Skip to content

Commit deb0e1b

Browse files
imabhichowimabhichow
committed
chore: validate release
1 parent cbfab66 commit deb0e1b

File tree

3 files changed

+222
-0
lines changed

3 files changed

+222
-0
lines changed

‎.github/workflows/ci_codebuild_batch.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1297,6 +1297,45 @@ jobs:
12971297
project-name: python-esdk
12981298
buildspec-override: codebuild/py312/decrypt_golden_manifest_with_masterkey.yml
12991299
image-override: aws/codebuild/standard:7.0
1300+
1301+
# Python Release Validation with test vectors
1302+
python_release_validation:
1303+
name: Python Release Validation with Test Vectors
1304+
runs-on: ubuntu-latest
1305+
steps:
1306+
- name: Configure AWS Credentials
1307+
uses: aws-actions/configure-aws-credentials@v2
1308+
with:
1309+
role-to-assume: ${{ secrets.CI_AWS_ROLE_ARN }}
1310+
aws-region: us-west-2
1311+
role-duration-seconds: 7200
1312+
- name: Run CodeBuild
1313+
uses: aws-actions/aws-codebuild-run-build@v1
1314+
timeout-minutes: 120
1315+
with:
1316+
project-name: python-esdk
1317+
buildspec-override: codebuild/release/validate_test_vectors.yml
1318+
image-override: aws/codebuild/standard:7.0
1319+
1320+
1321+
# Python Release Validation with examples as alternate
1322+
python_release_examples_validation:
1323+
name: Python Release Validation with Examples
1324+
runs-on: ubuntu-latest
1325+
steps:
1326+
- name: Configure AWS Credentials
1327+
uses: aws-actions/configure-aws-credentials@v2
1328+
with:
1329+
role-to-assume: ${{ secrets.CI_AWS_ROLE_ARN }}
1330+
aws-region: us-west-2
1331+
role-duration-seconds: 7200
1332+
- name: Run CodeBuild
1333+
uses: aws-actions/aws-codebuild-run-build@v1
1334+
timeout-minutes: 120
1335+
with:
1336+
project-name: python-esdk
1337+
buildspec-override: codebuild/release/validate_released_with_examples.yml
1338+
image-override: aws/codebuild/standard:7.0
13001339

13011340
# Code Coverage and Compliance jobs
13021341
code_coverage:

‎codebuild/release/validate_released_with_examples.yml‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
version: 0.2
2+
3+
env:
4+
variables:
5+
# Default VERSION if not provided externally
6+
VERSION: 4.0.2
7+
REGION: "us-west-2"
8+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID: >-
9+
arn:aws:kms:us-west-2:658956600833:key/b3537ef1-d8dc-4780-9f5a-55776cbb2f7f
10+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID_2: >-
11+
arn:aws:kms:eu-central-1:658956600833:key/75414c93-5285-4b57-99c9-30c1cf0a22c2
12+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_1: >-
13+
arn:aws:kms:us-west-2:658956600833:key/mrk-80bd8ecdcd4342aebd84b7dc9da498a7
14+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_2: >-
15+
arn:aws:kms:us-east-1:658956600833:key/mrk-80bd8ecdcd4342aebd84b7dc9da498a7
16+
17+
phases:
18+
install:
19+
runtime-versions:
20+
python: 3.11
21+
commands:
22+
# Check VERSION is available from either environment or env.variables
23+
- |
24+
if [ -z "$VERSION" ]; then
25+
echo "Using default VERSION=$VERSION"
26+
else
27+
echo "Using provided VERSION=$VERSION"
28+
fi
29+
# Install the released package instead of the source
30+
- echo "Installing aws-encryption-sdk version $VERSION"
31+
- pip install "aws-encryption-sdk==$VERSION"
32+
- pip install "tox < 4.0"
33+
build:
34+
commands:
35+
# Create a simple tox.ini file for running examples with the installed package
36+
- |
37+
cat > release_validation_tox.ini << 'EOF'
38+
[tox]
39+
envlist = py311
40+
skipsdist = True
41+
42+
[testenv]
43+
passenv =
44+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID
45+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID_2
46+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_1
47+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_2
48+
AWS_ACCESS_KEY_ID
49+
AWS_SECRET_ACCESS_KEY
50+
AWS_SESSION_TOKEN
51+
AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
52+
AWS_PROFILE
53+
deps =
54+
pytest
55+
pytest-mock
56+
mock
57+
coverage
58+
pyyaml
59+
moto
60+
boto3
61+
cryptography
62+
commands =
63+
# Run non-MPL examples
64+
pytest examples/test/legacy/ -m examples
65+
# Run all other examples
66+
pytest examples/test/ -m examples --ignore examples/test/legacy/
67+
EOF
68+
69+
# Run the examples with NUM_RETRIES to handle transient failures
70+
- NUM_RETRIES=3
71+
- |
72+
while [ $NUM_RETRIES -gt 0 ]
73+
do
74+
tox -c release_validation_tox.ini -e py311
75+
if [ $? -eq 0 ]; then
76+
break
77+
fi
78+
NUM_RETRIES=$((NUM_RETRIES-1))
79+
if [ $NUM_RETRIES -eq 0 ]; then
80+
echo "All validation attempts failed, stopping"
81+
exit 1;
82+
else
83+
echo "Validation failed, retrying in 60 seconds; will retry $NUM_RETRIES more times" && sleep 60
84+
fi
85+
done
86+
87+
# Assume special role for MPL-specific tests
88+
- echo "Running tests with special role for MPL features"
89+
- TMP_ROLE=$(aws sts assume-role --role-arn "arn:aws:iam::370957321024:role/GitHub-CI-Public-ESDK-Python-Role-us-west-2" --role-session-name "CB-ValidateReleased")
90+
- export TMP_ROLE
91+
- export AWS_ACCESS_KEY_ID=$(echo "${TMP_ROLE}" | jq -r '.Credentials.AccessKeyId')
92+
- export AWS_SECRET_ACCESS_KEY=$(echo "${TMP_ROLE}" | jq -r '.Credentials.SecretAccessKey')
93+
- export AWS_SESSION_TOKEN=$(echo "${TMP_ROLE}" | jq -r '.Credentials.SessionToken')
94+
- aws sts get-caller-identity
95+
96+
# Also install MPL requirements
97+
- pip install -r requirements_mpl.txt
98+
99+
# Run MPL-specific examples
100+
- NUM_RETRIES=3
101+
- |
102+
while [ $NUM_RETRIES -gt 0 ]
103+
do
104+
# Only run the MPL-specific tests that require special permissions
105+
# These would normally be run with py311-mplexamples-mpl
106+
python -m pytest examples/test/ -m examples --ignore examples/test/legacy/
107+
if [ $? -eq 0 ]; then
108+
break
109+
fi
110+
NUM_RETRIES=$((NUM_RETRIES-1))
111+
if [ $NUM_RETRIES -eq 0 ]; then
112+
echo "All MPL validation attempts failed, stopping"
113+
exit 1;
114+
else
115+
echo "MPL validation failed, retrying in 60 seconds; will retry $NUM_RETRIES more times" && sleep 60
116+
fi
117+
done

‎codebuild/release/validate_test_vectors.yml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
version: 0.2
2+
3+
# Validation script for aws-encryption-sdk using test vectors to verify cryptographic operations
4+
# and interoperability with the keyring model
5+
6+
env:
7+
variables:
8+
# Default VERSION if not provided externally
9+
VERSION: 4.0.2
10+
11+
phases:
12+
install:
13+
commands:
14+
- pip install "tox < 4.0" poetry
15+
- pip install --upgrade pip
16+
runtime-versions:
17+
python: latest
18+
dotnet: 6.0
19+
pre_build:
20+
commands:
21+
# Setup environment
22+
- aws configure set region us-west-2
23+
- git clone https://github.com/aws/aws-encryption-sdk.git esdk-dafny
24+
- cd esdk-dafny && git submodule update --init --recursive && cd ..
25+
# Install packages and setup environments
26+
- echo "Installing aws-encryption-sdk version $VERSION"
27+
- pip install "aws-encryption-sdk==$VERSION"
28+
- pyenv install --skip-existing 3.11.0 && pyenv local 3.11.0
29+
- make -C esdk-dafny/mpl/StandardLibrary setup_net
30+
- pip install pytest boto3 attrs cryptography
31+
# Update the aws-encryption-sdk version in TestVectors
32+
- sed -i "s/aws-encryption-sdk = \">=4.0.1\"/aws-encryption-sdk = \"==$VERSION\"/" \
33+
esdk-dafny/TestVectors/runtimes/python/pyproject.toml
34+
build:
35+
commands:
36+
- NUM_RETRIES=3
37+
- |
38+
run_command() {
39+
eval "$1"
40+
return $?
41+
}
42+
43+
# Navigate to TestVectors directory
44+
cd esdk-dafny/TestVectors || exit 1
45+
46+
while [ $NUM_RETRIES -gt 0 ]
47+
do
48+
49+
# Build TestVectors implementation in Python
50+
CORES=$(nproc || echo 4)
51+
if ! run_command "make transpile_python CORES=$CORES"; then
52+
NUM_RETRIES=$((NUM_RETRIES-1))
53+
[ $NUM_RETRIES -gt 0 ] && sleep 60 && continue
54+
exit 1
55+
fi
56+
57+
# Run all the test vector commands together
58+
if ! run_command "make test_generate_vectors_python && make test_encrypt_vectors_python && make test_decrypt_encrypt_vectors_python"; then
59+
NUM_RETRIES=$((NUM_RETRIES-1))
60+
[ $NUM_RETRIES -gt 0 ] && sleep 60 && continue
61+
exit 1
62+
fi
63+
64+
# Success
65+
break
66+
done

0 commit comments

Comments
 (0)