Skip to content

Commit bee8183

Browse files
sharmabikramsharmabikram
authored
Merge branch 'master' into dependabot/pip/dev_requirements/setuptools-70.0.0
2 parents daeddf7 + ff8ceec commit bee8183

14 files changed

Lines changed: 218 additions & 135 deletions

‎.github/workflows/ci_integration.yml‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
# This workflow runs integration tests with AWS KMS keys
2+
name: integration-tests
3+
4+
on:
5+
workflow_call:
6+
# Keep the schedule to maintain daily runs
7+
schedule:
8+
- cron: '0 0 * * *'
9+
10+
jobs:
11+
test:
12+
runs-on: ubuntu-latest
13+
strategy:
14+
fail-fast: false
15+
matrix:
16+
python-version: ['3.8', '3.9', '3.10', '3.11', '3.12']
17+
include:
18+
- python-version: '3.8'
19+
toxenv: 'py38-integ-slow'
20+
- python-version: '3.9'
21+
toxenv: 'py39-integ-slow'
22+
- python-version: '3.10'
23+
toxenv: 'py310-integ-slow'
24+
- python-version: '3.11'
25+
toxenv: 'py311-integ-slow'
26+
- python-version: '3.12'
27+
toxenv: 'py312-integ-slow'
28+
permissions:
29+
id-token: write
30+
contents: read
31+
32+
steps:
33+
- uses: actions/checkout@v4
34+
35+
- name: Set up Python ${{ matrix.python-version }}
36+
uses: actions/setup-python@v5
37+
with:
38+
python-version: ${{ matrix.python-version }}
39+
40+
- name: Install dependencies
41+
run: |
42+
python -m pip install --upgrade pip
43+
pip install "tox < 4.0"
44+
45+
# Python no longer bundles setuptools starting in 3.12
46+
- name: Install python version specific dependencies
47+
if: matrix.python-version == '3.12'
48+
run: |
49+
pip install setuptools
50+
51+
- name: Configure AWS Credentials for Tests
52+
uses: aws-actions/configure-aws-credentials@v4
53+
with:
54+
aws-region: us-west-2
55+
role-to-assume: arn:aws:iam::370957321024:role/GitHub-CI-DDBEC-Python-Role-us-west-2
56+
role-session-name: DDBEC-Python-Tests
57+
58+
- name: Test with tox
59+
env:
60+
TOXENV: ${{ matrix.toxenv }}
61+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID: >-
62+
arn:aws:kms:us-west-2:658956600833:key/b3537ef1-d8dc-4780-9f5a-55776cbb2f7f
63+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID_2: >-
64+
arn:aws:kms:eu-central-1:658956600833:key/75414c93-5285-4b57-99c9-30c1cf0a22c2
65+
run: tox
66+
67+
coverage:
68+
runs-on: ubuntu-latest
69+
steps:
70+
- uses: actions/checkout@v4
71+
72+
- name: Set up Python
73+
uses: actions/setup-python@v5
74+
with:
75+
python-version: '3.13'
76+
77+
- name: Install dependencies
78+
run: |
79+
python -m pip install --upgrade pip
80+
pip install "tox < 4.0"
81+
pip install setuptools
82+
83+
- name: Run coverage
84+
env:
85+
TOXENV: coverage
86+
run: tox

‎.github/workflows/ci_static-analysis.yaml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,14 @@
22
name: static analysis
33

44
on:
5-
pull_request:
6-
push:
7-
# Run once a day
5+
workflow_call:
6+
# Keep the schedule to maintain daily runs
87
schedule:
98
- cron: '0 0 * * *'
109

10+
permissions:
11+
contents: read
12+
1113
jobs:
1214
analysis:
1315
runs-on: ubuntu-latest

‎.github/workflows/ci_tests.yaml‎

Lines changed: 19 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,14 @@
22
name: tests
33

44
on:
5-
pull_request:
6-
push:
7-
# Run once a day
5+
workflow_call:
6+
# Keep the schedule to maintain daily runs
87
schedule:
98
- cron: '0 0 * * *'
109

10+
permissions:
11+
contents: read
12+
1113
jobs:
1214
tests:
1315
runs-on: ${{ matrix.platform.os }}
@@ -22,17 +24,29 @@ jobs:
2224
# x86 builds are only meaningful for Windows
2325
- os: windows-latest
2426
architecture: x86
25-
- os: macos-12
27+
- os: macos-latest
2628
architecture: x64
2729
python:
2830
- 3.8
2931
- 3.9
3032
- "3.10"
3133
- "3.11"
3234
- "3.12"
33-
- 3.x
35+
# - 3.x 3.13 does not have 'pipes' and maybe other necessary things
3436
category:
3537
- local-slow
38+
exclude:
39+
# Python < 3.11 is broken on macOS runners due to missing libintl dependency
40+
# See: https://github.com/actions/setup-python/issues/875
41+
- platform:
42+
os: macos-latest
43+
python: 3.8
44+
- platform:
45+
os: macos-latest
46+
python: 3.9
47+
- platform:
48+
os: macos-latest
49+
python: "3.10"
3650
# These require credentials.
3751
# Enable them once we sort how to provide them.
3852
# - integ-slow

‎.github/workflows/pull.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
name: Pull Request Checks
2+
3+
on:
4+
pull_request:
5+
6+
permissions:
7+
contents: read
8+
id-token: write
9+
10+
jobs:
11+
call-integration-tests:
12+
name: Run Integration Tests
13+
uses: ./.github/workflows/ci_integration.yml
14+
call-static-analysis:
15+
name: Run Static Analysis
16+
uses: ./.github/workflows/ci_static-analysis.yaml
17+
call-tests:
18+
name: Run Tests
19+
uses: ./.github/workflows/ci_tests.yaml
20+
pr-ci-all-required:
21+
if: always()
22+
needs:
23+
- call-integration-tests
24+
- call-static-analysis
25+
- call-tests
26+
runs-on: ubuntu-22.04
27+
steps:
28+
- name: Verify all required jobs passed
29+
uses: re-actors/alls-green@release/v1
30+
with:
31+
jobs: ${{ toJSON(needs) }}

‎.github/workflows/push.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: Push Checks
2+
3+
on:
4+
push:
5+
branches: master
6+
7+
permissions:
8+
contents: read
9+
10+
jobs:
11+
call-integration-tests:
12+
name: Run Integration Tests
13+
uses: ./.github/workflows/ci_integration.yml
14+
call-static-analysis:
15+
name: Run Static Analysis
16+
uses: ./.github/workflows/ci_static-analysis.yaml
17+
call-tests:
18+
name: Run Tests
19+
uses: ./.github/workflows/ci_tests.yaml

‎.github/workflows/repo-sync.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,10 @@ name: Repo Sync
33
on:
44
workflow_dispatch: # allows triggering this manually through the Actions UI
55

6+
permissions:
7+
contents: write
8+
pull-requests: write
9+
610
jobs:
711
repo-sync:
812
name: Repo Sync

‎cfn/github_permissions.yml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
AWSTemplateFormatVersion: "2010-09-09"
2+
Description: "IAM Role for CI from Github"
3+
4+
Parameters:
5+
ProjectName:
6+
Type: String
7+
Description: A prefix that will be applied to any names
8+
Default: DDBEC-Python
9+
GitHubRepo:
10+
Type: String
11+
Description: GitHub Repo that invokes CI
12+
Default: aws/aws-dynamodb-encryption-python
13+
14+
Resources:
15+
GitHubCIRole:
16+
Type: 'AWS::IAM::Role'
17+
Properties:
18+
RoleName: !Sub "GitHub-CI-${ProjectName}-Role-${AWS::Region}"
19+
Description: "Access KMS Resources for CI from GitHub"
20+
ManagedPolicyArns:
21+
- "arn:aws:iam::370957321024:policy/KMS-Public-CMK-EncryptDecrypt-Key-Access"
22+
AssumeRolePolicyDocument: !Sub |
23+
{
24+
"Version": "2012-10-17",
25+
"Statement": [
26+
{
27+
"Effect": "Allow",
28+
"Principal": { "Federated": "arn:aws:iam::${AWS::AccountId}:oidc-provider/token.actions.githubusercontent.com" },
29+
"Action": "sts:AssumeRoleWithWebIdentity",
30+
"Condition": {
31+
"StringEquals": {
32+
"token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
33+
},
34+
"StringLike": {
35+
"token.actions.githubusercontent.com:sub": "repo:${GitHubRepo}:*"
36+
}
37+
}
38+
},
39+
{
40+
"Effect": "Allow",
41+
"Principal": {
42+
"AWS": "*"
43+
},
44+
"Action": "sts:AssumeRole",
45+
"Condition": {
46+
"StringEquals": {
47+
"aws:PrincipalArn": [
48+
"arn:aws:iam::${AWS::AccountId}:role/ToolsDevelopment"
49+
]
50+
}
51+
}
52+
}
53+
]
54+
}

‎codebuild/coverage/coverage.yml‎

Lines changed: 0 additions & 14 deletions
This file was deleted.

‎codebuild/python3.10.yml‎

Lines changed: 0 additions & 18 deletions
This file was deleted.

‎codebuild/python3.11.yml‎

Lines changed: 0 additions & 18 deletions
This file was deleted.

0 commit comments

Comments
 (0)