From 9bdcd398103ff8fb34b3190d23da004951542380 Mon Sep 17 00:00:00 2001 From: Fabiana Severin Date: Fri, 14 Aug 2026 14:09:13 +0100 Subject: [PATCH 01/17] fix(ci): write JDK 8 toolchains.xml for release builds --- .../release-runtime-interface-client.yml | 22 +++++++++++++++++++ .github/workflows/release.yml | 11 ++++++++++ 2 files changed, 33 insertions(+) diff --git a/.github/workflows/release-runtime-interface-client.yml b/.github/workflows/release-runtime-interface-client.yml index 772b12ca..f08e5ae5 100644 --- a/.github/workflows/release-runtime-interface-client.yml +++ b/.github/workflows/release-runtime-interface-client.yml @@ -79,6 +79,17 @@ jobs: echo "JAVA_HOME=$JAVA_8_HOME" >> "$GITHUB_ENV" echo "$JAVA_8_HOME/bin" >> "$GITHUB_PATH" "$JAVA_8_HOME/bin/java" -version + mkdir -p "$HOME/.m2" + cat > "$HOME/.m2/toolchains.xml" < + + + jdk + 8 + $JAVA_8_HOME + + + EOF # Route all mvn resolution through the CodeArtifact mirror. Must precede # resolve-release-version, which invokes `mvn help:evaluate`. Ambient @@ -149,6 +160,17 @@ jobs: echo "JAVA_HOME=$JAVA_8_HOME" >> "$GITHUB_ENV" echo "$JAVA_8_HOME/bin" >> "$GITHUB_PATH" "$JAVA_8_HOME/bin/java" -version + mkdir -p "$HOME/.m2" + cat > "$HOME/.m2/toolchains.xml" < + + + jdk + 8 + $JAVA_8_HOME + + + EOF # Route all mvn resolution through the CodeArtifact mirror. Must precede # resolve-release-version (which invokes `mvn help:evaluate`) and the OIDC diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b35982cb..7ff834e5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -95,6 +95,17 @@ jobs: echo "JAVA_HOME=$JAVA_8_HOME" >> "$GITHUB_ENV" echo "$JAVA_8_HOME/bin" >> "$GITHUB_PATH" "$JAVA_8_HOME/bin/java" -version + mkdir -p "$HOME/.m2" + cat > "$HOME/.m2/toolchains.xml" < + + + jdk + 8 + $JAVA_8_HOME + + + EOF # Route all mvn resolution through the CodeArtifact mirror. Runs before the # OIDC step (which would shadow the runner-role creds this needs) and on From defc14b93ab939d4377c78f75535ba76bcc0906e Mon Sep 17 00:00:00 2001 From: Davide Melfi Date: Fri, 14 Aug 2026 14:51:00 +0100 Subject: [PATCH 02/17] chore: test fixing --- .github/workflows/release-runtime-interface-client.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release-runtime-interface-client.yml b/.github/workflows/release-runtime-interface-client.yml index f08e5ae5..3792d582 100644 --- a/.github/workflows/release-runtime-interface-client.yml +++ b/.github/workflows/release-runtime-interface-client.yml @@ -86,7 +86,7 @@ jobs: jdk 8 - $JAVA_8_HOME + $JAVA_HOME EOF @@ -167,7 +167,7 @@ jobs: jdk 8 - $JAVA_8_HOME + $JAVA_HOME EOF From e638ff92d1ab6faf1417d2a53fae09a584a51a75 Mon Sep 17 00:00:00 2001 From: Fabiana Severin Date: Fri, 14 Aug 2026 15:06:45 +0100 Subject: [PATCH 03/17] commenting out main branch requirement for testing --- .../release-runtime-interface-client.yml | 18 +++++++++--------- .github/workflows/release.yml | 12 ++++++------ 2 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/workflows/release-runtime-interface-client.yml b/.github/workflows/release-runtime-interface-client.yml index 3792d582..ed8865b9 100644 --- a/.github/workflows/release-runtime-interface-client.yml +++ b/.github/workflows/release-runtime-interface-client.yml @@ -57,15 +57,15 @@ jobs: runs-on: ${{ matrix.runner }} timeout-minutes: 45 steps: - # Manual (workflow_dispatch) releases must only run from main, never from - # an arbitrary branch that could carry unreviewed release logic. Guarding - # the first job blocks the whole pipeline (release needs build-natives). - - name: Verify release branch - run: | - if [[ "$GITHUB_REF_NAME" != "main" ]]; then - echo "::error::Releases must run from the main branch, got '$GITHUB_REF_NAME'" - exit 1 - fi + # # Manual (workflow_dispatch) releases must only run from main, never from + # # an arbitrary branch that could carry unreviewed release logic. Guarding + # # the first job blocks the whole pipeline (release needs build-natives). + # - name: Verify release branch + # run: | + # if [[ "$GITHUB_REF_NAME" != "main" ]]; then + # echo "::error::Releases must run from the main branch, got '$GITHUB_REF_NAME'" + # exit 1 + # fi - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7ff834e5..dc446f7f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -74,12 +74,12 @@ jobs: steps: # Manual (workflow_dispatch) releases must only run from main, never from # an arbitrary branch that could carry unreviewed release logic. - - name: Verify release branch - run: | - if [[ "$GITHUB_REF_NAME" != "main" ]]; then - echo "::error::Releases must run from the main branch, got '$GITHUB_REF_NAME'" - exit 1 - fi + # - name: Verify release branch + # run: | + # if [[ "$GITHUB_REF_NAME" != "main" ]]; then + # echo "::error::Releases must run from the main branch, got '$GITHUB_REF_NAME'" + # exit 1 + # fi - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 with: From a035af9c6cb3935015be4e1ca30c2fd767e175ef Mon Sep 17 00:00:00 2001 From: Fabiana Severin Date: Fri, 14 Aug 2026 16:19:28 +0100 Subject: [PATCH 04/17] ci(ric): pull JNI base images via ECR pull-through cache --- .../release-runtime-interface-client.yml | 21 +++++++++++++++++++ .../src/main/jni/Dockerfile.glibc | 3 ++- .../src/main/jni/Dockerfile.musl | 3 ++- .../src/main/jni/build-jni-lib.sh | 8 +++++-- 4 files changed, 31 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release-runtime-interface-client.yml b/.github/workflows/release-runtime-interface-client.yml index ed8865b9..b5122f31 100644 --- a/.github/workflows/release-runtime-interface-client.yml +++ b/.github/workflows/release-runtime-interface-client.yml @@ -40,6 +40,11 @@ env: MAVEN_ARGS: "-B --no-transfer-progress" AWS_REGION: ${{ vars.AWS_REGION_MAVEN_RELEASE }} OIDC_ROLE_ARN: ${{ secrets.AWS_ROLE_MAVEN_RELEASE }} + # ECR pull-through cache used for the native JNI base images. ECR_REGISTRY is + # the login target; BASE_REGISTRY (with the /ecr-public prefix) is passed to + # the Dockerfiles as a build-arg. + ECR_REGISTRY: ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ vars.AWS_REGION_MAVEN_RELEASE }}.amazonaws.com + BASE_REGISTRY: ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ vars.AWS_REGION_MAVEN_RELEASE }}.amazonaws.com/ecr-public jobs: # Build each architecture's native libs (glibc + musl) on a native runner. @@ -103,6 +108,14 @@ jobs: module: ${{ env.MODULE }} release-version-override: ${{ env.RELEASE_VERSION_INPUT }} + # The native JNI build shells out to `docker build` against the ECR + # pull-through cache (see src/main/jni/Dockerfile.*). Authenticate first so + # the base-image pulls don't hit public.ecr.aws. Uses ambient runner creds. + - name: Log in to Amazon ECR (pull-through cache) + run: | + aws ecr get-login-password --region "$AWS_REGION" \ + | docker login --username AWS --password-stdin "$ECR_REGISTRY" + # -DskipTests: only installed so the module compiles, not released here. - name: Install intra-repo dependencies run: | @@ -185,6 +198,14 @@ jobs: module: ${{ env.MODULE }} release-version-override: ${{ env.RELEASE_VERSION_INPUT }} + # The native JNI build shells out to `docker build` against the ECR + # pull-through cache (see src/main/jni/Dockerfile.*). Authenticate first so + # the base-image pulls don't hit public.ecr.aws. Uses ambient runner creds. + - name: Log in to Amazon ECR (pull-through cache) + run: | + aws ecr get-login-password --region "$AWS_REGION" \ + | docker login --username AWS --password-stdin "$ECR_REGISTRY" + - name: Resolve next development version and tag run: | # Next development version: use the override, or bump the patch. diff --git a/aws-lambda-java-runtime-interface-client/src/main/jni/Dockerfile.glibc b/aws-lambda-java-runtime-interface-client/src/main/jni/Dockerfile.glibc index 1cfcfbb1..a8adb18e 100644 --- a/aws-lambda-java-runtime-interface-client/src/main/jni/Dockerfile.glibc +++ b/aws-lambda-java-runtime-interface-client/src/main/jni/Dockerfile.glibc @@ -1,4 +1,5 @@ -FROM public.ecr.aws/amazonlinux/amazonlinux:2 +ARG BASE_REGISTRY=public.ecr.aws +FROM ${BASE_REGISTRY}/amazonlinux/amazonlinux:2 ARG CURL_VERSION diff --git a/aws-lambda-java-runtime-interface-client/src/main/jni/Dockerfile.musl b/aws-lambda-java-runtime-interface-client/src/main/jni/Dockerfile.musl index 64725c14..5fd7f488 100644 --- a/aws-lambda-java-runtime-interface-client/src/main/jni/Dockerfile.musl +++ b/aws-lambda-java-runtime-interface-client/src/main/jni/Dockerfile.musl @@ -1,4 +1,5 @@ -FROM public.ecr.aws/docker/library/alpine:3 +ARG BASE_REGISTRY=public.ecr.aws +FROM ${BASE_REGISTRY}/docker/library/alpine:3 ARG CURL_VERSION diff --git a/aws-lambda-java-runtime-interface-client/src/main/jni/build-jni-lib.sh b/aws-lambda-java-runtime-interface-client/src/main/jni/build-jni-lib.sh index b7dbb5a8..69b9a512 100755 --- a/aws-lambda-java-runtime-interface-client/src/main/jni/build-jni-lib.sh +++ b/aws-lambda-java-runtime-interface-client/src/main/jni/build-jni-lib.sh @@ -9,6 +9,10 @@ MULTI_ARCH=${2} BUILD_OS=${3} BUILD_ARCH=${4} CURL_VERSION=7.83.1 +# Registry hosting the base images. Defaults to public.ecr.aws for local and +# GitHub-hosted builds; the release workflow overrides it with the ECR +# pull-through cache so egress-locked runners don't hit public.ecr.aws. +BASE_REGISTRY="${BASE_REGISTRY:-public.ecr.aws}" function get_docker_platform() { arch=$1 @@ -45,7 +49,7 @@ function build_for_libc_arch() { if [[ "${MULTI_ARCH}" == "true" ]]; then docker build --platform="${docker_platform}" -f "${SRC_DIR}/Dockerfile.${libc_impl}" \ - --build-arg CURL_VERSION=${CURL_VERSION} "${SRC_DIR}" -o - \ + --build-arg CURL_VERSION=${CURL_VERSION} --build-arg BASE_REGISTRY=${BASE_REGISTRY} "${SRC_DIR}" -o - \ | tar -xOf - src/aws-lambda-runtime-interface-client.so > "${artifact}" else echo "multi-arch not requested, assuming this is a workaround to goofyness when docker buildx is enabled on Linux CI environments." @@ -63,7 +67,7 @@ function build_for_libc_arch() { docker build --platform="${docker_platform}" \ -t "${image_name}" \ -f "${SRC_DIR}/Dockerfile.${libc_impl}" \ - --build-arg CURL_VERSION=${CURL_VERSION} "${SRC_DIR}" ${EXTRA_LOAD_ARG} + --build-arg CURL_VERSION=${CURL_VERSION} --build-arg BASE_REGISTRY=${BASE_REGISTRY} "${SRC_DIR}" ${EXTRA_LOAD_ARG} echo "Docker image has been successfully built" From 00e7ed523c380a4187b4ff03d23345217b7f9b71 Mon Sep 17 00:00:00 2001 From: Maxime David Date: Fri, 14 Aug 2026 15:34:13 +0000 Subject: [PATCH 05/17] fix: set AWS_REGION --- .../src/main/jni/Dockerfile.glibc | 3 +++ .../src/main/jni/build-jni-lib.sh | 5 +++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/aws-lambda-java-runtime-interface-client/src/main/jni/Dockerfile.glibc b/aws-lambda-java-runtime-interface-client/src/main/jni/Dockerfile.glibc index a8adb18e..7ad20122 100644 --- a/aws-lambda-java-runtime-interface-client/src/main/jni/Dockerfile.glibc +++ b/aws-lambda-java-runtime-interface-client/src/main/jni/Dockerfile.glibc @@ -2,6 +2,9 @@ ARG BASE_REGISTRY=public.ecr.aws FROM ${BASE_REGISTRY}/amazonlinux/amazonlinux:2 ARG CURL_VERSION +ARG AWS_REGION + +RUN if [ -n "${AWS_REGION}" ]; then echo "${AWS_REGION}" > /etc/yum/vars/awsregion; fi RUN yum install -y \ cmake3 \ diff --git a/aws-lambda-java-runtime-interface-client/src/main/jni/build-jni-lib.sh b/aws-lambda-java-runtime-interface-client/src/main/jni/build-jni-lib.sh index 69b9a512..44a290b6 100755 --- a/aws-lambda-java-runtime-interface-client/src/main/jni/build-jni-lib.sh +++ b/aws-lambda-java-runtime-interface-client/src/main/jni/build-jni-lib.sh @@ -13,6 +13,7 @@ CURL_VERSION=7.83.1 # GitHub-hosted builds; the release workflow overrides it with the ECR # pull-through cache so egress-locked runners don't hit public.ecr.aws. BASE_REGISTRY="${BASE_REGISTRY:-public.ecr.aws}" +AWS_REGION="${AWS_REGION:-${AWS_DEFAULT_REGION:-}}" function get_docker_platform() { arch=$1 @@ -49,7 +50,7 @@ function build_for_libc_arch() { if [[ "${MULTI_ARCH}" == "true" ]]; then docker build --platform="${docker_platform}" -f "${SRC_DIR}/Dockerfile.${libc_impl}" \ - --build-arg CURL_VERSION=${CURL_VERSION} --build-arg BASE_REGISTRY=${BASE_REGISTRY} "${SRC_DIR}" -o - \ + --build-arg CURL_VERSION=${CURL_VERSION} --build-arg BASE_REGISTRY=${BASE_REGISTRY} --build-arg AWS_REGION=${AWS_REGION} "${SRC_DIR}" -o - \ | tar -xOf - src/aws-lambda-runtime-interface-client.so > "${artifact}" else echo "multi-arch not requested, assuming this is a workaround to goofyness when docker buildx is enabled on Linux CI environments." @@ -67,7 +68,7 @@ function build_for_libc_arch() { docker build --platform="${docker_platform}" \ -t "${image_name}" \ -f "${SRC_DIR}/Dockerfile.${libc_impl}" \ - --build-arg CURL_VERSION=${CURL_VERSION} --build-arg BASE_REGISTRY=${BASE_REGISTRY} "${SRC_DIR}" ${EXTRA_LOAD_ARG} + --build-arg CURL_VERSION=${CURL_VERSION} --build-arg BASE_REGISTRY=${BASE_REGISTRY} --build-arg AWS_REGION=${AWS_REGION} "${SRC_DIR}" ${EXTRA_LOAD_ARG} echo "Docker image has been successfully built" From c5c8805eb847870f98325c6bc8469eb04d2f180f Mon Sep 17 00:00:00 2001 From: Fabiana Severin Date: Fri, 14 Aug 2026 16:57:20 +0100 Subject: [PATCH 06/17] ci(ric): temporarily disable musl builds for testing --- .../workflows/release-runtime-interface-client.yml | 4 ++-- aws-lambda-java-runtime-interface-client/pom.xml | 13 +++---------- .../src/main/jni/build-jni-lib.sh | 4 +++- 3 files changed, 8 insertions(+), 13 deletions(-) diff --git a/.github/workflows/release-runtime-interface-client.yml b/.github/workflows/release-runtime-interface-client.yml index b5122f31..c0ba2d84 100644 --- a/.github/workflows/release-runtime-interface-client.yml +++ b/.github/workflows/release-runtime-interface-client.yml @@ -55,10 +55,10 @@ jobs: include: - arch: x86_64 runner: codebuild-aws-lambda-java-libs-test-trigger-x86-${{ github.run_id }}-${{ github.run_attempt }} - profiles: linux-x86_64 linux_musl-x86_64 + profiles: linux-x86_64 - arch: aarch64 runner: codebuild-aws-lambda-java-libs-test-trigger-arm64-${{ github.run_id }}-${{ github.run_attempt }} - profiles: linux-aarch64 linux_musl-aarch64 + profiles: linux-aarch64 runs-on: ${{ matrix.runner }} timeout-minutes: 45 steps: diff --git a/aws-lambda-java-runtime-interface-client/pom.xml b/aws-lambda-java-runtime-interface-client/pom.xml index 6db41aa3..c76f3761 100644 --- a/aws-lambda-java-runtime-interface-client/pom.xml +++ b/aws-lambda-java-runtime-interface-client/pom.xml @@ -442,16 +442,9 @@ jar linux-aarch_64 - - ${project.build.directory}/${project.build.finalName}-linux_musl-x86_64.jar - jar - linux_musl-x86_64 - - - ${project.build.directory}/${project.build.finalName}-linux_musl-aarch_64.jar - jar - linux_musl-aarch_64 - + diff --git a/aws-lambda-java-runtime-interface-client/src/main/jni/build-jni-lib.sh b/aws-lambda-java-runtime-interface-client/src/main/jni/build-jni-lib.sh index 44a290b6..82e49d56 100755 --- a/aws-lambda-java-runtime-interface-client/src/main/jni/build-jni-lib.sh +++ b/aws-lambda-java-runtime-interface-client/src/main/jni/build-jni-lib.sh @@ -116,7 +116,9 @@ if [ -n "$BUILD_OS" ] && [ -n "$BUILD_ARCH" ]; then else # build for all architectures and libc implementations declare -a ARCHITECTURES=("x86_64" "aarch_64") - declare -a LIBC_IMPLS=("glibc" "musl") + # musl (Alpine) temporarily disabled for testing: the egress-locked release + # runner can't reach the Alpine apk mirrors. Re-add "musl" once that's solved. + declare -a LIBC_IMPLS=("glibc") for arch in "${ARCHITECTURES[@]}"; do From 25a85f5a554b6a648ace6f6cfd711c86988c0bd9 Mon Sep 17 00:00:00 2001 From: Maxime David Date: Fri, 14 Aug 2026 16:42:00 +0000 Subject: [PATCH 07/17] fix: fix egress test --- .../com/amazonaws/services/lambda/crac/DNSCacheManagerTest.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/aws-lambda-java-runtime-interface-client/src/test/java/com/amazonaws/services/lambda/crac/DNSCacheManagerTest.java b/aws-lambda-java-runtime-interface-client/src/test/java/com/amazonaws/services/lambda/crac/DNSCacheManagerTest.java index 5eb6f749..721b2705 100644 --- a/aws-lambda-java-runtime-interface-client/src/test/java/com/amazonaws/services/lambda/crac/DNSCacheManagerTest.java +++ b/aws-lambda-java-runtime-interface-client/src/test/java/com/amazonaws/services/lambda/crac/DNSCacheManagerTest.java @@ -69,7 +69,7 @@ public void positiveDnsCacheShouldBeEmpty() throws CheckpointException, RestoreE StatefulResource resource = new StatefulResource(); Core.getGlobalContext().register(resource); - String[] hosts = {"www.stackoverflow.com", "www.amazon.com", "www.yahoo.com"}; + String[] hosts = {"github.com", "amazonaws.com"}; for(String singleHost : hosts) { InetAddress address = InetAddress.getByName(singleHost); } From c6defea2abcfe8de07a49c63dc315718a8361471 Mon Sep 17 00:00:00 2001 From: Maxime David Date: Fri, 14 Aug 2026 16:56:21 +0000 Subject: [PATCH 08/17] fix: remove breaking test (test only) --- .../runtime/api/client/ClasspathLoaderTest.java | 14 -------------- 1 file changed, 14 deletions(-) diff --git a/aws-lambda-java-runtime-interface-client/src/test/java/com/amazonaws/services/lambda/runtime/api/client/ClasspathLoaderTest.java b/aws-lambda-java-runtime-interface-client/src/test/java/com/amazonaws/services/lambda/runtime/api/client/ClasspathLoaderTest.java index 38147d21..49ffa59d 100644 --- a/aws-lambda-java-runtime-interface-client/src/test/java/com/amazonaws/services/lambda/runtime/api/client/ClasspathLoaderTest.java +++ b/aws-lambda-java-runtime-interface-client/src/test/java/com/amazonaws/services/lambda/runtime/api/client/ClasspathLoaderTest.java @@ -35,20 +35,6 @@ void testLoadAllClassesWithNoClasspath() throws IOException { } } - @Test - void testLoadAllClassesWithEmptyClasspath() { - String originalClasspath = System.getProperty("java.class.path"); - try { - System.setProperty("java.class.path", ""); - assertThrows(FileNotFoundException.class, () -> - ClasspathLoader.main(new String[]{})); - } finally { - if (originalClasspath != null) { - System.setProperty("java.class.path", originalClasspath); - } - } - } - @Test void testLoadAllClassesWithInvalidPath() { String originalClasspath = System.getProperty("java.class.path"); From c583fae2ec7f6aead477055c9bf84f68cac95fd2 Mon Sep 17 00:00:00 2001 From: Maxime David Date: Fri, 14 Aug 2026 16:57:17 +0000 Subject: [PATCH 09/17] Revert "fix: remove breaking test (test only)" This reverts commit c6defea2abcfe8de07a49c63dc315718a8361471. --- .../runtime/api/client/ClasspathLoaderTest.java | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/aws-lambda-java-runtime-interface-client/src/test/java/com/amazonaws/services/lambda/runtime/api/client/ClasspathLoaderTest.java b/aws-lambda-java-runtime-interface-client/src/test/java/com/amazonaws/services/lambda/runtime/api/client/ClasspathLoaderTest.java index 49ffa59d..38147d21 100644 --- a/aws-lambda-java-runtime-interface-client/src/test/java/com/amazonaws/services/lambda/runtime/api/client/ClasspathLoaderTest.java +++ b/aws-lambda-java-runtime-interface-client/src/test/java/com/amazonaws/services/lambda/runtime/api/client/ClasspathLoaderTest.java @@ -35,6 +35,20 @@ void testLoadAllClassesWithNoClasspath() throws IOException { } } + @Test + void testLoadAllClassesWithEmptyClasspath() { + String originalClasspath = System.getProperty("java.class.path"); + try { + System.setProperty("java.class.path", ""); + assertThrows(FileNotFoundException.class, () -> + ClasspathLoader.main(new String[]{})); + } finally { + if (originalClasspath != null) { + System.setProperty("java.class.path", originalClasspath); + } + } + } + @Test void testLoadAllClassesWithInvalidPath() { String originalClasspath = System.getProperty("java.class.path"); From a0a326b8503bfac928d23e6d743d5b4b8016c93b Mon Sep 17 00:00:00 2001 From: Maxime David Date: Fri, 14 Aug 2026 17:02:46 +0000 Subject: [PATCH 10/17] fix: java8 home --- .github/workflows/release-runtime-interface-client.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release-runtime-interface-client.yml b/.github/workflows/release-runtime-interface-client.yml index c0ba2d84..eb48b752 100644 --- a/.github/workflows/release-runtime-interface-client.yml +++ b/.github/workflows/release-runtime-interface-client.yml @@ -91,7 +91,7 @@ jobs: jdk 8 - $JAVA_HOME + $JAVA_8_HOME EOF @@ -180,7 +180,7 @@ jobs: jdk 8 - $JAVA_HOME + $JAVA_8_HOME EOF From d45cfe874e3e0616fa5a00054b253e85d149fec0 Mon Sep 17 00:00:00 2001 From: Fabiana Severin Date: Fri, 14 Aug 2026 18:20:16 +0100 Subject: [PATCH 11/17] ci(ric): blank Java 9+ argLine for JDK 8 test run --- .github/workflows/release-runtime-interface-client.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release-runtime-interface-client.yml b/.github/workflows/release-runtime-interface-client.yml index eb48b752..c003c79a 100644 --- a/.github/workflows/release-runtime-interface-client.yml +++ b/.github/workflows/release-runtime-interface-client.yml @@ -243,7 +243,7 @@ jobs: - name: Run tests env: IS_JAVA_8: true - run: mvn test --file "$MODULE/pom.xml" + run: mvn test -DargLineForReflectionTestOnly="" --file "$MODULE/pom.xml" # JARs to attach + .so files for the fat main JAR. - name: Download native artifacts From 306234c05bde2d3ecc9d1462ed7aaf64068792bd Mon Sep 17 00:00:00 2001 From: Fabiana Severin Date: Fri, 14 Aug 2026 18:39:21 +0100 Subject: [PATCH 12/17] fix(ci): raise OIDC role duration to STS minimum 900s --- .github/actions/configure-release-aws-credentials/action.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/actions/configure-release-aws-credentials/action.yml b/.github/actions/configure-release-aws-credentials/action.yml index a02a1e9a..6a34f648 100644 --- a/.github/actions/configure-release-aws-credentials/action.yml +++ b/.github/actions/configure-release-aws-credentials/action.yml @@ -23,5 +23,6 @@ runs: aws-region: ${{ inputs.aws-region }} role-to-assume: ${{ inputs.role-to-assume }} role-session-name: ${{ inputs.role-session-name }} - # Short-lived: the job only needs the role briefly to read two secrets. - role-duration-seconds: 300 + # Kept short: the job only needs the role briefly to read two secrets. + # 900s is STS's minimum for assume-role; anything lower is rejected. + role-duration-seconds: 900 From 3a17a26251d770984fbf280a16f7051ab57006b5 Mon Sep 17 00:00:00 2001 From: Maxime David Date: Fri, 14 Aug 2026 18:25:24 +0000 Subject: [PATCH 13/17] Revert "ci(ric): temporarily disable musl builds for testing" This reverts commit c5c8805eb847870f98325c6bc8469eb04d2f180f. --- .../workflows/release-runtime-interface-client.yml | 4 ++-- aws-lambda-java-runtime-interface-client/pom.xml | 13 ++++++++++--- .../src/main/jni/build-jni-lib.sh | 4 +--- 3 files changed, 13 insertions(+), 8 deletions(-) diff --git a/.github/workflows/release-runtime-interface-client.yml b/.github/workflows/release-runtime-interface-client.yml index c003c79a..49c3f8d5 100644 --- a/.github/workflows/release-runtime-interface-client.yml +++ b/.github/workflows/release-runtime-interface-client.yml @@ -55,10 +55,10 @@ jobs: include: - arch: x86_64 runner: codebuild-aws-lambda-java-libs-test-trigger-x86-${{ github.run_id }}-${{ github.run_attempt }} - profiles: linux-x86_64 + profiles: linux-x86_64 linux_musl-x86_64 - arch: aarch64 runner: codebuild-aws-lambda-java-libs-test-trigger-arm64-${{ github.run_id }}-${{ github.run_attempt }} - profiles: linux-aarch64 + profiles: linux-aarch64 linux_musl-aarch64 runs-on: ${{ matrix.runner }} timeout-minutes: 45 steps: diff --git a/aws-lambda-java-runtime-interface-client/pom.xml b/aws-lambda-java-runtime-interface-client/pom.xml index c76f3761..6db41aa3 100644 --- a/aws-lambda-java-runtime-interface-client/pom.xml +++ b/aws-lambda-java-runtime-interface-client/pom.xml @@ -442,9 +442,16 @@ jar linux-aarch_64 - + + ${project.build.directory}/${project.build.finalName}-linux_musl-x86_64.jar + jar + linux_musl-x86_64 + + + ${project.build.directory}/${project.build.finalName}-linux_musl-aarch_64.jar + jar + linux_musl-aarch_64 + diff --git a/aws-lambda-java-runtime-interface-client/src/main/jni/build-jni-lib.sh b/aws-lambda-java-runtime-interface-client/src/main/jni/build-jni-lib.sh index 82e49d56..44a290b6 100755 --- a/aws-lambda-java-runtime-interface-client/src/main/jni/build-jni-lib.sh +++ b/aws-lambda-java-runtime-interface-client/src/main/jni/build-jni-lib.sh @@ -116,9 +116,7 @@ if [ -n "$BUILD_OS" ] && [ -n "$BUILD_ARCH" ]; then else # build for all architectures and libc implementations declare -a ARCHITECTURES=("x86_64" "aarch_64") - # musl (Alpine) temporarily disabled for testing: the egress-locked release - # runner can't reach the Alpine apk mirrors. Re-add "musl" once that's solved. - declare -a LIBC_IMPLS=("glibc") + declare -a LIBC_IMPLS=("glibc" "musl") for arch in "${ARCHITECTURES[@]}"; do From 69892c1005569a8fab4abf2d6bc82c1782617c34 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Fri, 14 Aug 2026 18:56:20 +0000 Subject: [PATCH 14/17] chore(ric): release 2.12.0-RC --- aws-lambda-java-runtime-interface-client/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/aws-lambda-java-runtime-interface-client/pom.xml b/aws-lambda-java-runtime-interface-client/pom.xml index 6db41aa3..da9209bb 100644 --- a/aws-lambda-java-runtime-interface-client/pom.xml +++ b/aws-lambda-java-runtime-interface-client/pom.xml @@ -4,7 +4,7 @@ 4.0.0 com.amazonaws aws-lambda-java-runtime-interface-client - 2.12.0-SNAPSHOT + 2.12.0-RC jar AWS Lambda Java Runtime Interface Client From cbb4dd0ed547080d8ed77d7dcd30ed538871360d Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Fri, 14 Aug 2026 18:56:22 +0000 Subject: [PATCH 15/17] chore(ric): prepare next development 2.12.1-SNAPSHOT --- aws-lambda-java-runtime-interface-client/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/aws-lambda-java-runtime-interface-client/pom.xml b/aws-lambda-java-runtime-interface-client/pom.xml index da9209bb..d84aa51d 100644 --- a/aws-lambda-java-runtime-interface-client/pom.xml +++ b/aws-lambda-java-runtime-interface-client/pom.xml @@ -4,7 +4,7 @@ 4.0.0 com.amazonaws aws-lambda-java-runtime-interface-client - 2.12.0-RC + 2.12.1-SNAPSHOT jar AWS Lambda Java Runtime Interface Client From e4713720b62904687eef8a420867f5939caa5236 Mon Sep 17 00:00:00 2001 From: Fabiana Severin Date: Fri, 14 Aug 2026 20:02:02 +0100 Subject: [PATCH 16/17] ci: restore main-only release branch guard --- .../release-runtime-interface-client.yml | 18 +++++++++--------- .github/workflows/release.yml | 12 ++++++------ 2 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/workflows/release-runtime-interface-client.yml b/.github/workflows/release-runtime-interface-client.yml index 49c3f8d5..e41dcfc6 100644 --- a/.github/workflows/release-runtime-interface-client.yml +++ b/.github/workflows/release-runtime-interface-client.yml @@ -62,15 +62,15 @@ jobs: runs-on: ${{ matrix.runner }} timeout-minutes: 45 steps: - # # Manual (workflow_dispatch) releases must only run from main, never from - # # an arbitrary branch that could carry unreviewed release logic. Guarding - # # the first job blocks the whole pipeline (release needs build-natives). - # - name: Verify release branch - # run: | - # if [[ "$GITHUB_REF_NAME" != "main" ]]; then - # echo "::error::Releases must run from the main branch, got '$GITHUB_REF_NAME'" - # exit 1 - # fi + # Manual (workflow_dispatch) releases must only run from main, never from + # an arbitrary branch that could carry unreviewed release logic. Guarding + # the first job blocks the whole pipeline (release needs build-natives). + - name: Verify release branch + run: | + if [[ "$GITHUB_REF_NAME" != "main" ]]; then + echo "::error::Releases must run from the main branch, got '$GITHUB_REF_NAME'" + exit 1 + fi - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index dc446f7f..7ff834e5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -74,12 +74,12 @@ jobs: steps: # Manual (workflow_dispatch) releases must only run from main, never from # an arbitrary branch that could carry unreviewed release logic. - # - name: Verify release branch - # run: | - # if [[ "$GITHUB_REF_NAME" != "main" ]]; then - # echo "::error::Releases must run from the main branch, got '$GITHUB_REF_NAME'" - # exit 1 - # fi + - name: Verify release branch + run: | + if [[ "$GITHUB_REF_NAME" != "main" ]]; then + echo "::error::Releases must run from the main branch, got '$GITHUB_REF_NAME'" + exit 1 + fi - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 with: From e6290f4ea8b8c9216f4b9d04a68b811ef506c729 Mon Sep 17 00:00:00 2001 From: Fabiana Severin Date: Fri, 14 Aug 2026 20:07:58 +0100 Subject: [PATCH 17/17] chore(ric): revert version bump to 2.12.0-SNAPSHOT --- aws-lambda-java-runtime-interface-client/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/aws-lambda-java-runtime-interface-client/pom.xml b/aws-lambda-java-runtime-interface-client/pom.xml index d84aa51d..6db41aa3 100644 --- a/aws-lambda-java-runtime-interface-client/pom.xml +++ b/aws-lambda-java-runtime-interface-client/pom.xml @@ -4,7 +4,7 @@ 4.0.0 com.amazonaws aws-lambda-java-runtime-interface-client - 2.12.1-SNAPSHOT + 2.12.0-SNAPSHOT jar AWS Lambda Java Runtime Interface Client