Try moving canary to ci step

smithy-lang · Mar 28, 2024 · 9d12ead · 9d12ead
1 parent db749e1
commit 9d12ead
Show file tree

Hide file tree

Showing 6 changed files with 64 additions and 71 deletions.
diff --git a/.github/workflows/canary.yml b/.github/workflows/canary.yml
diff --git a/.github/workflows/ci-main.yml b/.github/workflows/ci-main.yml
@@ -68,3 +68,5 @@ jobs:
     secrets:
       ENCRYPTED_DOCKER_PASSWORD: ${{ needs.acquire-base-image.outputs.docker-login-password }}
       DOCKER_LOGIN_TOKEN_PASSPHRASE: ${{ secrets.DOCKER_LOGIN_TOKEN_PASSPHRASE }}
+      CANARY_GITHUB_ACTIONS_ROLE_ARN: ${{ secrets.CANARY_GITHUB_ACTIONS_ROLE_ARN }}
+      CANARY_STACK_CDK_OUTPUTS_BUCKET_NAME: ${{ secrets.CANARY_STACK_CDK_OUTPUTS_BUCKET_NAME }}
diff --git a/.github/workflows/ci-merge-queue.yml b/.github/workflows/ci-merge-queue.yml
@@ -91,3 +91,5 @@ jobs:
     secrets:
       ENCRYPTED_DOCKER_PASSWORD: ${{ needs.save-docker-login-token.outputs.docker-login-password }}
       DOCKER_LOGIN_TOKEN_PASSPHRASE: ${{ secrets.DOCKER_LOGIN_TOKEN_PASSPHRASE }}
+      CANARY_GITHUB_ACTIONS_ROLE_ARN: ${{ secrets.CANARY_GITHUB_ACTIONS_ROLE_ARN }}
+      CANARY_STACK_CDK_OUTPUTS_BUCKET_NAME: ${{ secrets.CANARY_STACK_CDK_OUTPUTS_BUCKET_NAME }}
diff --git a/.github/workflows/ci-pr.yml b/.github/workflows/ci-pr.yml
@@ -93,17 +93,6 @@ jobs:
     secrets:
       ENCRYPTED_DOCKER_PASSWORD: ${{ needs.save-docker-login-token.outputs.docker-login-password }}
       DOCKER_LOGIN_TOKEN_PASSPHRASE: ${{ secrets.DOCKER_LOGIN_TOKEN_PASSPHRASE }}
-
-  # Run the canary against generated SDKs
-  canary:
-    name: Canary
-    needs: acquire-base-image
-    if: ${{ github.event.pull_request.head.repo.full_name == 'smithy-lang/smithy-rs' }}
-    uses: ./.github/workflows/canary.yml
-    with:
-      pull_request_number: ${{ github.event.number }}
-      commit_sha: ${{ github.event.pull_request.head.sha }}
-    secrets:
       CANARY_GITHUB_ACTIONS_ROLE_ARN: ${{ secrets.CANARY_GITHUB_ACTIONS_ROLE_ARN }}
       CANARY_STACK_CDK_OUTPUTS_BUCKET_NAME: ${{ secrets.CANARY_STACK_CDK_OUTPUTS_BUCKET_NAME }}
 

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -27,6 +27,10 @@ on:
         required: false
       DOCKER_LOGIN_TOKEN_PASSPHRASE:
         required: false
+      CANARY_GITHUB_ACTIONS_ROLE_ARN:
+        required: false
+      CANARY_STACK_CDK_OUTPUTS_BUCKET_NAME:
+        required: false
 
 env:
   rust_version: 1.74.1
@@ -295,6 +299,33 @@ jobs:
       shell: bash
       run: cross test --target ${{ matrix.target }} --manifest-path "aws/rust-runtime/Cargo.toml" ${{ matrix.test_aws_exclude }} --workspace
 
+  # Run the canary against generated SDKs
+  canary:
+    name: Canary
+    if: ${{ github.event.pull_request.head.repo.full_name == 'smithy-lang/smithy-rs' }}
+    needs: generate
+    runs-on: smithy_ubuntu-latest_8-core
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        path: smithy-rs
+        ref: ${{ inputs.git_ref }}
+    - name: Configure credentials
+      id: creds
+      uses: aws-actions/configure-aws-credentials@v4
+      with:
+        aws-region: us-west-2
+        role-to-assume: ${{ secrets.CANARY_GITHUB_ACTIONS_ROLE_ARN }}
+        output-credentials: true
+    - name: Run canary
+      uses: ./smithy-rs/.github/actions/docker-build
+      with:
+        action: run-canary
+        action-arguments: ${{ secrets.CANARY_STACK_CDK_OUTPUTS_BUCKET_NAME }} ${{ steps.creds.outputs.aws-access-key-id }} ${{ steps.creds.outputs.aws-secret-access-key }} ${{ steps.creds.outputs.aws-session-token }}
+
   # This job is split out from the rest since it is not required to pass for merge
   check-sdk-examples:
     name: Check SDK Examples
@@ -321,8 +352,11 @@ jobs:
     - test-sdk
     - test-rust-windows
     - test-exotic-platform-support
+    - canary
     # Run this job even if its dependency jobs fail
-    if: always()
+    if: |
+      always() &&
+      ${{ github.event.pull_request.head.repo.full_name == 'smithy-lang/smithy-rs' }}
     runs-on: ubuntu-latest
     name: Matrix Success
     steps:
@@ -331,3 +365,26 @@ jobs:
       uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe
       with:
         jobs: ${{ toJSON(needs) }}
+
+  # Pseudo-job that depends on matrix jobs so that we don't have to enter
+  # the myriad of test matrix combinations into GitHub's protected branch rules
+  require-all-but-canary:
+    # Should NOT depend on check-sdk-examples since that's an optional check
+    needs:
+    - generate
+    - test-codegen
+    - test-sdk
+    - test-rust-windows
+    - test-exotic-platform-support
+    # Run this job even if its dependency jobs fail
+    if: |
+      always() &&
+      ${{ github.event.pull_request.head.repo.full_name != 'smithy-lang/smithy-rs' }}
+    runs-on: ubuntu-latest
+    name: Matrix Success
+    steps:
+    - name: Verify jobs succeeded
+        # Pinned to commit hash of v1.2.2
+      uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe
+      with:
+        jobs: ${{ toJSON(needs) }}
diff --git a/tools/ci-scripts/run-canary b/tools/ci-scripts/run-canary
@@ -12,14 +12,9 @@ export AWS_SECRET_ACCESS_KEY=$3
 export AWS_SESSION_TOKEN=$4
 export AWS_REGION=us-west-2
 
-SMITHY_RS="$(pwd)/smithy-rs"
-SDK_PATH="${SMITHY_RS}/aws/sdk/build/aws-sdk/sdk"
+SDK_PATH="$(pwd)/aws-sdk/sdk"
 
-cd "${SMITHY_RS}"
-# Generate only SDKs used by canary (see BASE_MANIFEST in build_bundle.rs of canary-runner)
-./gradlew -Paws.services=+ec2,+s3,+sso,+ssooidc,+sts,+transcribestreaming :aws:sdk:assemble
-
-cd tools/ci-cdk/canary-runner
+cd smithy-rs/tools/ci-cdk/canary-runner
 aws s3 cp s3://"${CANARY_STACK_CDK_OUTPUTS_BUCKET_NAME}"/cdk-outputs.json .
 cargo run -- \
   run --rust-version "${RUST_STABLE_VERSION}" \