ci: Add GitHub Actions CI for Linux and Windows, update Mac workflow by laileni-aws · Pull Request #35 · aws/amazon-q-jetbrains

laileni-aws · 2026-03-16T22:42:03Z

Summary

Adds GitHub Actions CI workflows for Linux and Windows unit tests, and updates the existing Mac workflow to match. Linux and Windows now run tests against IDE versions 2025.1, 2025.2, and 2025.3 in a matrix and Mac runs on 2025.3 version.

Workflows

Workflow	Runner	Gradle command
`linux-unit-tests.yml`	`ubuntu-latest`	`check coverageReport -x gitSecrets`
`windows-unit-tests.yml`	`windows-latest`	`coverageReport`
`mac.yml` (updated)	`macos-latest`	`check coverageReport -x gitSecrets`

All workflows trigger on push to main and PRs targeting main, feature/*, fix/*, test/*.

Build config fixes

Coroutine pool size: Added systemProperty("kotlinx.coroutines.scheduler.core.pool.size", "4") to test JVM args in toolkit-intellij-subplugin.gradle.kts. GHA runners have 2 CPU cores, which starves the IntelliJ Fleet kernel Transactor when kotlinx.coroutines defaults pool size to CPU count.
Cognito test race condition: Changed verify(cognitoClient, times(1)) to verify(cognitoClient, atLeast(2)) in AwsCognitoCredentialsProviderTest.testGetCredentialsExpired. The NonBlocking prefetch strategy causes additional getCredentialsForIdentity calls on slower CI runners.

Platform-specific notes

Linux: Requires Xvfb (Xvfb :99) for AWT/Swing display support needed by IntelliJ test framework.
Windows: Runs coverageReport only (not check), matching the existing CodeBuild buildspec behavior.
gitSecrets: Skipped via -x gitSecrets on Linux and Mac. The Gradle-downloaded git-secrets script has shell compatibility issues on GHA Ubuntu runners (/bin/sh → dash). GitHub's built-in secret scanning provides equivalent coverage.

Common configuration across all workflows

JDK 21 Corretto
Gradle caching via gradle/actions/setup-gradle@v4
-Dorg.gradle.jvmargs=-Xmx4g
LOCAL_ENV_RUN=true, CI=true
fetch-depth: 0
--continue flag
Test report artifact upload on failure (14-day retention)
PR: ci: Add GitHub Actions CI for Linux and Windows, update Mac workflow #34

Checklist

My code follows the code style of this project
I have added tests to cover my changes
A short description of the change has been added to the CHANGELOG if the change is customer-facing in the IDE.
I have added metrics for my changes (if required)

License

I confirm that my contribution is made under the terms of the Apache 2.0 license.

…34) * ci: adding linux and windows unit tests * fix: Added LOCAL_ENV_RUN: true env var — set in all CodeBuild buildspecs * fix: Fix the race condition in testGetCredentialsExpired * fix: resolve test failures on GitHub Actions CI runners - Add coroutine scheduler pool size (4) to test JVM args to fix ClosedSendChannelException/Transactor errors on low-core GHA runners - Fix race condition in AwsCognitoCredentialsProviderTest where NonBlocking prefetch triggers extra refresh calls on slower runners - Add Xvfb virtual display for Linux unit tests - Install git-secrets for Linux CI - Add Linux and Windows unit test workflows with IDE version matrix * fix: test it * fix: fix mac unit test ci * fix: modifying tests

.github/workflows/linux-unit-tests.yml

+    name: Linux (${{ matrix.ideProfileName }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        ideProfileName: [ "2025.1", "2025.2", "2025.3" ]
+    env:
+      CI: true
+      LOCAL_ENV_RUN: true
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@v4
+        with:
+          java-version: 21
+          distribution: 'corretto'
+          cache: 'gradle'
+
+      - name: Configure Gradle properties
+        run: |
+          mkdir -p ~/.gradle
+          cat >> ~/.gradle/gradle.properties <<EOF
+          org.gradle.jvmargs=-Xmx4g
+          kotlin.daemon.jvmargs=-Xmx4g
+          EOF
+
+      - name: Grant execute permission for gradlew
+        run: chmod +x gradlew
+
+      - name: Run tests
+        run: |
+          Xvfb :99 -screen 0 1920x1080x24 &
+          export DISPLAY=:99
+          ./gradlew -PideProfileName=${{ matrix.ideProfileName }} check coverageReport -x gitSecrets --info --stacktrace --console plain --continue
+
+      - name: Build plugin
+        if: success()
+        run: ./gradlew -PideProfileName=${{ matrix.ideProfileName }} buildPlugin
+
+      - name: Collect test artifacts
+        if: always()
+        run: |
+          mkdir -p /tmp/testArtifacts/test-reports
+          rsync -rmq --include='*/' --include '**/build/idea-sandbox/**/log*/**' --exclude='*' . /tmp/testArtifacts/ || true
+          rsync -rmq --include='*/' --include '**/build/reports/**' --exclude='*' . /tmp/testArtifacts/ || true
+          rsync -rmq --include='*/' --include '**/test-results/**/*.xml' --exclude='*' . /tmp/testArtifacts/test-reports || true
+
+      - name: Upload test artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: linux-test-artifacts-${{ matrix.ideProfileName }}
+          path: /tmp/testArtifacts/
+          retention-days: 14
+
+      - name: Upload plugin artifact
+        if: success()
+        uses: actions/upload-artifact@v4
+        with:
+          name: linux-plugin-${{ matrix.ideProfileName }}
+          path: plugins/**/build/distributions/*.zip
+          retention-days: 14


Generally, the fix is to explicitly define a permissions block in the workflow (at the root or per job) to restrict the GITHUB_TOKEN to the least privileges required. For this specific workflow, the job only checks out code and uploads artifacts, so contents: read is sufficient. No steps modify issues, pull requests, or repository contents.

The best minimal-impact fix is to add a permissions section to the linux-unit-tests job. This keeps the change localized and avoids affecting other workflows or jobs. Concretely, in .github/workflows/linux-unit-tests.yml, within the linux-unit-tests job definition, add:

permissions: contents: read

right after the runs-on: ubuntu-latest line (or anywhere within the job’s top-level keys). No imports or additional methods are needed; this is purely a YAML configuration change. Functionality remains the same, but the GITHUB_TOKEN is now explicitly limited.

.github/workflows/windows-unit-tests.yml

+    name: Windows (${{ matrix.ideProfileName }})
+    runs-on: windows-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        ideProfileName: [ "2025.1", "2025.2", "2025.3" ]
+    env:
+      CI: true
+      LOCAL_ENV_RUN: true
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@v4
+        with:
+          java-version: 21
+          distribution: 'corretto'
+          cache: 'gradle'
+
+      - name: Configure Gradle properties
+        shell: pwsh
+        run: |
+          New-Item -ItemType Directory -Force -Path "$env:USERPROFILE\.gradle" | Out-Null
+          @"
+          org.gradle.jvmargs=-Xmx4g
+          kotlin.daemon.jvmargs=-Xmx4g
+          "@ | Add-Content -Path "$env:USERPROFILE\.gradle\gradle.properties"
+
+      - name: Run tests
+        run: ./gradlew -PideProfileName="${{ matrix.ideProfileName }}" coverageReport --info --console plain
+
+      - name: Collect test artifacts
+        if: always()
+        shell: pwsh
+        run: |
+          $TEST_ARTIFACTS = Join-Path $env:TEMP "testArtifacts"
+          $TEST_REPORTS = Join-Path $TEST_ARTIFACTS "test-reports"
+          New-Item -ItemType Directory -Force -Path $TEST_REPORTS | Out-Null
+
+          function Copy-Artifacts($filter, $destdir) {
+            Get-ChildItem -Recurse -Directory -ErrorAction SilentlyContinue |
+              Where-Object { $_.FullName -Like "$filter" } |
+              ForEach-Object {
+                $relativePath = Resolve-Path -Relative $_.FullName
+                $dest = Join-Path $destdir $relativePath
+                Copy-Item -Path $_.FullName -Destination $dest -Recurse -Container -ErrorAction SilentlyContinue
+              }
+          }
+
+          Copy-Artifacts "*\build\idea-sandbox\*\log*" $TEST_ARTIFACTS
+          Copy-Artifacts "*\build\reports" $TEST_ARTIFACTS
+          Copy-Artifacts "*\test-results" $TEST_REPORTS
+
+          echo "TEST_ARTIFACTS=$TEST_ARTIFACTS" >> $env:GITHUB_ENV
+
+      - name: Upload test artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: windows-test-artifacts-${{ matrix.ideProfileName }}
+          path: ${{ env.TEST_ARTIFACTS }}
+          retention-days: 14


In general, the fix is to explicitly declare a permissions: block for the workflow or the specific job, granting only the minimal required scopes. For this job, the steps only read repository contents (for checkout) and interact with the Actions artifact service; they do not need to write to repository contents, issues, or pull requests. The minimal safe configuration is to set contents: read, which is precisely what the CodeQL message suggests as a starting point.

The most direct and non-invasive fix is to add a permissions: block under the windows-unit-tests job, so it only affects this job and does not change behavior for any other jobs that might exist in the workflow file (we are only shown one, but this approach stays conservative). Concretely, in .github/workflows/windows-unit-tests.yml, insert:

permissions: contents: read

between the name: and runs-on: keys for the windows-unit-tests job (around lines 11–12). No new imports or external dependencies are needed, and no existing functionality changes, because GitHub’s standard actions (actions/checkout, actions/setup-java, actions/upload-artifact) all work with read-only contents permissions.

github-actions · 2026-03-16T22:59:08Z

Qodana for JVM

It seems all right 👌

No new problems were found according to the checks applied

💡 Qodana analysis was run in the pull request mode: only the changed files were checked

View the detailed Qodana report

To be able to view the detailed Qodana report, you can either:

Register at Qodana Cloud and configure the action
Use GitHub Code Scanning with Qodana
Host Qodana report at GitHub Pages
Inspect and use qodana.sarif.json (see the Qodana SARIF format for details)

To get *.log files or any other Qodana artifacts, run the action with upload-result option set to true,
so that the action will upload the files as the job artifacts:

      - name: 'Qodana Scan'
        uses: JetBrains/qodana-action@v2025.1.1
        with:
          upload-result: true

Contact Qodana team

Contact us at qodana-support@jetbrains.com

Or via our issue tracker: https://jb.gg/qodana-issue
Or share your feedback: https://jb.gg/qodana-discussions

laileni-aws requested a review from a team as a code owner March 16, 2026 22:42

github-advanced-security bot found potential problems Mar 16, 2026

View reviewed changes

laileni-aws closed this Mar 16, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci: Add GitHub Actions CI for Linux and Windows, update Mac workflow#35

ci: Add GitHub Actions CI for Linux and Windows, update Mac workflow#35
laileni-aws wants to merge 1 commit intomainfrom
feature/ci-builds

laileni-aws commented Mar 16, 2026

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

github-actions bot commented Mar 16, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

laileni-aws commented Mar 16, 2026

Summary

Workflows

Build config fixes

Platform-specific notes

Common configuration across all workflows

Checklist

License

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

github-actions bot commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Qodana for JVM

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

github-actions bot commented Mar 16, 2026 •

edited

Loading