ci: add preflight and verification to testing image release

Author: nvasiu

.github/scripts/parse_testing_version.py

@@ -0,0 +1,32 @@
+#!/usr/bin/env python3
+
+import os
+import re
+
+# Matches a testing-v<x.y.z> entry in the release tag, stopping at a comma
+# so combined tags like "sdk-v2.0.0,testing-v2.0.0" resolve to the testing part.
+_PATTERN = re.compile(r"testing-v[0-9]+\.[0-9]+\.[0-9]+([^,]*)")
+
+
+def parse_testing_version(release_tag: str) -> str:
+    """Return the testing version named by the release tag, or empty if none."""
+    match = _PATTERN.search(release_tag)
+    if not match:
+        return ""
+    return match.group(0).removeprefix("testing-v")
+
+
+def main():
+    release_tag = os.environ.get("RELEASE_TAG", "")
+    tag_version = parse_testing_version(release_tag)
+
+    github_output = os.environ.get("GITHUB_OUTPUT")
+    if github_output:
+        with open(github_output, "a", encoding="utf-8") as f:
+            f.write(f"tag_version={tag_version}\n")
+
+    print(tag_version)
+
+
+if __name__ == "__main__":
+    main()

.github/scripts/tests/test_parse_testing_version.py

@@ -0,0 +1,43 @@
+#!/usr/bin/env python3
+
+import os
+import sys
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(__file__)))
+
+from parse_testing_version import parse_testing_version
+
+
+def test_parse_testing_version():
+    test_cases = [
+        # Testing-only tag enables the job
+        ("testing-v2.0.0", "2.0.0"),
+        ("testing-v1.2.1", "1.2.1"),
+        # Combined comma-separated tags resolve to the testing version
+        ("sdk-v2.0.0,testing-v2.0.0", "2.0.0"),
+        ("testing-v2.0.0,sdk-v2.1.0", "2.0.0"),
+        ("otel-v1.0.0,testing-v1.2.1,sdk-v2.0.0", "1.2.1"),
+        # SDK-only or OTel-only tags do not enable the job
+        ("sdk-v2.1.0", ""),
+        ("otel-v1.0.0", ""),
+        ("sdk-v2.0.0,otel-v1.0.0", ""),
+        # No release tag
+        ("", ""),
+        ("v2.0.0", ""),
+        ("random-text", ""),
+        # Pre-release suffix is kept up to the comma boundary
+        ("testing-v2.0.0rc1", "2.0.0rc1"),
+        ("testing-v2.0.0-beta,sdk-v1.0.0", "2.0.0-beta"),
+    ]
+
+    for input_text, expected in test_cases:
+        result = parse_testing_version(input_text)
+        # Assert is expected in test functions
+        assert result == expected, (  # noqa: S101
+            f"Expected '{expected}' but got '{result}' for input: {input_text}"
+        )
+
+
+if __name__ == "__main__":
+    test_parse_testing_version()
+    sys.exit(0)

.github/workflows/ecr-release.yml

@@ -13,9 +13,106 @@ env:
   ecr_repository_name: durable-functions/aws-durable-execution-emulator
 
 jobs:
+  preflight:
+    # Decide whether to publish before building anything.
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write  # ECR Public reads require an assumed role
+    outputs:
+      should_publish: ${{ steps.plan.outputs.should_publish }}
+      version: ${{ steps.plan.outputs.version }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          ref: ${{ github.event.release.tag_name }}
+
+      - name: Parse testing version from the release tag
+        id: tag
+        shell: bash
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          tag_version="$(python .github/scripts/parse_testing_version.py)"
+          if [[ -z "$tag_version" ]]; then
+            echo "Release tag does not name the testing package. Nothing to publish."
+          else
+            echo "tag names testing version: $tag_version"
+          fi
+
+      - name: Verify the tag version matches the source
+        id: verify
+        if: steps.tag.outputs.tag_version != ''
+        shell: bash
+        env:
+          TAG_VERSION: ${{ steps.tag.outputs.tag_version }}
+          ABOUT_PATH: ${{ env.package_path }}/src/aws_durable_execution_sdk_python_testing/__about__.py
+        run: |
+          source_version="$(grep "^__version__" "$ABOUT_PATH" | cut -d'"' -f2)"
+          echo "source version: $source_version"
+          if [[ "$TAG_VERSION" != "$source_version" ]]; then
+            echo "::error::Release tag names testing-v$TAG_VERSION but __about__.py is $source_version. Aborting before any publish."
+            exit 1
+          fi
+          echo "version=$source_version" >> "$GITHUB_OUTPUT"
+
+      - name: Configure AWS Credentials
+        if: steps.tag.outputs.tag_version != ''
+        uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4
+        with:
+          role-to-assume: ${{ secrets.ECR_UPLOAD_IAM_ROLE_ARN }}
+          aws-region: ${{ env.aws_region }}
+
+      - name: Check whether the image tag already exists
+        id: exists
+        if: steps.tag.outputs.tag_version != ''
+        shell: bash
+        env:
+          VERSION: ${{ steps.verify.outputs.version }}
+          ECR_REPOSITORY: ${{ env.ecr_repository_name }}
+        run: |
+          repo_name="${ECR_REPOSITORY##*/}"
+          if aws ecr-public describe-images \
+              --region "${{ env.aws_region }}" \
+              --repository-name "$repo_name" \
+              --image-ids imageTag="v${VERSION}" >/dev/null 2>&1; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Emit release plan
+        id: plan
+        shell: bash
+        env:
+          TAG_VERSION: ${{ steps.tag.outputs.tag_version }}
+          VERSION: ${{ steps.verify.outputs.version }}
+          EXISTS: ${{ steps.exists.outputs.exists }}
+        run: |
+          echo "## Emulator image release plan" >> "$GITHUB_STEP_SUMMARY"
+
+          if [[ -z "$TAG_VERSION" ]]; then
+            echo "- decision: **skip** (release does not name the testing package)" >> "$GITHUB_STEP_SUMMARY"
+            echo "should_publish=false" >> "$GITHUB_OUTPUT"
+            echo "version=" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "- testing version: $VERSION" >> "$GITHUB_STEP_SUMMARY"
+          if [[ "$EXISTS" == "true" ]]; then
+            echo "- image tag v$VERSION: already present in public ECR" >> "$GITHUB_STEP_SUMMARY"
+            echo "- decision: **skip** (version already published)" >> "$GITHUB_STEP_SUMMARY"
+            echo "should_publish=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "- image tag v$VERSION: not present in public ECR" >> "$GITHUB_STEP_SUMMARY"
+            echo "- decision: **publish**" >> "$GITHUB_STEP_SUMMARY"
+            echo "should_publish=true" >> "$GITHUB_OUTPUT"
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
   build-and-upload-image-to-ecr:
-    # Only publish when the release includes a new testing package version.
-    if: contains(github.event.release.tag_name, 'testing-v')
+    needs: preflight
+    if: needs.preflight.outputs.should_publish == 'true'
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -24,7 +121,7 @@ jobs:
       full_image_arm64: ${{ steps.build-publish.outputs.full_image_arm64 }}
       full_image_x86_64: ${{ steps.build-publish.outputs.full_image_x86_64 }}
       ecr_registry_repository: ${{ steps.build-publish.outputs.ecr_registry_repository }}
-      version: ${{ steps.version.outputs.VERSION }}
+      version: ${{ needs.preflight.outputs.version }}
     strategy:
       matrix:
         include:
@@ -56,13 +153,6 @@ jobs:
         working-directory: ${{ env.package_path }}
         run: hatch build
 
-      - name: Get version from __about__.py
-        id: version
-        run: |
-          VERSION=$(grep "^__version__" "${{ env.package_path }}/src/aws_durable_execution_sdk_python_testing/__about__.py" | cut -d'"' -f2)
-          echo "VERSION=$VERSION"
-          echo "VERSION=${VERSION}" >> "$GITHUB_OUTPUT"
-
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4
         with:
@@ -81,7 +171,7 @@ jobs:
         env:
           ECR_REGISTRY: ${{ steps.login-ecr-public.outputs.registry }}
           ECR_REPOSITORY: ${{ env.ecr_repository_name }}
-          PER_ARCH_IMAGE_TAG: v${{ steps.version.outputs.VERSION }}-${{ matrix.arch }}
+          PER_ARCH_IMAGE_TAG: v${{ needs.preflight.outputs.version }}-${{ matrix.arch }}
         run: |
           docker build --platform "${{ matrix.platform }}" --provenance false "${{ env.package_path }}" -f "${{ env.package_path }}/Dockerfile" -t "$ECR_REGISTRY/$ECR_REPOSITORY:$PER_ARCH_IMAGE_TAG"
           docker push "$ECR_REGISTRY/$ECR_REPOSITORY:$PER_ARCH_IMAGE_TAG"
@@ -134,3 +224,53 @@ jobs:
             --arch amd64 \
             --os linux
           docker manifest push "${{ needs.build-and-upload-image-to-ecr.outputs.ecr_registry_repository }}"
+
+  verify-publish:
+    needs: [preflight, create-ecr-manifest-per-arch]
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    steps:
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4
+        with:
+          role-to-assume: ${{ secrets.ECR_UPLOAD_IAM_ROLE_ARN }}
+          aws-region: ${{ env.aws_region }}
+
+      - name: Verify the version and latest tags on public ECR
+        shell: bash
+        env:
+          VERSION: ${{ needs.preflight.outputs.version }}
+          ECR_REPOSITORY: ${{ env.ecr_repository_name }}
+        run: |
+          repo_name="${ECR_REPOSITORY##*/}"
+          version_digest=""
+          for attempt in $(seq 1 10); do
+            version_digest="$(aws ecr-public describe-images \
+                --region "${{ env.aws_region }}" \
+                --repository-name "$repo_name" \
+                --image-ids imageTag="v${VERSION}" \
+                --query 'imageDetails[0].imageDigest' --output text 2>/dev/null || true)"
+            if [[ -n "$version_digest" && "$version_digest" != "None" ]]; then
+              echo "v$VERSION is visible in public ECR ($version_digest)."
+              break
+            fi
+            echo "attempt $attempt: v$VERSION not visible in public ECR yet, retrying."
+            version_digest=""
+            sleep 15
+          done
+          if [[ -z "$version_digest" ]]; then
+            echo "::error::v$VERSION did not become visible in public ECR after publishing."
+            exit 1
+          fi
+
+          latest_digest="$(aws ecr-public describe-images \
+              --region "${{ env.aws_region }}" \
+              --repository-name "$repo_name" \
+              --image-ids imageTag="latest" \
+              --query 'imageDetails[0].imageDigest' --output text 2>/dev/null || true)"
+          if [[ "$latest_digest" != "$version_digest" ]]; then
+            echo "::error::latest on public ECR points at $latest_digest but v$VERSION is $version_digest."
+            exit 1
+          fi
+          echo "latest on public ECR points at v$VERSION."

.github/workflows/test-parser.yml

@@ -6,6 +6,7 @@ on:
       - '.github/scripts/build_lambda_layer.py'
       - '.github/scripts/check_otel_wheel_dependencies.py'
       - '.github/scripts/parse_sdk_branch.py'
+      - '.github/scripts/parse_testing_version.py'
       - '.github/scripts/tests/**'
       - '.github/workflows/ai-pr-review.yml'
       - '.github/workflows/opentelemetry-conformance-tests.yml'
@@ -16,6 +17,7 @@ on:
       - '.github/scripts/build_lambda_layer.py'
       - '.github/scripts/check_otel_wheel_dependencies.py'
       - '.github/scripts/parse_sdk_branch.py'
+      - '.github/scripts/parse_testing_version.py'
       - '.github/scripts/tests/**'
       - '.github/workflows/ai-pr-review.yml'
       - '.github/workflows/opentelemetry-conformance-tests.yml'
@@ -40,4 +42,5 @@ jobs:
           .github/scripts/tests/test_build_lambda_layer.py \
           .github/scripts/tests/test_check_otel_wheel_dependencies.py \
           .github/scripts/tests/test_opentelemetry_conformance_workflow.py \
-          .github/scripts/tests/test_parse_sdk_branch.py
+          .github/scripts/tests/test_parse_sdk_branch.py \
+          .github/scripts/tests/test_parse_testing_version.py