Skip to content

Commit 1c4929f

Browse files
dreamorosidreamorosi
authored
Merge branch 'main' into 4131-graphql-includerouter
2 parents c0f1856 + de62353 commit 1c4929f

File tree

318 files changed

+11520
-5634
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

318 files changed

+11520
-5634
lines changed

‎.devcontainer/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# See here for image contents: https://github.com/microsoft/vscode-dev-containers/blob/v0.212.0/containers/javascript-node/.devcontainer/base.Dockerfile
2-
FROM mcr.microsoft.com/vscode/devcontainers/javascript-node@sha256:eac37fbeb0dd1ded8ae31a93f1f3e0defc413715e7541e2ba5a5c10079777f62
2+
FROM mcr.microsoft.com/vscode/devcontainers/javascript-node@sha256:9b4b7e41bc59ec3cbb0a2e06a231a067fc013f21187d0931d63db122d0a6eca6
33

44
# Install fnm to manage Node.js versions
55
RUN curl -fsSL https://fnm.vercel.app/install -o /tmp/install \

‎.github/workflows/bootstrap_region.yml‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -47,14 +47,14 @@ jobs:
4747
with:
4848
ref: ${{ github.sha }}
4949
- name: Setup Node.js
50-
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
50+
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
5151
with:
5252
node-version: "22"
5353
- name: Setup dependencies
5454
uses: aws-powertools/actions/.github/actions/cached-node-modules@29979bc5339bf54f76a11ac36ff67701986bb0f0
5555
- id: credentials
5656
name: AWS Credentials
57-
uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a
57+
uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838
5858
with:
5959
aws-region: ${{ inputs.region }}
6060
role-to-assume: ${{ secrets.REGION_IAM_ROLE }}
@@ -65,10 +65,13 @@ jobs:
6565
mkdir -p build/project
6666
- id: cdk-project
6767
name: CDK Project
68+
env:
69+
REGION: ${{ inputs.region }}
6870
working-directory: build/project
6971
run: |
72+
set -euo pipefail
7073
npx cdk init app --language=typescript
71-
AWS_REGION="${{ inputs.region }}" npx cdk bootstrap
74+
AWS_REGION="$REGION" npx cdk bootstrap
7275
7376
copy_layers:
7477
name: Copy Layers
@@ -81,14 +84,14 @@ jobs:
8184
steps:
8285
- id: credentials
8386
name: AWS Credentials
84-
uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a
87+
uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838
8588
with:
8689
aws-region: us-east-1
8790
role-to-assume: ${{ secrets.REGION_IAM_ROLE }}
8891
mask-aws-account-id: true
8992
- id: go-setup
9093
name: Setup Go
91-
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
94+
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
9295
with:
9396
go-version: '>=1.23.0'
9497
- id: go-env
@@ -101,4 +104,7 @@ jobs:
101104
name: Run Balance
102105
env:
103106
BALANCE_ROLE_ARN: ${{ secrets.BALANCE_ROLE_ARN }}
104-
run: balance -read-region us-east-1 -write-region ${{ inputs.region }} -write-role $BALANCE_ROLE_ARN -layer-name AWSLambdaPowertoolsTypeScriptV2 -dry-run=false
107+
REGION: ${{ inputs.region }}
108+
run: |
109+
set -euo pipefail
110+
balance -read-region us-east-1 -write-region "$REGION" -write-role "$BALANCE_ROLE_ARN" -layer-name AWSLambdaPowertoolsTypeScriptV2 -dry-run=false

‎.github/workflows/layer_balance.yml‎

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -45,14 +45,14 @@ jobs:
4545
steps:
4646
- id: credentials
4747
name: AWS Credentials
48-
uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a
48+
uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838
4949
with:
5050
aws-region: us-east-1
5151
role-to-assume: ${{ secrets.REGION_IAM_ROLE }}
5252
mask-aws-account-id: true
5353
- id: go-setup
5454
name: Setup Go
55-
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
55+
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
5656
with:
5757
go-version: '>=1.23.0'
5858
- id: go-env
@@ -64,8 +64,17 @@ jobs:
6464
- id: run-balance-new-region
6565
name: Run Balance
6666
if: ${{ inputs.start_at == '' }}
67-
run: balance -read-region us-east-1 -write-region ${{ inputs.region }} -write-role $BALANCE_ROLE_ARN -layer-name AWSLambdaPowertoolsTypeScriptV2 -dry-run=false
67+
env:
68+
REGION: ${{ inputs.region }}
69+
run: |
70+
set -euo pipefail
71+
balance -read-region us-east-1 -write-region "$REGION" -write-role "$BALANCE_ROLE_ARN" -layer-name AWSLambdaPowertoolsTypeScriptV2 -dry-run=false
6872
- id: run-balance-existing
6973
name: Run Balance (Existing Region)
7074
if: ${{ inputs.start_at != '' }}
71-
run: balance -read-region us-east-1 -start-at ${{ inputs.start_at }} -write-region ${{ inputs.region }} -write-role $BALANCE_ROLE_ARN -layer-name AWSLambdaPowertoolsTypeScriptV2 -dry-run=false
75+
env:
76+
REGION: ${{ inputs.region }}
77+
START_AT: ${{ inputs.start_at }}
78+
run: |
79+
set -euo pipefail
80+
balance -read-region us-east-1 -start-at "$START_AT" -write-region "$REGION" -write-role "$BALANCE_ROLE_ARN" -layer-name AWSLambdaPowertoolsTypeScriptV2 -dry-run=false

‎.github/workflows/layers_partition_verify.yml‎

Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -84,15 +84,18 @@ jobs:
8484
environment: Prod (Readonly)
8585
steps:
8686
- name: Configure AWS Credentials
87-
uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
87+
uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838 # v5.0.0
8888
with:
8989
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
9090
aws-region: us-east-1
9191
mask-aws-account-id: true
9292
- name: Output AWSLambdaPowertoolsTypeScriptV2
93+
env:
94+
VERSION: ${{ inputs.version }}
9395
# fetch the specific layer version information from the us-east-1 commercial region
9496
run: |
95-
aws --region us-east-1 lambda get-layer-version-by-arn --arn 'arn:aws:lambda:us-east-1:094274105915:layer:AWSLambdaPowertoolsTypeScriptV2:${{ inputs.version }}' > AWSLambdaPowertoolsTypeScriptV2.json
97+
set -euo pipefail
98+
aws --region us-east-1 lambda get-layer-version-by-arn --arn "arn:aws:lambda:us-east-1:094274105915:layer:AWSLambdaPowertoolsTypeScriptV2:${VERSION}" > AWSLambdaPowertoolsTypeScriptV2.json
9699
- name: Store Metadata
97100
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
98101
with:
@@ -124,7 +127,7 @@ jobs:
124127
run: |
125128
echo 'CONVERTED_REGION=${{ matrix.region }}' | tr 'a-z\-' 'A-Z_' >> "$GITHUB_OUTPUT"
126129
- name: Configure AWS Credentials
127-
uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
130+
uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838 # v5.0.0
128131
with:
129132
# Dynamic secret access is safe here - secrets are scoped per environment
130133
role-to-assume: ${{ secrets[format('IAM_ROLE_{0}', steps.transform.outputs.CONVERTED_REGION)] }}
@@ -133,13 +136,22 @@ jobs:
133136
audience: ${{ needs.setup.outputs.aud }}
134137
- id: partition_version
135138
name: Partition Layer Version
139+
env:
140+
VERSION: ${{ inputs.version }}
141+
PARTITION_VERSION: ${{ inputs.partition_version }}
136142
run: |
137-
echo 'partition_version=$([[ -n "${{ inputs.partition_version}}" ]] && echo ${{ inputs.partition_version}} || echo ${{ inputs.version }} )' >> "$GITHUB_OUTPUT"
143+
set -euo pipefail
144+
if [ -n "${PARTITION_VERSION:-}" ]; then
145+
echo "partition_version=${PARTITION_VERSION}" >> "$GITHUB_OUTPUT"
146+
else
147+
echo "partition_version=${VERSION}" >> "$GITHUB_OUTPUT"
148+
fi
138149
- name: Verify Layer
139150
run: |
140-
export layer_output='AWSLambdaPowertoolsTypeScriptV2-${{matrix.region}}.json'
151+
set -euo pipefail
152+
layer_output="AWSLambdaPowertoolsTypeScriptV2-${{ matrix.region }}.json"
141153
# Dynamic secret access is safe here - secrets are scoped per environment
142-
aws --region ${{ matrix.region}} lambda get-layer-version-by-arn --arn "arn:${{ needs.setup.outputs.partition }}:lambda:${{ matrix.region}}:${{ secrets[format('AWS_ACCOUNT_{0}', steps.transform.outputs.CONVERTED_REGION)] }}:layer:AWSLambdaPowertoolsTypeScriptV2:${{ steps.partition_version.outputs.partition_version }}" > $layer_output
154+
aws --region "${{ matrix.region }}" lambda get-layer-version-by-arn --arn "arn:${{ needs.setup.outputs.partition }}:lambda:${{ matrix.region }}:${{ secrets[format('AWS_ACCOUNT_{0}', steps.transform.outputs.CONVERTED_REGION)] }}:layer:AWSLambdaPowertoolsTypeScriptV2:${{ steps.partition_version.outputs.partition_version }}" > "$layer_output"
143155
REMOTE_SHA=$(jq -r '.Content.CodeSha256' $layer_output)
144156
LOCAL_SHA=$(jq -r '.Content.CodeSha256' AWSLambdaPowertoolsTypeScriptV2.json)
145157
test "$REMOTE_SHA" == "$LOCAL_SHA" && echo "SHA OK: ${LOCAL_SHA}" || exit 1

‎.github/workflows/layers_partitions.yml‎

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -93,15 +93,18 @@ jobs:
9393
environment: Prod (Readonly)
9494
steps:
9595
- name: Configure AWS Credentials
96-
uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
96+
uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838 # v5.0.0
9797
with:
9898
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
9999
aws-region: us-east-1
100100
mask-aws-account-id: true
101101
- name: Grab Zip
102+
env:
103+
VERSION: ${{ inputs.version }}
102104
run: |
103-
aws --region us-east-1 lambda get-layer-version-by-arn --arn arn:aws:lambda:us-east-1:094274105915:layer:AWSLambdaPowertoolsTypeScriptV2:${{ inputs.version }} --query 'Content.Location' | xargs curl -L -o AWSLambdaPowertoolsTypeScriptV2.zip
104-
aws --region us-east-1 lambda get-layer-version-by-arn --arn arn:aws:lambda:us-east-1:094274105915:layer:AWSLambdaPowertoolsTypeScriptV2:${{ inputs.version }} > AWSLambdaPowertoolsTypeScriptV2.json
105+
set -euo pipefail
106+
aws --region us-east-1 lambda get-layer-version-by-arn --arn "arn:aws:lambda:us-east-1:094274105915:layer:AWSLambdaPowertoolsTypeScriptV2:${VERSION}" --query 'Content.Location' | xargs curl -L -o AWSLambdaPowertoolsTypeScriptV2.zip
107+
aws --region us-east-1 lambda get-layer-version-by-arn --arn "arn:aws:lambda:us-east-1:094274105915:layer:AWSLambdaPowertoolsTypeScriptV2:${VERSION}" > AWSLambdaPowertoolsTypeScriptV2.json
105108
- name: Store Zip
106109
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
107110
with:
@@ -148,7 +151,7 @@ jobs:
148151
run: |
149152
echo 'CONVERTED_REGION=${{ matrix.region }}' | tr 'a-z\-' 'A-Z_' >> "$GITHUB_OUTPUT"
150153
- name: Configure AWS Credentials
151-
uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
154+
uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838 # v5.0.0
152155
with:
153156
# Dynamic secret access is safe here - secrets are scoped per environment
154157
role-to-assume: ${{ secrets[format('IAM_ROLE_{0}', steps.transform.outputs.CONVERTED_REGION)] }}
@@ -158,17 +161,18 @@ jobs:
158161
- name: Create Layer
159162
id: create-layer
160163
run: |
164+
set -euo pipefail
161165
cat AWSLambdaPowertoolsTypeScriptV2.json | jq '{"LayerName": "AWSLambdaPowertoolsTypeScriptV2", "Description": .Description, "CompatibleRuntimes": .CompatibleRuntimes, "LicenseInfo": .LicenseInfo}' > input.json
162-
163-
LAYER_VERSION=$(aws --region ${{ matrix.region}} lambda publish-layer-version \
166+
167+
LAYER_VERSION=$(aws --region "${{ matrix.region }}" lambda publish-layer-version \
164168
--zip-file fileb://./AWSLambdaPowertoolsTypeScriptV2.zip \
165169
--cli-input-json file://./input.json \
166170
--query 'Version' \
167171
--output text)
168172
169173
echo "LAYER_VERSION=$LAYER_VERSION" >> "$GITHUB_OUTPUT"
170174
171-
aws --region ${{ matrix.region}} lambda add-layer-version-permission \
175+
aws --region "${{ matrix.region }}" lambda add-layer-version-permission \
172176
--layer-name 'AWSLambdaPowertoolsTypeScriptV2' \
173177
--statement-id 'PublicLayer' \
174178
--action lambda:GetLayerVersion \
@@ -182,17 +186,19 @@ jobs:
182186
- name: Verify Layer
183187
env:
184188
LAYER_VERSION: ${{ steps.create-layer.outputs.LAYER_VERSION }}
189+
ENVIRONMENT: ${{ inputs.environment }}
185190
run: |
186-
export layer_output='AWSLambdaPowertoolsTypeScriptV2-${{matrix.region}}.json'
191+
set -euo pipefail
192+
export layer_output="AWSLambdaPowertoolsTypeScriptV2-${{ matrix.region }}.json"
187193
# Dynamic secret access is safe here - secrets are scoped per environment
188-
aws --region ${{ matrix.region}} lambda get-layer-version-by-arn --arn 'arn:${{ needs.setup.outputs.partition }}:lambda:${{ matrix.region}}:${{ secrets[format('AWS_ACCOUNT_{0}', steps.transform.outputs.CONVERTED_REGION)] }}:layer:AWSLambdaPowertoolsTypeScriptV2:${{ env.LAYER_VERSION }}' > $layer_output
194+
aws --region "${{ matrix.region }}" lambda get-layer-version-by-arn --arn "arn:${{ needs.setup.outputs.partition }}:lambda:${{ matrix.region }}:${{ secrets[format('AWS_ACCOUNT_{0}', steps.transform.outputs.CONVERTED_REGION)] }}:layer:AWSLambdaPowertoolsTypeScriptV2:${LAYER_VERSION}" > "$layer_output"
189195
REMOTE_SHA=$(jq -r '.Content.CodeSha256' $layer_output)
190196
LOCAL_SHA=$(jq -r '.Content.CodeSha256' AWSLambdaPowertoolsTypeScriptV2.json)
191197
test "$REMOTE_SHA" == "$LOCAL_SHA" && echo "SHA OK: ${LOCAL_SHA}" || exit 1
192198
REMOTE_DESCRIPTION=$(jq -r '.Description' $layer_output)
193199
LOCAL_DESCRIPTION=$(jq -r '.Description' AWSLambdaPowertoolsTypeScriptV2.json)
194200
test "$REMOTE_DESCRIPTION" == "$LOCAL_DESCRIPTION" && echo "Version number OK: ${LOCAL_DESCRIPTION}" || exit 1
195-
if [ "${{ inputs.environment }}" == "Prod" ]; then
201+
if [ "$ENVIRONMENT" == "Prod" ]; then
196202
REMOTE_LAYER_VERSION=$(jq -r '.LayerVersionArn' $layer_output | sed 's/.*://')
197203
LOCAL_LAYER_VERSION=$(jq -r '.LayerVersionArn' AWSLambdaPowertoolsTypeScriptV2.json | sed 's/.*://')
198204
test "$REMOTE_LAYER_VERSION" == "$LOCAL_LAYER_VERSION" && echo "Layer Version number OK: ${LOCAL_LAYER_VERSION}" || exit 1

‎.github/workflows/make-release.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,10 +48,11 @@ jobs:
4848
with:
4949
ref: ${{ github.sha }}
5050
- name: Setup NodeJS
51-
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
51+
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
5252
with:
5353
node-version: "22"
5454
cache: "npm"
55+
registry-url: 'https://registry.npmjs.org'
5556
- name: Setup auth tokens
5657
env:
5758
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

‎.github/workflows/make-version.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ jobs:
3535
ref: ${{ github.ref }}
3636
fetch-depth: 0 # fetch all history, commits and tags, so we can determine the next version
3737
- name: Setup Node.js
38-
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
38+
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
3939
with:
4040
node-version: ${{ env.NODE_VERSION }}
4141
cache: "npm"

‎.github/workflows/on_merged_pr.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ jobs:
5151
steps:
5252
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
5353
- name: "Label PR related issue for release"
54-
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
54+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
5555
env:
5656
PR_NUMBER: ${{ needs.get_pr_details.outputs.prNumber }}
5757
PR_BODY: ${{ needs.get_pr_details.outputs.prBody }}

‎.github/workflows/ossf_scorecard.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,6 @@ jobs:
4343

4444
# Upload the results to GitHub's code scanning dashboard.
4545
- name: "Upload to code-scanning"
46-
uses: github/codeql-action/upload-sarif@3c3833e0f8c1c83d449a7478aa59c036a9165498 # v3.29.5
46+
uses: github/codeql-action/upload-sarif@303c0aef88fc2fe5ff6d63d3b1596bfd83dfa1f9 # v3.29.5
4747
with:
4848
sarif_file: results.sarif

‎.github/workflows/post-release.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ jobs:
3737
fi
3838
echo "RELEASE_VERSION=$RELEASE_VERSION" >> $GITHUB_ENV
3939
- name: Update issues related to release
40-
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
40+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
4141
with:
4242
github-token: ${{ secrets.GITHUB_TOKEN }}
4343
script: |

0 commit comments

Comments
 (0)