jobs: echo "JAVA_HOME=$JAVA_8_HOME" >> "$GITHUB_ENV" echo "$JAVA_8_HOME/bin" >> "$GITHUB_PATH" "$JAVA_8_HOME/bin/java" -version + mkdir -p "$HOME/.m2" + cat > "$HOME/.m2/toolchains.xml" < + + + jdk + 8 + $JAVA_8_HOME + + + EOF # Route all mvn resolution through the CodeArtifact mirror. Must precede # resolve-release-version (which invokes `mvn help:evaluate`) and the OIDC @@ -163,6 +198,14 @@ jobs: module: ${{ env.MODULE }} release-version-override: ${{ env.RELEASE_VERSION_INPUT }} + # The native JNI build shells out to `docker build` against the ECR + # pull-through cache (see src/main/jni/Dockerfile.*). Authenticate first so + # the base-image pulls don't hit public.ecr.aws. Uses ambient runner creds. + - name: Log in to Amazon ECR (pull-through cache) + run: | + aws ecr get-login-password --region "$AWS_REGION" \ + | docker login --username AWS --password-stdin "$ECR_REGISTRY" + - name: Resolve next development version and tag run: | # Next development version: use the override, or bump the patch. @@ -200,7 +243,7 @@ jobs: - name: Run tests env: IS_JAVA_8: true - run: mvn test --file "$MODULE/pom.xml" + run: mvn test -DargLineForReflectionTestOnly="" --file "$MODULE/pom.xml" # JARs to attach + .so files for the fat main JAR. - name: Download native artifacts diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b35982cbf..7ff834e56 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -95,6 +95,17 @@ jobs: echo "JAVA_HOME=$JAVA_8_HOME" >> "$GITHUB_ENV" echo "$JAVA_8_HOME/bin" >> "$GITHUB_PATH" "$JAVA_8_HOME/bin/java" -version + mkdir -p "$HOME/.m2" + cat > "$HOME/.m2/toolchains.xml" < + + + jdk + 8 + $JAVA_8_HOME + + + EOF # Route all mvn resolution through the CodeArtifact mirror. Runs before the # OIDC step (which would shadow the runner-role creds this needs) and on diff --git a/aws-lambda-java-runtime-interface-client/src/main/jni/Dockerfile.glibc b/aws-lambda-java-runtime-interface-client/src/main/jni/Dockerfile.glibc index 1cfcfbb1d..7ad20122c 100644 --- a/aws-lambda-java-runtime-interface-client/src/main/jni/Dockerfile.glibc +++ b/aws-lambda-java-runtime-interface-client/src/main/jni/Dockerfile.glibc @@ -1,6 +1,10 @@ -FROM public.ecr.aws/amazonlinux/amazonlinux:2 +ARG BASE_REGISTRY=public.ecr.aws +FROM ${BASE_REGISTRY}/amazonlinux/amazonlinux:2 ARG CURL_VERSION +ARG AWS_REGION + +RUN if [ -n "${AWS_REGION}" ]; then echo "${AWS_REGION}" > /etc/yum/vars/awsregion; fi RUN yum install -y \ cmake3 \ diff --git a/aws-lambda-java-runtime-interface-client/src/main/jni/Dockerfile.musl b/aws-lambda-java-runtime-interface-client/src/main/jni/Dockerfile.musl index 64725c140..5fd7f4882 100644 --- a/aws-lambda-java-runtime-interface-client/src/main/jni/Dockerfile.musl +++ b/aws-lambda-java-runtime-interface-client/src/main/jni/Dockerfile.musl @@ -1,4 +1,5 @@ -FROM public.ecr.aws/docker/library/alpine:3 +ARG BASE_REGISTRY=public.ecr.aws +FROM ${BASE_REGISTRY}/docker/library/alpine:3 ARG CURL_VERSION diff --git a/aws-lambda-java-runtime-interface-client/src/main/jni/build-jni-lib.sh b/aws-lambda-java-runtime-interface-client/src/main/jni/build-jni-lib.sh index b7dbb5a80..44a290b6a 100755 --- a/aws-lambda-java-runtime-interface-client/src/main/jni/build-jni-lib.sh +++ b/aws-lambda-java-runtime-interface-client/src/main/jni/build-jni-lib.sh @@ -9,6 +9,11 @@ MULTI_ARCH=${2} BUILD_OS=${3} BUILD_ARCH=${4} CURL_VERSION=7.83.1 +# Registry hosting the base images. Defaults to public.ecr.aws for local and +# GitHub-hosted builds; the release workflow overrides it with the ECR +# pull-through cache so egress-locked runners don't hit public.ecr.aws. +BASE_REGISTRY="${BASE_REGISTRY:-public.ecr.aws}" +AWS_REGION="${AWS_REGION:-${AWS_DEFAULT_REGION:-}}" function get_docker_platform() { arch=$1 @@ -45,7 +50,7 @@ function build_for_libc_arch() { if [[ "${MULTI_ARCH}" == "true" ]]; then docker build --platform="${docker_platform}" -f "${SRC_DIR}/Dockerfile.${libc_impl}" \ - --build-arg CURL_VERSION=${CURL_VERSION} "${SRC_DIR}" -o - \ + --build-arg CURL_VERSION=${CURL_VERSION} --build-arg BASE_REGISTRY=${BASE_REGISTRY} --build-arg AWS_REGION=${AWS_REGION} "${SRC_DIR}" -o - \ | tar -xOf - src/aws-lambda-runtime-interface-client.so > "${artifact}" else echo "multi-arch not requested, assuming this is a workaround to goofyness when docker buildx is enabled on Linux CI environments." @@ -63,7 +68,7 @@ function build_for_libc_arch() { docker build --platform="${docker_platform}" \ -t "${image_name}" \ -f "${SRC_DIR}/Dockerfile.${libc_impl}" \ - --build-arg CURL_VERSION=${CURL_VERSION} "${SRC_DIR}" ${EXTRA_LOAD_ARG} + --build-arg CURL_VERSION=${CURL_VERSION} --build-arg BASE_REGISTRY=${BASE_REGISTRY} --build-arg AWS_REGION=${AWS_REGION} "${SRC_DIR}" ${EXTRA_LOAD_ARG} echo "Docker image has been successfully built" diff --git a/aws-lambda-java-runtime-interface-client/src/test/java/com/amazonaws/services/lambda/crac/DNSCacheManagerTest.java b/aws-lambda-java-runtime-interface-client/src/test/java/com/amazonaws/services/lambda/crac/DNSCacheManagerTest.java index 5eb6f749f..721b27059 100644 --- a/aws-lambda-java-runtime-interface-client/src/test/java/com/amazonaws/services/lambda/crac/DNSCacheManagerTest.java +++ b/aws-lambda-java-runtime-interface-client/src/test/java/com/amazonaws/services/lambda/crac/DNSCacheManagerTest.java @@ -69,7 +69,7 @@ public void positiveDnsCacheShouldBeEmpty() throws CheckpointException, RestoreE StatefulResource resource = new StatefulResource(); Core.getGlobalContext().register(resource); - String[] hosts = {"www.stackoverflow.com", "www.amazon.com", "www.yahoo.com"}; + String[] hosts = {"github.com", "amazonaws.com"}; for(String singleHost : hosts) { InetAddress address = InetAddress.getByName(singleHost); }