Merge branch 'main' into zhaez/release-build-safety

Author: ezhang6811

.github/actions/artifacts_build/action.yml

@@ -103,4 +103,5 @@ runs:
       uses: ./.github/actions/image_scan
       with:
         image-ref: ${{ inputs.image_uri_with_tag }}
-        severity: 'CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN'
+        severity: 'CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN'
+        logout: 'true'

.github/actions/image_scan/action.yml

@@ -11,6 +11,11 @@ inputs:
   severity:
     required: true
     description: "List of severities that will cause a failure"
+  logout:
+    required: true
+    description: |
+      Whether to logout of public AWS ECR. Set to 'true' for PR workflows to avoid potential call failures,
+      'false' for daily scans which has a higher bar for passing regularly and specifically wants to sign in.
 
 runs:
   using: "composite"
@@ -22,6 +27,7 @@ runs:
   # ensure we can make unauthenticated call. This is important for making the pr_build workflow run on
   # PRs created from forked repos.
   - name: Logout of public AWS ECR
+    if: inputs.logout == 'true'
     shell: bash
     run: docker logout public.ecr.aws
 
@@ -30,4 +36,4 @@ runs:
     with:
       image-ref: ${{ inputs.image-ref }}
       severity: ${{ inputs.severity }}
-      exit-code: '1'
+      exit-code: '1'

.github/workflows/application-signals-e2e-test.yml

@@ -124,4 +124,20 @@ jobs:
     with:
       node-version: 22
       staging-instrumentation-name: ${{ inputs.staging-instrumentation-name }}
-      caller-workflow-name: 'main-build'
+      caller-workflow-name: 'main-build'
+
+  # This validation is to ensure that all test workflows relevant to this repo are actually
+  # being used in this repo, which is referring to all the other jobs in this file.
+  #
+  # If this starts failing, then it most likely means that new e2e test workflow was
+  # added to `aws-observability/aws-application-signals-test-framework`, but was not
+  # added to this file. It could also mean that a test in this file has been removed.
+  #
+  # If a particular test file is intended to not be tested in this repo and should not
+  # be failing this particular validation, then choose one of the following options:
+  # - Add the test file to the exclusions input (CSV format) to the workflow
+  #   (see: https://github.com/aws-observability/aws-application-signals-test-framework/blob/main/.github/workflows/validate-e2e-tests-are-accounted-for.yml#L1)
+  # - Update the `validate-e2e-tests-are-accounted-for` job to change which "workflow files are expected to be used by this repo"
+  #   (see: https://github.com/aws-observability/aws-application-signals-test-framework/blob/main/.github/workflows/validate-e2e-tests-are-accounted-for.yml)
+  validate-all-tests-are-accounted-for:
+    uses: aws-observability/aws-application-signals-test-framework/.github/workflows/validate-e2e-tests-are-accounted-for.yml@main

.github/workflows/daily-scan.yml

@@ -8,8 +8,10 @@
 name: Daily scan
 
 on:
-  schedule:
-    - cron: '0 18 * * *' # scheduled to run at 18:00 UTC every day
+  schedule: # scheduled to run at 14:00, 20:00, 02:00 UTC every day
+    - cron: '0 14 * * *' # 6:00/7:00   PST/PDT (14:00 UTC)
+    - cron: '0 20 * * *' # 12:00/13:00 PST/PDT (20:00 UTC)
+    - cron: '0 02 * * *' # 18:00/19:00 PST/PDT (02:00 UTC)
   workflow_dispatch: # be able to run the workflow on demand
 
 env:
@@ -66,24 +68,35 @@ jobs:
       - name: Print dependency scan results on failure
         if: ${{ steps.dep_scan.outcome != 'success' }}
         run: less dependency-check-report.html
+      
+      - name: Configure AWS credentials for image scan
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
+          aws-region: ${{ env.AWS_DEFAULT_REGION }}
+
+      - name: Login to Public ECR
+        uses: docker/login-action@v3
+        with:
+          registry: public.ecr.aws
 
-      # TODO: Update image to public once available
       - name: Perform high image scan
         if: always()
         id: high_scan
         uses: ./.github/actions/image_scan
         with:
-          image-ref: "public.ecr.aws/aws-observability/adot-autoinstrumentation-node:v0.6.0"
+          image-ref: "public.ecr.aws/aws-observability/adot-autoinstrumentation-node:v0.7.0"
           severity: 'CRITICAL,HIGH'
+          logout: 'false'
 
-      # TODO: Update image to public once available
       - name: Perform low image scan
         if: always()
         id: low_scan
         uses: ./.github/actions/image_scan
         with:
-          image-ref: "public.ecr.aws/aws-observability/adot-autoinstrumentation-node:v0.6.0"
+          image-ref: "public.ecr.aws/aws-observability/adot-autoinstrumentation-node:v0.7.0"
           severity: 'MEDIUM,LOW,UNKNOWN'
+          logout: 'false'
 
       - name: Configure AWS Credentials for emitting metrics
         if: always()

.github/workflows/main-build.yml

@@ -104,3 +104,23 @@ jobs:
     with:
       staging-instrumentation-name: ${{ needs.build.outputs.staging_tarball_file }}
       adot-image-name: ${{ needs.build.outputs.staging_registry }}/aws-observability/adot-autoinstrumentation-node-staging:${{ needs.build.outputs.node_image_tag }}
+
+  publish-main-build-status:
+    name: "Publish Main Build Status"
+    needs: [ build, application-signals-e2e-test ]
+    runs-on: ubuntu-latest
+    if: always()
+    steps:
+      - name: Configure AWS Credentials for emitting metrics
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.MONITORING_ROLE_ARN }}
+          aws-region: ${{ env.AWS_DEFAULT_REGION }}
+
+      - name: Publish main build status
+        run: |
+          value="${{ needs.build.result == 'success' && needs.application-signals-e2e-test.result == 'success' && '0.0' || '1.0'}}"
+          aws cloudwatch put-metric-data --namespace 'ADOT/GitHubActions' \
+            --metric-name Failure \
+            --dimensions repository=${{ github.repository }},branch=${{ github.ref_name }},workflow=main_build \
+            --value $value

.github/workflows/pr-build.yml

@@ -38,6 +38,15 @@ jobs:
         run: npm ci
       - name: Compile all NPM projects
         run: npm run compile
+      - name: Build Tarball and Image Files
+        uses: ./.github/actions/artifacts_build
+        with:
+          image_uri_with_tag: pr-build/${{ matrix.node }}
+          push_image: false
+          load_image: true
+          node_version: ${{ matrix.node }}
+          package_name: aws-distro-opentelemetry-node-autoinstrumentation
+          os: ubuntu-latest
       - name: Build Lambda Layer
         run: npm run build-lambda
       - name: Unit tests (Full)

.github/workflows/release-lambda.yml

@@ -13,7 +13,8 @@ on:
 
 env:
   AWS_REGIONS: ${{ github.event.inputs.aws_region }}
-  COMMERCIAL_REGIONS: us-east-1, us-east-2, us-west-1, us-west-2, ap-south-1, ap-northeast-3, ap-northeast-2, ap-southeast-1, ap-southeast-2, ap-northeast-1, ca-central-1, eu-central-1, eu-west-1, eu-west-2, eu-west-3, eu-north-1, sa-east-1, ap-southeast-5, ap-southeast-7, mx-central-1, ca-west-1, cn-north-1, cn-northwest-1
+  # Legacy list of commercial regions to deploy to. New regions should NOT be added here, and instead should be added to the `aws_region` default input to the workflow.
+  LEGACY_COMMERCIAL_REGIONS: us-east-1, us-east-2, us-west-1, us-west-2, ap-south-1, ap-northeast-3, ap-northeast-2, ap-southeast-1, ap-southeast-2, ap-northeast-1, ca-central-1, eu-central-1, eu-west-1, eu-west-2, eu-west-3, eu-north-1, sa-east-1
   LAYER_NAME: AWSOpenTelemetryDistroJs
 
 permissions:
@@ -66,21 +67,21 @@ jobs:
     steps:
       - name: role arn
         env:
-          COMMERCIAL_REGIONS: ${{ env.COMMERCIAL_REGIONS }}
+          LEGACY_COMMERCIAL_REGIONS: ${{ env.LEGACY_COMMERCIAL_REGIONS }}
         run: |
-          COMMERCIAL_REGIONS_ARRAY=(${COMMERCIAL_REGIONS//,/ })
+          LEGACY_COMMERCIAL_REGIONS_ARRAY=(${LEGACY_COMMERCIAL_REGIONS//,/ })
           FOUND=false
-          for REGION in "${COMMERCIAL_REGIONS_ARRAY[@]}"; do
+          for REGION in "${LEGACY_COMMERCIAL_REGIONS_ARRAY[@]}"; do
             if [[ "$REGION" == "${{ matrix.aws_region }}" ]]; then
               FOUND=true
               break
             fi
           done
           if [ "$FOUND" = true ]; then
-            echo "Found ${{ matrix.aws_region }} in COMMERCIAL_REGIONS"
+            echo "Found ${{ matrix.aws_region }} in LEGACY_COMMERCIAL_REGIONS"
             SECRET_KEY="LAMBDA_LAYER_RELEASE"
           else
-            echo "Not found ${{ matrix.aws_region }} in COMMERCIAL_REGIONS"
+            echo "Not found ${{ matrix.aws_region }} in LEGACY_COMMERCIAL_REGIONS"
             SECRET_KEY="${{ matrix.aws_region }}_LAMBDA_LAYER_RELEASE"
           fi
           SECRET_KEY=${SECRET_KEY//-/_}

aws-distro-opentelemetry-node-autoinstrumentation/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/aws-distro-opentelemetry-node-autoinstrumentation",
-  "version": "0.6.0-dev0",
+  "version": "0.7.0-dev0",
   "description": "This package provides Amazon Web Services distribution of the OpenTelemetry Node Instrumentation, which allows for auto-instrumentation of NodeJS applications.",
   "author": {
     "name": "Amazon Web Services",

contract-tests/images/mock-collector/pyproject.toml

@@ -13,7 +13,7 @@ dependencies = [
     "grpcio ~= 1.60.0",
     "opentelemetry-proto==1.25.0",
     "opentelemetry-sdk==1.25.0",
-    "protobuf==4.25.2",
+    "protobuf==4.25.8",
     "typing-extensions==4.9.0"
 ]
 

contract-tests/images/mock-collector/requirements.txt

@@ -1,5 +1,5 @@
 grpcio==1.60.1
 opentelemetry-proto==1.25.0
 opentelemetry-sdk==1.25.0
-protobuf==4.25.2
+protobuf==4.25.8
 typing-extensions==4.9.0