Skip to content

Commit ef1c99b

Browse files
lucasmcdonald3lucasmcdonald3
committed
ci(esdk): provision full cross-language toolchain matrix for the TestServer orchestrate job
1 parent cbce67f commit ef1c99b

1 file changed

Lines changed: 87 additions & 22 deletions

File tree

‎.github/workflows/test-server.yml‎

Lines changed: 87 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -43,10 +43,12 @@ jobs:
4343
working-directory: test-server
4444
run: npm test
4545

46-
# The complete cross-language TestServer run: `make test-server` clones the
47-
# commons repo and orchestrates the full matrix with this working tree as the
48-
# live JavaScript server. Runs on every pull_request/push; needs the
49-
# CI_AWS_ROLE_ARN and COMMONS_REPO_TOKEN repo secrets.
46+
# The complete cross-language TestServer run: `make test-server` clones commons
47+
# and the orchestrator materializes + builds + launches every configured
48+
# Language_Server (this working tree is the live server), runs the full pairwise
49+
# Tests matrix, and tears down. Because the orchestrated run builds EVERY
50+
# language server, this job provisions the full cross-language toolchain matrix.
51+
# Needs the COMMONS_REPO_PAT repo secret (read on commons + java + rust).
5052
test-server:
5153
name: Cross-language TestServer run
5254
runs-on: ubuntu-latest
@@ -55,48 +57,111 @@ jobs:
5557
contents: read
5658
env:
5759
AWS_REGION: us-west-2
60+
GRADLE_OPTS: -Dorg.gradle.daemon=false
5861
steps:
5962
- uses: actions/checkout@v4
63+
with:
64+
persist-credentials: false
6065

61-
- name: Setup Node.js
62-
uses: actions/setup-node@v4
66+
- name: Set up JDK 17 (Temurin) — exposes JAVA_HOME_17_X64 for the MPL stub jar
67+
uses: actions/setup-java@v4
6368
with:
64-
node-version: "22.x"
65-
cache: "npm"
69+
distribution: temurin
70+
java-version: "17"
6671

67-
# The commons orchestrator (smithy-java) needs a JDK 21+
68-
- name: Set up JDK 21 (Temurin)
72+
- name: Set up JDK 21 (Temurin) — the commons orchestrator (smithy-java) needs 21+
6973
uses: actions/setup-java@v4
7074
with:
7175
distribution: temurin
7276
java-version: "21"
7377

74-
- name: Configure AWS credentials (branch-key-store account)
75-
uses: aws-actions/configure-aws-credentials@v4
78+
- name: Set up Python 3.11 (the materialized Python Language_Server needs >=3.11)
79+
uses: actions/setup-python@v5
7680
with:
77-
role-to-assume: ${{ vars.ESDK_TEST_SERVER_KMS_ROLE_ARN || 'arn:aws:iam::370957321024:role/esdk-test-server-ci-kms-role' }}
78-
aws-region: us-west-2
81+
python-version: "3.11"
7982

80-
# The private commons clone (git@ URL from commons-configuration.json)
81-
# picks up this SSH -> HTTPS+token mapping.
82-
- name: Authenticate the commons clone
83-
run: git config --global url."https://x-access-token:${{ secrets.COMMONS_REPO_PAT }}@github.com/".insteadOf "git@github.com:"
83+
- name: Set up Node.js 22 (the materialized JavaScript Language_Server build needs 17+)
84+
uses: actions/setup-node@v4
85+
with:
86+
node-version: "22"
87+
88+
- name: Set up Go (Go Language_Server + the Rust servers' aws-lc-sys native builds)
89+
uses: actions/setup-go@v5
90+
with:
91+
go-version: "stable"
92+
93+
- name: Set up the Rust toolchain (Rust Language_Server builds)
94+
run: |
95+
set -euo pipefail
96+
rustup toolchain install stable --profile minimal
97+
rustup default stable
98+
cargo --version
99+
100+
- name: Set up .NET (the materialized .NET Language_Server build)
101+
uses: actions/setup-dotnet@v5
102+
with:
103+
dotnet-version: |
104+
6.0.x
105+
8.0.x
106+
107+
- name: Install Dafny 4.9.0 (the .NET library transpile in the materialized clone)
108+
run: |
109+
set -euo pipefail
110+
dotnet tool install --global dafny --version 4.9.0
111+
echo "$HOME/.dotnet/tools" >> "$GITHUB_PATH"
112+
"$HOME/.dotnet/tools/dafny" --version
113+
114+
- name: Build aws-c-common (the materialized C Language_Server cmake requires it)
115+
run: |
116+
set -euo pipefail
117+
git clone --depth 1 https://github.com/awslabs/aws-c-common "$RUNNER_TEMP/aws-c-common"
118+
cmake -S "$RUNNER_TEMP/aws-c-common" -B "$RUNNER_TEMP/aws-c-common-build" \
119+
-DCMAKE_INSTALL_PREFIX="${{ github.workspace }}/.aws-c-common-install" \
120+
-DBUILD_TESTING=OFF
121+
cmake --build "$RUNNER_TEMP/aws-c-common-build" --target install -- -j
122+
echo "CMAKE_PREFIX_PATH=${{ github.workspace }}/.aws-c-common-install" >> "$GITHUB_ENV"
84123
85124
- name: Install stub for the unpublished MPL test-vectors artifact
86-
# The java Language_Server build runs `mvn install`, which resolves a
87-
# test-scope MPL artifact (TestAwsCryptographicMaterialProviders) that is
88-
# not on Maven Central; a stub jar satisfies resolution (its tests skip).
125+
# The materialized Java Language_Server build runs `mvn install`, which
126+
# resolves a test-scope MPL artifact (TestAwsCryptographicMaterialProviders)
127+
# that is not on Maven Central; a stub jar satisfies resolution (tests skip).
89128
run: |
90129
set -euo pipefail
91130
tmp="$(mktemp -d)"
92131
echo placeholder > "$tmp/README.txt"
93-
"$JAVA_HOME/bin/jar" cf "$tmp/stub.jar" -C "$tmp" README.txt
132+
"$JAVA_HOME_17_X64/bin/jar" cf "$tmp/stub.jar" -C "$tmp" README.txt
94133
mvn -q -e org.apache.maven.plugins:maven-install-plugin:3.1.1:install-file \
95134
-Dfile="$tmp/stub.jar" \
96135
-DgroupId=software.amazon.cryptography \
97136
-DartifactId=TestAwsCryptographicMaterialProviders \
98137
-Dversion=1.7.0 \
99138
-Dpackaging=jar
139+
140+
- name: Authenticate the private clones (commons, java, rust)
141+
# `make test-server` clones commons and the orchestrator materializes the
142+
# other language servers, several from private repos via git@ URLs; rewrite
143+
# SSH to token HTTPS. COMMONS_REPO_PAT needs read on commons + java + rust.
144+
env:
145+
PAT: ${{ secrets.COMMONS_REPO_PAT }}
146+
run: |
147+
test -n "$PAT" || { echo "::error::COMMONS_REPO_PAT is empty/unset in this repo"; exit 1; }
148+
git config --global url."https://x-access-token:${PAT}@github.com/".insteadOf "git@github.com:"
149+
150+
- name: Configure AWS credentials via OIDC (required KMS scenarios)
151+
id: aws-credentials
152+
continue-on-error: true
153+
uses: aws-actions/configure-aws-credentials@v4
154+
with:
155+
role-to-assume: ${{ vars.ESDK_TEST_SERVER_KMS_ROLE_ARN || 'arn:aws:iam::370957321024:role/esdk-test-server-ci-kms-role' }}
156+
aws-region: us-west-2
157+
158+
- name: Verify AWS credentials are active (gates the orchestrated run)
159+
run: |
160+
if ! aws sts get-caller-identity; then
161+
echo "::error::No usable AWS credentials for the required KMS scenarios." >&2
162+
exit 1
163+
fi
164+
100165
- name: Run the orchestrated TestServer
101166
working-directory: test-server
102167
run: make test-server

0 commit comments

Comments
 (0)