Skip to content

Commit 01a13f4

Browse files
imabhichowimabhichow
committed
chore: validate release
1 parent cbfab66 commit 01a13f4

File tree

3 files changed

+219
-0
lines changed

3 files changed

+219
-0
lines changed

‎.github/workflows/ci_codebuild_batch.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1297,6 +1297,48 @@ jobs:
12971297
project-name: python-esdk
12981298
buildspec-override: codebuild/py312/decrypt_golden_manifest_with_masterkey.yml
12991299
image-override: aws/codebuild/standard:7.0
1300+
1301+
# Python Release Validation with test vectors
1302+
python_release_validation:
1303+
name: Python Release Validation with Test Vectors
1304+
runs-on: ubuntu-latest
1305+
steps:
1306+
- name: Configure AWS Credentials
1307+
uses: aws-actions/configure-aws-credentials@v2
1308+
with:
1309+
role-to-assume: ${{ secrets.CI_AWS_ROLE_ARN }}
1310+
aws-region: us-west-2
1311+
role-duration-seconds: 7200
1312+
- name: Run CodeBuild
1313+
uses: aws-actions/aws-codebuild-run-build@v1
1314+
timeout-minutes: 120
1315+
env:
1316+
VERSION: "4.0.2"
1317+
with:
1318+
project-name: python-esdk
1319+
buildspec-override: codebuild/release/validate_test_vectors.yml
1320+
image-override: aws/codebuild/standard:7.0
1321+
1322+
# Python Release Validation with examples as alternate
1323+
python_release_examples_validation:
1324+
name: Python Release Validation with Examples
1325+
runs-on: ubuntu-latest
1326+
steps:
1327+
- name: Configure AWS Credentials
1328+
uses: aws-actions/configure-aws-credentials@v2
1329+
with:
1330+
role-to-assume: ${{ secrets.CI_AWS_ROLE_ARN }}
1331+
aws-region: us-west-2
1332+
role-duration-seconds: 7200
1333+
- name: Run CodeBuild
1334+
uses: aws-actions/aws-codebuild-run-build@v1
1335+
timeout-minutes: 120
1336+
env:
1337+
VERSION: "4.0.2"
1338+
with:
1339+
project-name: python-esdk
1340+
buildspec-override: codebuild/release/validate_released_with_examples.yml
1341+
image-override: aws/codebuild/standard:7.0
13001342

13011343
# Code Coverage and Compliance jobs
13021344
code_coverage:

‎codebuild/release/validate_released_with_examples.yml‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
version: 0.2
2+
3+
env:
4+
variables:
5+
# VERSION should be passed in from the build environment
6+
# Example: VERSION=4.02
7+
REGION: "us-west-2"
8+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID: >-
9+
arn:aws:kms:us-west-2:658956600833:key/b3537ef1-d8dc-4780-9f5a-55776cbb2f7f
10+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID_2: >-
11+
arn:aws:kms:eu-central-1:658956600833:key/75414c93-5285-4b57-99c9-30c1cf0a22c2
12+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_1: >-
13+
arn:aws:kms:us-west-2:658956600833:key/mrk-80bd8ecdcd4342aebd84b7dc9da498a7
14+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_2: >-
15+
arn:aws:kms:us-east-1:658956600833:key/mrk-80bd8ecdcd4342aebd84b7dc9da498a7
16+
17+
phases:
18+
install:
19+
runtime-versions:
20+
python: 3.11
21+
commands:
22+
# Ensure VERSION is set
23+
- |
24+
if [ -z "$VERSION" ]; then
25+
echo "ERROR: VERSION environment variable is not set"
26+
echo "Please set VERSION to the released version to validate (e.g. VERSION=4.02)"
27+
exit 1
28+
fi
29+
# Install the released package instead of the source
30+
- echo "Installing aws-encryption-sdk version $VERSION"
31+
- pip install "aws-encryption-sdk==$VERSION"
32+
- pip install "tox < 4.0"
33+
build:
34+
commands:
35+
# Create a simple tox.ini file for running examples with the installed package
36+
- |
37+
cat > release_validation_tox.ini << 'EOF'
38+
[tox]
39+
envlist = py311
40+
skipsdist = True
41+
42+
[testenv]
43+
passenv =
44+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID
45+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID_2
46+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_1
47+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_2
48+
AWS_ACCESS_KEY_ID
49+
AWS_SECRET_ACCESS_KEY
50+
AWS_SESSION_TOKEN
51+
AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
52+
AWS_PROFILE
53+
deps =
54+
pytest
55+
pytest-mock
56+
mock
57+
coverage
58+
pyyaml
59+
moto
60+
boto3
61+
cryptography
62+
commands =
63+
# Run non-MPL examples
64+
pytest examples/test/legacy/ -m examples
65+
# Run all other examples
66+
pytest examples/test/ -m examples --ignore examples/test/legacy/
67+
EOF
68+
69+
# Run the examples with NUM_RETRIES to handle transient failures
70+
- NUM_RETRIES=3
71+
- |
72+
while [ $NUM_RETRIES -gt 0 ]
73+
do
74+
tox -c release_validation_tox.ini -e py311
75+
if [ $? -eq 0 ]; then
76+
break
77+
fi
78+
NUM_RETRIES=$((NUM_RETRIES-1))
79+
if [ $NUM_RETRIES -eq 0 ]; then
80+
echo "All validation attempts failed, stopping"
81+
exit 1;
82+
else
83+
echo "Validation failed, retrying in 60 seconds; will retry $NUM_RETRIES more times" && sleep 60
84+
fi
85+
done
86+
87+
# Assume special role for MPL-specific tests
88+
- echo "Running tests with special role for MPL features"
89+
- TMP_ROLE=$(aws sts assume-role --role-arn "arn:aws:iam::370957321024:role/GitHub-CI-Public-ESDK-Python-Role-us-west-2" --role-session-name "CB-ValidateReleased")
90+
- export TMP_ROLE
91+
- export AWS_ACCESS_KEY_ID=$(echo "${TMP_ROLE}" | jq -r '.Credentials.AccessKeyId')
92+
- export AWS_SECRET_ACCESS_KEY=$(echo "${TMP_ROLE}" | jq -r '.Credentials.SecretAccessKey')
93+
- export AWS_SESSION_TOKEN=$(echo "${TMP_ROLE}" | jq -r '.Credentials.SessionToken')
94+
- aws sts get-caller-identity
95+
96+
# Also install MPL requirements
97+
- pip install -r requirements_mpl.txt
98+
99+
# Run MPL-specific examples
100+
- NUM_RETRIES=3
101+
- |
102+
while [ $NUM_RETRIES -gt 0 ]
103+
do
104+
# Only run the MPL-specific tests that require special permissions
105+
# These would normally be run with py311-mplexamples-mpl
106+
python -m pytest examples/test/ -m examples --ignore examples/test/legacy/
107+
if [ $? -eq 0 ]; then
108+
break
109+
fi
110+
NUM_RETRIES=$((NUM_RETRIES-1))
111+
if [ $NUM_RETRIES -eq 0 ]; then
112+
echo "All MPL validation attempts failed, stopping"
113+
exit 1;
114+
else
115+
echo "MPL validation failed, retrying in 60 seconds; will retry $NUM_RETRIES more times" && sleep 60
116+
fi
117+
done

‎codebuild/release/validate_test_vectors.yml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
version: 0.2
2+
3+
# Validation script for aws-encryption-sdk using test vectors to verify cryptographic operations
4+
# and interoperability with the keyring model
5+
6+
phases:
7+
install:
8+
commands:
9+
- pip install "tox < 4.0" poetry
10+
- pip install --upgrade pip
11+
runtime-versions:
12+
python: latest
13+
dotnet: 6.0
14+
pre_build:
15+
commands:
16+
# Setup environment
17+
- aws configure set region us-west-2
18+
- git clone https://github.com/aws/aws-encryption-sdk.git esdk-dafny
19+
- cd esdk-dafny && git submodule update --init --recursive && cd ..
20+
# Install packages and setup environments
21+
- pip install aws-encryption-sdk==$VERSION
22+
- pyenv install --skip-existing 3.11.0 && pyenv local 3.11.0
23+
- make -C esdk-dafny/mpl/StandardLibrary setup_net
24+
- pip install pytest boto3 attrs cryptography
25+
# Update the aws-encryption-sdk version in TestVectors
26+
- sed -i "s/aws-encryption-sdk = \">=4.0.1\"/aws-encryption-sdk = \"==$VERSION\"/" \
27+
esdk-dafny/TestVectors/runtimes/python/pyproject.toml
28+
build:
29+
commands:
30+
- NUM_RETRIES=3
31+
- |
32+
run_command() {
33+
eval "$1"
34+
return $?
35+
}
36+
37+
# Navigate to TestVectors directory
38+
cd esdk-dafny/TestVectors || exit 1
39+
40+
while [ $NUM_RETRIES -gt 0 ]
41+
do
42+
43+
# Build TestVectors implementation in Python
44+
CORES=$(nproc || echo 4)
45+
if ! run_command "make transpile_python CORES=$CORES"; then
46+
NUM_RETRIES=$((NUM_RETRIES-1))
47+
[ $NUM_RETRIES -gt 0 ] && sleep 60 && continue
48+
exit 1
49+
fi
50+
51+
# Run all the test vector commands together
52+
if ! run_command "make test_generate_vectors_python && make test_encrypt_vectors_python && make test_decrypt_encrypt_vectors_python"; then
53+
NUM_RETRIES=$((NUM_RETRIES-1))
54+
[ $NUM_RETRIES -gt 0 ] && sleep 60 && continue
55+
exit 1
56+
fi
57+
58+
# Success
59+
break
60+
done

0 commit comments

Comments
 (0)