Repository navigation
feat(cli): gate standalone resource command families #2569
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: PR Automation | ||
|
Check warning on line 1 in .github/workflows/pr-automation.yml
|
||
| on: | ||
| pull_request_target: | ||
| branches: [main, refactor, "feat/**"] | ||
| types: [opened, reopened, edited, synchronize, labeled] | ||
| workflow_dispatch: | ||
| inputs: | ||
| automation: | ||
| description: Automation to run | ||
| required: true | ||
| type: choice | ||
| options: [harness-review, security-review, pr-tarball] | ||
| pr_number: | ||
| description: Pull request number | ||
| required: true | ||
| type: string | ||
| jobs: | ||
| size-title: | ||
| if: | | ||
| github.event_name == 'pull_request_target' && | ||
| contains(fromJSON('["opened","reopened","edited","synchronize"]'), github.event.action) | ||
| permissions: | ||
| contents: read | ||
| pull-requests: write | ||
| statuses: write | ||
| uses: aws/agentcore-devx-devtools/.github/workflows/reusable-pr-size-title.yml@458c0a684af0f9e3a013ec05cd23851def4f9cab | ||
| with: | ||
| runner: codebuild | ||
| secrets: inherit | ||
| security-review: | ||
| if: | | ||
| (github.event_name == 'workflow_dispatch' && inputs.automation == 'security-review') || | ||
| ( | ||
| github.event_name == 'pull_request_target' && | ||
| contains(fromJSON('["opened","reopened","synchronize","labeled"]'), github.event.action) | ||
| ) | ||
| permissions: | ||
| id-token: write | ||
| pull-requests: write | ||
| issues: write | ||
| contents: read | ||
| uses: aws/agentcore-devx-devtools/.github/workflows/reusable-pr-security-review.yml@4b3972e790e4cc312ddf6f1909a0b6ca8a749506 | ||
| with: | ||
| runner: codebuild | ||
| pr_number: ${{ inputs.pr_number || format('{0}', github.event.pull_request.number) }} | ||
| allowed_base_branches: '["main","refactor"]' | ||
| secrets: inherit | ||
| harness-review: | ||
| if: | | ||
| (github.event_name == 'workflow_dispatch' && inputs.automation == 'harness-review') || | ||
| ( | ||
| github.event_name == 'pull_request_target' && | ||
| contains(fromJSON('["opened","reopened"]'), github.event.action) | ||
| ) | ||
| permissions: | ||
| id-token: write | ||
| pull-requests: write | ||
| issues: write | ||
| contents: read | ||
| uses: aws/agentcore-devx-devtools/.github/workflows/reusable-pr-ai-review.yml@4b3972e790e4cc312ddf6f1909a0b6ca8a749506 | ||
| with: | ||
| runner: codebuild | ||
| model_id: us.anthropic.claude-opus-5 | ||
| pr_url: >- | ||
| ${{ github.event_name == 'workflow_dispatch' && | ||
| format('{0}/{1}/pull/{2}', github.server_url, github.repository, inputs.pr_number) || | ||
| github.event.pull_request.html_url }} | ||
| secret_source: secrets-manager | ||
| system_prompt_path: .github/harness/prompts/system.md | ||
| review_prompt_path: .github/harness/prompts/review.md | ||
| secrets: inherit | ||
| tarball-authorize: | ||
| if: | | ||
| (github.event_name == 'workflow_dispatch' && inputs.automation == 'pr-tarball') || | ||
| ( | ||
| github.event_name == 'pull_request_target' && | ||
| contains(fromJSON('["opened","reopened","synchronize"]'), github.event.action) | ||
| ) | ||
| runs-on: codebuild-agentcore-e2e-${{ github.run_id }}-${{ github.run_attempt }} | ||
| permissions: | ||
| id-token: write | ||
| contents: read | ||
| outputs: | ||
| is_authorized: ${{ steps.check.outputs.is_authorized }} | ||
| pr_number: ${{ steps.pr.outputs.number }} | ||
| head_sha: ${{ steps.pr.outputs.head_sha }} | ||
| steps: | ||
| - name: Resolve PR | ||
| id: pr | ||
| env: | ||
| GH_TOKEN: ${{ github.token }} | ||
| PR_NUMBER: ${{ inputs.pr_number || github.event.pull_request.number }} | ||
| run: | | ||
| if [[ ! "$PR_NUMBER" =~ ^[0-9]+$ ]]; then | ||
| echo "::error::Invalid PR number: $PR_NUMBER" | ||
| exit 1 | ||
| fi | ||
| pr="$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}")" | ||
| author="$(jq -r '.user.login' <<< "$pr")" | ||
| base_ref="$(jq -r '.base.ref' <<< "$pr")" | ||
| head_sha="$(jq -r '.head.sha' <<< "$pr")" | ||
| state="$(jq -r '.state' <<< "$pr")" | ||
| if [[ "$state" != "open" ]]; then | ||
| echo "::error::PR #${PR_NUMBER} is not open" | ||
| exit 1 | ||
| fi | ||
| case "$base_ref" in | ||
| main|refactor|feat/*) ;; | ||
| *) | ||
| echo "::error::Unsupported base branch: $base_ref" | ||
| exit 1 | ||
| ;; | ||
| esac | ||
| echo "number=$PR_NUMBER" >> "$GITHUB_OUTPUT" | ||
| echo "author=$author" >> "$GITHUB_OUTPUT" | ||
| echo "head_sha=$head_sha" >> "$GITHUB_OUTPUT" | ||
| - name: Fetch secrets from Secrets Manager | ||
| uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@31aa3b031a86664e29861d68956e44b07cf21a74 | ||
| with: | ||
| role-arn: ${{ secrets.WORKFLOW_SECRETS_READER_ROLE_ARN }} | ||
| repo: AUTHORIZED_USERS | ||
| - name: Check authorization | ||
| id: authz | ||
| uses: aws/agentcore-devx-devtools/.github/actions/check-authorized-user@31aa3b031a86664e29861d68956e44b07cf21a74 | ||
| with: | ||
| subject: ${{ steps.pr.outputs.author }} | ||
| authorized-users: ${{ env.AUTHORIZED_USERS }} | ||
| - name: Determine authorization | ||
| id: check | ||
| env: | ||
| IS_AUTHORIZED: ${{ steps.authz.outputs.is-authorized }} | ||
| PR_AUTHOR: ${{ steps.pr.outputs.author }} | ||
| run: | | ||
| if [[ "$IS_AUTHORIZED" == "true" ]]; then | ||
| echo "PR author ${PR_AUTHOR} is authorized" | ||
| echo "is_authorized=true" >> "$GITHUB_OUTPUT" | ||
| else | ||
| echo "PR author ${PR_AUTHOR} is not in AUTHORIZED_USERS, skipping" | ||
| echo "is_authorized=false" >> "$GITHUB_OUTPUT" | ||
| fi | ||
| pr-tarball: | ||
| needs: tarball-authorize | ||
| if: needs.tarball-authorize.outputs.is_authorized == 'true' | ||
| runs-on: codebuild-agentcore-e2e-${{ github.run_id }}-${{ github.run_attempt }} | ||
| timeout-minutes: 15 | ||
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
| steps: | ||
| - uses: actions/checkout@v7 | ||
| with: | ||
| ref: ${{ needs.tarball-authorize.outputs.head_sha }} | ||
| persist-credentials: false | ||
| allow-unsafe-pr-checkout: true | ||
| - uses: oven-sh/setup-bun@v2 | ||
| - run: bun install --frozen-lockfile | ||
| - run: bun run build | ||
| - name: Pack CLI | ||
| id: tarball | ||
| run: | | ||
| bun pm pack --destination "$RUNNER_TEMP" | ||
| tarball="$(find "$RUNNER_TEMP" -maxdepth 1 -type f -name 'aws-agentcore-*.tgz' -print -quit)" | ||
| test -f "$tarball" | ||
| echo "name=$(basename "$tarball")" >> "$GITHUB_OUTPUT" | ||
| echo "path=$tarball" >> "$GITHUB_OUTPUT" | ||
| - name: Generate GitHub App token | ||
| id: app-token | ||
| uses: actions/create-github-app-token@v3 | ||
| with: | ||
| app-id: ${{ vars.APP_ID }} | ||
| private-key: ${{ secrets.APP_PRIVATE_KEY }} | ||
| - name: Create or update PR release | ||
| id: release | ||
| env: | ||
| GH_TOKEN: ${{ steps.app-token.outputs.token }} | ||
| PR_NUMBER: ${{ needs.tarball-authorize.outputs.pr_number }} | ||
| TARBALL_NAME: ${{ steps.tarball.outputs.name }} | ||
| TARBALL_PATH: ${{ steps.tarball.outputs.path }} | ||
| HEAD_SHA: ${{ needs.tarball-authorize.outputs.head_sha }} | ||
| REPOSITORY: ${{ github.repository }} | ||
| run: | | ||
| tag="pr-${PR_NUMBER}-tarball" | ||
| gh release delete "$tag" --yes --cleanup-tag 2>/dev/null || true | ||
| gh release create "$tag" \ | ||
| "$TARBALL_PATH" \ | ||
| --title "PR #${PR_NUMBER} Tarball" \ | ||
| --notes "Auto-generated tarball for PR #${PR_NUMBER}." \ | ||
| --draft \ | ||
| --target "$HEAD_SHA" | ||
| download_url="https://github.com/${REPOSITORY}/releases/download/${tag}/${TARBALL_NAME}" | ||
| echo "url=$download_url" >> "$GITHUB_OUTPUT" | ||
| - name: Comment on PR | ||
| uses: marocchino/sticky-pull-request-comment@v3 | ||
| with: | ||
| header: tarball | ||
| message: | | ||
| ## Package Tarball | ||
| **[${{ steps.tarball.outputs.name }}](${{ steps.release.outputs.url }})** | ||
| ### How to install | ||
| ```bash | ||
| gh release download pr-${{ needs.tarball-authorize.outputs.pr_number }}-tarball --repo ${{ github.repository }} --pattern "*.tgz" --dir /tmp/pr-tarball | ||
| bun add --global /tmp/pr-tarball/${{ steps.tarball.outputs.name }} | ||
| ``` | ||
