Merge branch 'main' into nt/gracefully-terminate-bk-agents

Author: omehegan

.buildkite/docker-compose.yml

@@ -2,7 +2,7 @@ version: '3'
 
 services:
   fixperms-tests:
-    image: golang:1.23
+    image: golang:1.24
     working_dir: /code
     environment:
       CGO_ENABLED: 0
@@ -11,7 +11,7 @@ services:
     command: go test -v ./...
 
   ruby:
-    image: ruby:3.3
+    image: ruby:3.4
     working_dir: /work
     environment:
       - DRY_RUN

.buildkite/pipeline.cleanamis.yaml

@@ -29,9 +29,14 @@ steps:
       - "me-south-1"
       - "sa-east-1"
     plugins:
-      - aws-assume-role-with-web-identity#v1.1.0:
+      - aws-assume-role-with-web-identity#v1.4.0:
           role-arn: arn:aws:iam::172840064832:role/pipeline-buildkite-elastic-stack-for-aws-ami-cleaner
-      - docker-compose#v5.4.1:
+          session-tags:
+            - organization_slug
+            - organization_id
+            - pipeline_slug
+            - branch_build
+      - docker-compose#v5.10.0:
           run: ruby
           config: .buildkite/docker-compose.yml
           propagate-aws-auth-tokens: true

.buildkite/pipeline.yaml

@@ -7,6 +7,17 @@ steps:
     agents:
       queue: "${BUILDKITE_AGENT_META_DATA_QUEUE}"
 
+  - id: "cfn-lint"
+    name: ":mag: cfn-lint"
+    command: .buildkite/steps/cfn-lint.sh
+    agents:
+      queue: "${BUILDKITE_AGENT_META_DATA_QUEUE}"
+    soft_fail:
+    # https://github.com/aws-cloudformation/cfn-lint#exit-codes
+      - exit_status: 4 # Warning
+      - exit_status: 8 # Informational
+      - exit_status: 12 # Warning and informational
+
   - label: ":bash: shfmt"
     key: fmt
     command: .buildkite/steps/shfmt.sh
@@ -18,7 +29,7 @@ steps:
     agents:
       queue: "${BUILDKITE_AGENT_META_DATA_QUEUE}"
     plugins:
-      - docker-compose#v2.1.0:
+      - docker-compose#v5.10.0:
           run: fixperms-tests
           config: .buildkite/docker-compose.yml
 
@@ -30,10 +41,15 @@ steps:
     depends_on:
       - "fmt"
       - "lint"
+      - "cfn-lint"
       - "fixperms-tests"
     plugins:
-      - aws-assume-role-with-web-identity#v1.1.0:
+      - aws-assume-role-with-web-identity#v1.4.0:
           role-arn: arn:aws:iam::172840064832:role/pipeline-buildkite-aws-stack-buildkite-aws-stack
+          session-tags:
+            - organization_slug
+            - organization_id
+            - pipeline_slug
 
   - id: "packer-windows-amd64"
     name: ":packer: :windows:"
@@ -45,10 +61,15 @@ steps:
     depends_on:
       - "fmt"
       - "lint"
+      - "cfn-lint"
       - "fixperms-tests"
     plugins:
-      - aws-assume-role-with-web-identity#v1.1.0:
+      - aws-assume-role-with-web-identity#v1.4.0:
           role-arn: arn:aws:iam::172840064832:role/pipeline-buildkite-aws-stack-buildkite-aws-stack
+          session-tags:
+            - organization_slug
+            - organization_id
+            - pipeline_slug
 
   - id: "launch-windows-amd64"
     name: ":cloudformation: :windows: AMD64 Launch"
@@ -60,15 +81,19 @@ steps:
       - "packer-windows-amd64"
       - "deploy-service-role-stack"
     plugins:
-      - aws-assume-role-with-web-identity#v1.1.0:
+      - aws-assume-role-with-web-identity#v1.4.0:
           role-arn: arn:aws:iam::172840064832:role/pipeline-buildkite-aws-stack-buildkite-aws-stack
+          session-tags:
+            - organization_slug
+            - organization_id
+            - pipeline_slug
 
   - id: "test-windows-amd64"
     name: ":cloudformation: :windows: AMD64 Test"
     command:
       - git --version
       - docker info
-      - docker run --rm mcr.microsoft.com/windows/nanoserver:ltsc2019 cmd.exe /c echo hello
+      - docker run --rm mcr.microsoft.com/windows/nanoserver:ltsc2022 cmd.exe /c echo hello
     timeout_in_minutes: 5
     agents:
       stack: "buildkite-aws-stack-test-windows-amd64-${BUILDKITE_BUILD_NUMBER}"
@@ -85,8 +110,12 @@ steps:
     depends_on:
       - "test-windows-amd64"
     plugins:
-      - aws-assume-role-with-web-identity#v1.1.0:
+      - aws-assume-role-with-web-identity#v1.4.0:
           role-arn: arn:aws:iam::172840064832:role/pipeline-buildkite-aws-stack-buildkite-aws-stack
+          session-tags:
+            - organization_slug
+            - organization_id
+            - pipeline_slug
 
   - id: "packer-linux-amd64"
     name: ":packer: :linux: AMD64"
@@ -98,10 +127,15 @@ steps:
     depends_on:
       - "fmt"
       - "lint"
+      - "cfn-lint"
       - "fixperms-tests"
     plugins:
-      - aws-assume-role-with-web-identity#v1.1.0:
+      - aws-assume-role-with-web-identity#v1.4.0:
           role-arn: arn:aws:iam::172840064832:role/pipeline-buildkite-aws-stack-buildkite-aws-stack
+          session-tags:
+            - organization_slug
+            - organization_id
+            - pipeline_slug
 
   - id: "launch-linux-amd64"
     name: ":cloudformation: :linux: AMD64 Launch"
@@ -113,8 +147,12 @@ steps:
       - "packer-linux-amd64"
       - "deploy-service-role-stack"
     plugins:
-      - aws-assume-role-with-web-identity#v1.1.0:
+      - aws-assume-role-with-web-identity#v1.4.0:
           role-arn: arn:aws:iam::172840064832:role/pipeline-buildkite-aws-stack-buildkite-aws-stack
+          session-tags:
+            - organization_slug
+            - organization_id
+            - pipeline_slug
 
   - id: "test-linux-amd64"
     name: ":cloudformation: :linux: AMD64 Test"
@@ -137,8 +175,12 @@ steps:
     depends_on:
       - "test-linux-amd64"
     plugins:
-      - aws-assume-role-with-web-identity#v1.1.0:
+      - aws-assume-role-with-web-identity#v1.4.0:
           role-arn: arn:aws:iam::172840064832:role/pipeline-buildkite-aws-stack-buildkite-aws-stack
+          session-tags:
+            - organization_slug
+            - organization_id
+            - pipeline_slug
 
   - id: "packer-linux-arm64"
     name: ":packer: :linux: ARM64"
@@ -150,10 +192,15 @@ steps:
     depends_on:
       - "fmt"
       - "lint"
+      - "cfn-lint"
       - "fixperms-tests"
     plugins:
-      - aws-assume-role-with-web-identity#v1.1.0:
+      - aws-assume-role-with-web-identity#v1.4.0:
           role-arn: arn:aws:iam::172840064832:role/pipeline-buildkite-aws-stack-buildkite-aws-stack
+          session-tags:
+            - organization_slug
+            - organization_id
+            - pipeline_slug
 
   - id: "launch-linux-arm64"
     name: ":cloudformation: :linux: ARM64 Launch"
@@ -165,8 +212,12 @@ steps:
       - "packer-linux-arm64"
       - "deploy-service-role-stack"
     plugins:
-      - aws-assume-role-with-web-identity#v1.1.0:
+      - aws-assume-role-with-web-identity#v1.4.0:
           role-arn: arn:aws:iam::172840064832:role/pipeline-buildkite-aws-stack-buildkite-aws-stack
+          session-tags:
+            - organization_slug
+            - organization_id
+            - pipeline_slug
 
   - id: "test-linux-arm64"
     name: ":cloudformation: :linux: ARM64 Test"
@@ -189,8 +240,12 @@ steps:
     depends_on:
       - "test-linux-arm64"
     plugins:
-      - aws-assume-role-with-web-identity#v1.1.0:
+      - aws-assume-role-with-web-identity#v1.4.0:
           role-arn: arn:aws:iam::172840064832:role/pipeline-buildkite-aws-stack-buildkite-aws-stack
+          session-tags:
+            - organization_slug
+            - organization_id
+            - pipeline_slug
 
   - id: "delete-service-role-stack"
     name: ":aws-iam: :cloudformation: Delete"
@@ -202,8 +257,12 @@ steps:
       - "delete-linux-amd64"
       - "delete-linux-arm64"
     plugins:
-      - aws-assume-role-with-web-identity#v1.1.0:
+      - aws-assume-role-with-web-identity#v1.4.0:
           role-arn: arn:aws:iam::172840064832:role/pipeline-buildkite-aws-stack-buildkite-aws-stack
+          session-tags:
+            - organization_slug
+            - organization_id
+            - pipeline_slug
 
   - id: "copy-ami"
     name: ":cloudformation: 🚚 🌎"
@@ -216,8 +275,12 @@ steps:
       - "test-linux-arm64"
       - "test-windows-amd64"
     plugins:
-      - aws-assume-role-with-web-identity#v1.1.0:
+      - aws-assume-role-with-web-identity#v1.4.0:
           role-arn: arn:aws:iam::172840064832:role/pipeline-buildkite-aws-stack-buildkite-aws-stack
+          session-tags:
+            - organization_slug
+            - organization_id
+            - pipeline_slug
 
   - id: "publish"
     name: ":cloudformation: :rocket:"
@@ -230,8 +293,12 @@ steps:
     artifact_paths: "build/*.yml"
     depends_on: "copy-ami"
     plugins:
-      - aws-assume-role-with-web-identity#v1.1.0:
+      - aws-assume-role-with-web-identity#v1.4.0:
           role-arn: arn:aws:iam::172840064832:role/pipeline-buildkite-aws-stack-buildkite-aws-stack
+          session-tags:
+            - organization_slug
+            - organization_id
+            - pipeline_slug
 
   - id: cleanup
     name: ":broom: Cleanup"
@@ -240,5 +307,9 @@ steps:
       queue: "${BUILDKITE_AGENT_META_DATA_QUEUE}"
     depends_on: "publish"
     plugins:
-      - aws-assume-role-with-web-identity#v1.1.0:
+      - aws-assume-role-with-web-identity#v1.4.0:
           role-arn: arn:aws:iam::172840064832:role/pipeline-buildkite-aws-stack-buildkite-aws-stack
+          session-tags:
+            - organization_slug
+            - organization_id
+            - pipeline_slug

.buildkite/scripts/generate-changelog.sh

@@ -0,0 +1,41 @@
+#!/bin/bash
+set -euo pipefail
+
+if [[ -z "${1:-}" ]]; then
+  echo "Usage: $0 <VERSION>"
+  echo "Example: $0 v5.5.0"
+  exit 1
+fi
+
+RELEASE_VERSION=$1
+
+# 1. Get the previous release tag, excluding the current release version
+PREVIOUS_TAG=$(git describe --tags --abbrev=0 --match='v*' --exclude="$RELEASE_VERSION")
+
+# 2. Generate the changelog with ghch
+echo "--- Generating changelog from ${PREVIOUS_TAG} to ${RELEASE_VERSION}"
+CHANGELOG_BODY=$(ghch --format=markdown --from="$PREVIOUS_TAG" --next-version="$RELEASE_VERSION")
+
+# 3. Check for Buildkite Agent updates
+AGENT_INSTALL_SCRIPT_LINUX="packer/linux/scripts/install-buildkite-agent.sh"
+AGENT_INSTALL_SCRIPT_WINDOWS="packer/windows/scripts/install-buildkite-agent.ps1"
+
+if git diff --name-only "$PREVIOUS_TAG..HEAD" -- "$AGENT_INSTALL_SCRIPT_LINUX" "$AGENT_INSTALL_SCRIPT_WINDOWS" | grep -q "."; then
+  echo "--- Buildkite Agent version has changed. Fetching agent release notes."
+  AGENT_VERSION=$(grep "AGENT_VERSION=" "$AGENT_INSTALL_SCRIPT_LINUX" | cut -d'=' -f2)
+  AGENT_RELEASE_NOTES=$(gh release view "v${AGENT_VERSION}" --repo "buildkite/agent" --json body -q .body)
+  AGENT_CHANGELOG_DETAILS="<details>\n  <summary><h3>Agent Changelog</h3></summary>\n\n${AGENT_RELEASE_NOTES}\n</details>"
+  CHANGELOG_BODY+="\n\n${AGENT_CHANGELOG_DETAILS}"
+fi
+
+# 4. Update CHANGELOG.md, preserving the header
+echo "--- Updating CHANGELOG.md"
+CHANGELOG_HEADER=$(head -n 5 CHANGELOG.md)
+CHANGELOG_REST=$(tail -n +6 CHANGELOG.md)
+
+# Construct the new file content
+NEW_CHANGELOG_CONTENT="${CHANGELOG_HEADER}\n\n${CHANGELOG_BODY}\n\n${CHANGELOG_REST}"
+
+echo -e "$NEW_CHANGELOG_CONTENT" >CHANGELOG.md
+
+echo "CHANGELOG.md has been updated for ${RELEASE_VERSION}. Please review and create a pull request."

.buildkite/steps/cfn-lint.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+set -euo pipefail
+
+echo "--- Installing cfn-lint"
+pip install -q cfn-lint==1.36.0
+
+echo "--- Running cfn-lint on templates in templates/"
+# cfn-lint will scan all *.json, *.yaml, *.yml, *.template files in the directory and subdirectories.
+/var/lib/buildkite-agent/.local/bin/cfn-lint templates/*

.cfnlintrc

@@ -0,0 +1,2 @@
+ignore_checks:
+  - E1011

.github/workflows/linear_issue_open.yml

@@ -15,7 +15,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: "22"
 
       - name: Create Linear Issue
         uses: actions/github-script@v7