ci: split Lambda layer publish credentials by region - #633
Conversation
Sorry, something went wrong.
| role-to-assume: ${{ secrets.LAYER_PUBLISH_ROLE_ARN }} | ||
| role-session-name: otelLayerPublish | ||
| aws-region: us-east-1 | ||
| role-to-assume: ${{ secrets[matrix.publish_target.role_secret] }} |
| - name: Resolve publish targets | ||
| id: publish-targets | ||
| env: | ||
| LAYER_REGIONS: ${{ inputs.regions || vars.LAYER_PUBLISH_REGIONS }} |
This comment was marked as outdated.
This comment has been minimized.
This comment has been minimized.
| - name: Resolve publish targets | ||
| id: publish-targets | ||
| env: | ||
| LAYER_REGIONS: ${{ inputs.regions || vars.LAYER_PUBLISH_REGIONS }} |
There was a problem hiding this comment.
Codex AI review
[P1] Resolve the environment-scoped variable from an environment job
vars.LAYER_PUBLISH_REGIONS is now evaluated in build-distributions, which does not target the lambda-layer-publish environment. Environment-level variables are unavailable there, so release runs will see an empty value and silently select every credential group, potentially publishing to unintended Regions or failing on missing role secrets. Resolve targets in a job bound to that environment and pass its output to the matrix, or move the variable to repository/organization scope and update the documentation accordingly.
Sorry, something went wrong.
Codex AI reviewOne blocking workflow regression found. The static YAML tests do not cover GitHub environment-variable scoping. Reviewed commit 7f6e60f7fb38ba38bdedbdcfef666ba386a7e545. Workflow run |
Sorry, something went wrong.
Claude AI reviewNo blocking findings. This is a CI-only change that splits Lambda layer publishing into a credential-scoped matrix; it touches no SDK runtime code, so replay/determinism/serialization semantics are not affected. The new resolve_layer_publish_targets.py is deterministic (group iteration order is preserved; the request set is used only for membership), rejects unsupported regions, and emits compact single-line JSON that is safe for $GITHUB_OUTPUT and fromJSON. Because command substitution runs under the default bash -eo pipefail, an invalid manual regions override correctly fails the resolve step. Dynamic secrets[matrix.publish_target.role_secret] indexing and the audience input are valid for configure-aws-credentials@v6, and each partition's fixed aws_region correctly seeds STS for cross-region publishing within that partition. Tests cover the default target set, region filtering, unsupported-region rejection, matrix serialization, and the no-duplicate-region invariant; the docs and opt-in list are consistent with the script. Residual operational risk (not a code defect): the removed DEFAULT_LAYER_REGIONS fallback previously scoped the default (unset LAYER_PUBLISH_REGIONS) run to commercial + opt-in regions only. The default now returns every configured group, including the China and GovCloud partitions (.github/scripts/resolve_layer_publish_targets.py:109-121). On the first otel-v release after merge, if vars.LAYER_PUBLISH_REGIONS is unset and the LAYER_PUBLISH_ROLE_ARN_CHINA / LAYER_PUBLISH_ROLE_ARN_US_GOV (and per-opt-in-region) secrets are not yet configured, those matrix jobs will fail at "Configure AWS credentials" (empty role-to-assume). With fail-fast: false the commercial layers still publish, but the overall workflow reports failure. Confirm all per-region/per-partition role ARN secrets are provisioned before the first release, or set LAYER_PUBLISH_REGIONS to the ready subset. Reviewed commit 7f6e60f7fb38ba38bdedbdcfef666ba386a7e545. Workflow run |
Sorry, something went wrong.
Reviewers
At least 1 approving review is required to merge this pull request.
Summary
Testing