Merge branch 'main' into caching-tests-clean

Signed-off-by: Simon Marty <martysi@amazon.com>

Author: simonmarty

.github/workflows/integration-tests.yml

@@ -24,16 +24,26 @@ jobs:
     permissions:
       id-token: write
       contents: read
+      issues: write
       pull-requests: write
+
+    env:
+      LABEL_NAME: safe-to-test
+      REPO: ${{ github.event.pull_request.base.repo.full_name }}
+      PR_NUMBER: ${{ github.event.pull_request.number }}
 
     steps:
-    - name: Remove safe-to-test label after use
-      if: github.event_name == 'pull_request_target' && contains(github.event.pull_request.labels.*.name, 'safe-to-test')
+    - name: Remove label
       run: |
-        gh api repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/labels/safe-to-test -X DELETE || true
+        echo "Removing label '$LABEL_NAME' from PR #$PR_NUMBER on repo $REPO" 
+        gh_status=$(gh api "repos/$OWNER/$REPO/issues/$PR_NUMBER/labels/$LABEL_NAME" -X DELETE | jq ".status" --raw-output)
+        case $gh_status in
+          200) echo "Label removed" ;;
+          404) echo "Label not found — ignoring" ;;
+          *) echo "unexpected HTTP $gh_status" && exit 1 ;;
+        esac
       env:
         GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    
     - name: Checkout
       uses: actions/checkout@v5
       with:

README.md

@@ -41,6 +41,10 @@ To build the Secrets Manager Agent binary natively, you need the standard develo
 
 ------
 
+**NOTE:** To ensure a stable experience, use a specific git tag when building from source code. You can find a list of version tags [here](https://github.com/aws/aws-secretsmanager-agent/tags). Tags are in the pattern `/v\d+\.\d+\.\d+/` and follow [SemVer 2.0.0](https://semver.org/spec/v2.0.0.html).
+
+Example: `git clone --branch <git tag> https://github.com/aws/aws-secretsmanager-agent.git`
+
 **NOTE:** Building the agent with the `fips` feature enabled on macOS currently requires the following workaround:
 
 - Create an environment variable called `SDKROOT` which is set to the result of running `xcrun --show-sdk-path`