Skip to content

Commit 1092a1f

Browse files
imabhichowimabhichow
committed
chore: validate release
1 parent cbfab66 commit 1092a1f

File tree

3 files changed

+246
-0
lines changed

3 files changed

+246
-0
lines changed

‎.github/workflows/ci_codebuild_batch.yml

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1297,6 +1297,45 @@ jobs:
12971297
project-name: python-esdk
12981298
buildspec-override: codebuild/py312/decrypt_golden_manifest_with_masterkey.yml
12991299
image-override: aws/codebuild/standard:7.0
1300+
1301+
# Python Release Validation with test vectors
1302+
python_release_validation:
1303+
name: Python Release Validation with Test Vectors
1304+
runs-on: ubuntu-latest
1305+
steps:
1306+
- name: Configure AWS Credentials
1307+
uses: aws-actions/configure-aws-credentials@v2
1308+
with:
1309+
role-to-assume: ${{ secrets.CI_AWS_ROLE_ARN }}
1310+
aws-region: us-west-2
1311+
role-duration-seconds: 7200
1312+
- name: Run CodeBuild
1313+
uses: aws-actions/aws-codebuild-run-build@v1
1314+
timeout-minutes: 120
1315+
with:
1316+
project-name: python-esdk
1317+
buildspec-override: codebuild/release/validate_test_vectors.yml
1318+
image-override: aws/codebuild/standard:7.0
1319+
1320+
1321+
# Python Release Validation with examples as alternate
1322+
python_release_examples_validation:
1323+
name: Python Release Validation with Examples
1324+
runs-on: ubuntu-latest
1325+
steps:
1326+
- name: Configure AWS Credentials
1327+
uses: aws-actions/configure-aws-credentials@v2
1328+
with:
1329+
role-to-assume: ${{ secrets.CI_AWS_ROLE_ARN }}
1330+
aws-region: us-west-2
1331+
role-duration-seconds: 7200
1332+
- name: Run CodeBuild
1333+
uses: aws-actions/aws-codebuild-run-build@v1
1334+
timeout-minutes: 120
1335+
with:
1336+
project-name: python-esdk
1337+
buildspec-override: codebuild/release/validate_released_with_examples.yml
1338+
image-override: aws/codebuild/standard:7.0
13001339

13011340
# Code Coverage and Compliance jobs
13021341
code_coverage:

‎codebuild/release/validate_released_with_examples.yml

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
version: 0.2
2+
3+
env:
4+
variables:
5+
# Default VERSION if not provided externally
6+
VERSION: 4.0.2
7+
REGION: "us-west-2"
8+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID: >-
9+
arn:aws:kms:us-west-2:658956600833:key/b3537ef1-d8dc-4780-9f5a-55776cbb2f7f
10+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID_2: >-
11+
arn:aws:kms:eu-central-1:658956600833:key/75414c93-5285-4b57-99c9-30c1cf0a22c2
12+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_1: >-
13+
arn:aws:kms:us-west-2:658956600833:key/mrk-80bd8ecdcd4342aebd84b7dc9da498a7
14+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_2: >-
15+
arn:aws:kms:us-east-1:658956600833:key/mrk-80bd8ecdcd4342aebd84b7dc9da498a7
16+
17+
phases:
18+
install:
19+
runtime-versions:
20+
python: 3.11
21+
commands:
22+
- pip install "aws-encryption-sdk[MPL]==$VERSION"
23+
- pip install "tox < 4.0"
24+
build:
25+
commands:
26+
# Create a simple tox.ini file for running examples with the installed package
27+
- |
28+
cat > release_validation_tox.ini << EOF
29+
[tox]
30+
envlist = py311
31+
skipsdist = True
32+
33+
[testenv]
34+
passenv =
35+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID
36+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID_2
37+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_1
38+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_2
39+
AWS_ACCESS_KEY_ID
40+
AWS_SECRET_ACCESS_KEY
41+
AWS_SESSION_TOKEN
42+
AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
43+
AWS_PROFILE
44+
deps =
45+
pytest
46+
pytest-mock
47+
mock
48+
coverage
49+
pyyaml
50+
moto
51+
boto3
52+
cryptography
53+
aws-encryption-sdk[MPL]==$VERSION
54+
commands =
55+
# Run non-MPL examples
56+
pytest examples/test/legacy/ -m examples
57+
# Run all other examples
58+
pytest examples/test/ -m examples --ignore examples/test/legacy/
59+
EOF
60+
61+
# Run the examples with NUM_RETRIES to handle transient failures
62+
- NUM_RETRIES=3
63+
- |
64+
while [ $NUM_RETRIES -gt 0 ]
65+
do
66+
tox -c release_validation_tox.ini -e py311
67+
if [ $? -eq 0 ]; then
68+
break
69+
fi
70+
NUM_RETRIES=$((NUM_RETRIES-1))
71+
if [ $NUM_RETRIES -eq 0 ]; then
72+
echo "All validation attempts failed, stopping"
73+
exit 1;
74+
else
75+
echo "Validation failed, retrying in 60 seconds; will retry $NUM_RETRIES more times" && sleep 60
76+
fi
77+
done
78+
79+
# Assume special role for MPL-specific tests
80+
- echo "Running tests with special role for MPL features"
81+
- TMP_ROLE=$(aws sts assume-role --role-arn "arn:aws:iam::370957321024:role/GitHub-CI-Public-ESDK-Python-Role-us-west-2" --role-session-name "CB-ValidateReleased")
82+
- export TMP_ROLE
83+
- export AWS_ACCESS_KEY_ID=$(echo "${TMP_ROLE}" | jq -r '.Credentials.AccessKeyId')
84+
- export AWS_SECRET_ACCESS_KEY=$(echo "${TMP_ROLE}" | jq -r '.Credentials.SecretAccessKey')
85+
- export AWS_SESSION_TOKEN=$(echo "${TMP_ROLE}" | jq -r '.Credentials.SessionToken')
86+
- aws sts get-caller-identity
87+
88+
# Also install MPL requirements
89+
- pip install -r requirements_mpl.txt
90+
91+
# Run MPL-specific examples
92+
- NUM_RETRIES=3
93+
- |
94+
while [ $NUM_RETRIES -gt 0 ]
95+
do
96+
# Create a fresh tox.ini for MPL tests with correct dependencies
97+
echo "Creating MPL tox.ini with VERSION=$VERSION"
98+
cat > mpl_validation_tox.ini << EOF
99+
[tox]
100+
envlist = py311
101+
skipsdist = True
102+
103+
[testenv]
104+
passenv =
105+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID
106+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID_2
107+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_1
108+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_2
109+
AWS_ACCESS_KEY_ID
110+
AWS_SECRET_ACCESS_KEY
111+
AWS_SESSION_TOKEN
112+
AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
113+
AWS_PROFILE
114+
deps =
115+
pytest
116+
pytest-mock
117+
mock
118+
coverage
119+
pyyaml
120+
moto
121+
boto3
122+
cryptography
123+
aws-encryption-sdk[MPL]==$VERSION
124+
-r requirements_mpl.txt
125+
commands =
126+
# Only run the MPL-specific tests
127+
pytest examples/test/ -m examples --ignore examples/test/legacy/
128+
EOF
129+
130+
# Run the MPL-specific tests
131+
tox -c mpl_validation_tox.ini -e py311
132+
if [ $? -eq 0 ]; then
133+
break
134+
fi
135+
NUM_RETRIES=$((NUM_RETRIES-1))
136+
if [ $NUM_RETRIES -eq 0 ]; then
137+
echo "All MPL validation attempts failed, stopping"
138+
exit 1;
139+
else
140+
echo "MPL validation failed, retrying in 60 seconds; will retry $NUM_RETRIES more times" && sleep 60
141+
fi
142+
done

‎codebuild/release/validate_test_vectors.yml

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
version: 0.2
2+
3+
env:
4+
variables:
5+
# Default VERSION if not provided externally
6+
VERSION: 4.0.2
7+
8+
phases:
9+
install:
10+
commands:
11+
- cd ..
12+
- pip install "tox < 4.0" poetry
13+
- pip install --upgrade pip
14+
# Get Dafny
15+
- curl https://github.com/dafny-lang/dafny/releases/download/v4.9.0/dafny-4.9.0-x64-ubuntu-20.04.zip -L -o dafny.zip
16+
- unzip -qq dafny.zip && rm dafny.zip
17+
- export PATH="$PWD/dafny:$PATH"
18+
- cd aws-encryption-sdk-python/
19+
runtime-versions:
20+
python: latest
21+
dotnet: 6.0
22+
pre_build:
23+
commands:
24+
# Setup environment
25+
- aws configure set region us-west-2
26+
- git clone https://github.com/aws/aws-encryption-sdk.git
27+
- cd aws-encryption-sdk && git submodule update --init --recursive && cd ..
28+
# Install packages and setup environments
29+
- pip install "aws-encryption-sdk[MPL]==$VERSION"
30+
- pyenv install --skip-existing 3.11.0 && pyenv local 3.11.0
31+
- make -C aws-encryption-sdk/mpl/StandardLibrary setup_net
32+
- pip install pytest boto3 attrs cryptography
33+
build:
34+
commands:
35+
- NUM_RETRIES=3
36+
- |
37+
run_command() {
38+
eval "$1"
39+
return $?
40+
}
41+
42+
# Navigate to TestVectors directory
43+
cd aws-encryption-sdk/TestVectors || exit 1
44+
45+
while [ $NUM_RETRIES -gt 0 ]
46+
do
47+
48+
# Build TestVectors implementation in Python
49+
CORES=$(nproc || echo 4)
50+
if ! run_command "make transpile_python CORES=$CORES"; then
51+
NUM_RETRIES=$((NUM_RETRIES-1))
52+
[ $NUM_RETRIES -gt 0 ] && sleep 60 && continue
53+
exit 1
54+
fi
55+
56+
# Run all the test vector commands together
57+
if ! run_command "make test_generate_vectors_python && make test_encrypt_vectors_python && make test_decrypt_encrypt_vectors_python"; then
58+
NUM_RETRIES=$((NUM_RETRIES-1))
59+
[ $NUM_RETRIES -gt 0 ] && sleep 60 && continue
60+
exit 1
61+
fi
62+
63+
# Success
64+
break
65+
done

0 commit comments

Comments
 (0)