From 9cbf26542aaf8b0f574f2dbf1c4a0072a00ce553 Mon Sep 17 00:00:00 2001 From: Davide Melfi Date: Tue, 20 Oct 2026 12:39:21 +0000 Subject: [PATCH] chore: proposal --- .../actions/ecr-pull-through-login/action.yml | 97 +++++++++++++++++++ ...runtime-interface-client_merge_to_main.yml | 18 +++- .../workflows/runtime-interface-client_pr.yml | 35 ++++++- .../Makefile | 1 + .../codebuild-local/Dockerfile.agent | 7 +- .../integration/codebuild-local/test_one.sh | 19 +++- .../codebuild/buildspec.os.alpine.yml | 13 +-- .../codebuild/buildspec.os.amazoncorretto.yml | 13 +-- .../codebuild/buildspec.os.amazonlinux.1.yml | 13 +-- .../codebuild/buildspec.os.amazonlinux.2.yml | 13 +-- .../codebuild/buildspec.os.debian.yml | 13 +-- .../codebuild/buildspec.os.ubuntu.yml | 13 +-- .../scripts/configure_multi_arch_env.sh | 6 +- .../codebuild/scripts/docker_login.sh | 35 +++++++ .../docker/Dockerfile.function.alpine | 3 +- .../docker/Dockerfile.function.amazoncorretto | 3 +- .../docker/Dockerfile.function.amazonlinux | 3 +- .../docker/Dockerfile.function.debian | 5 +- .../docker/Dockerfile.function.ubuntu | 5 +- 19 files changed, 244 insertions(+), 71 deletions(-) create mode 100644 .github/actions/ecr-pull-through-login/action.yml create mode 100644 aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/docker_login.sh diff --git a/.github/actions/ecr-pull-through-login/action.yml b/.github/actions/ecr-pull-through-login/action.yml new file mode 100644 index 000000000..c32d3736b --- /dev/null +++ b/.github/actions/ecr-pull-through-login/action.yml @@ -0,0 +1,97 @@ +name: "Log in to the ECR pull-through cache (OIDC)" +description: > + Assumes the repo's OIDC role, logs Docker in to the ECR pull-through cache and + exports BASE_REGISTRY so the native JNI build (src/main/jni/build-jni-lib.sh) + pulls its base images from there instead of public.ecr.aws. Anonymous pulls + from shared GitHub-hosted runner IPs regularly hit public.ecr.aws's 429 + "Data limit exceeded". + + Pull requests from forks get neither secrets nor an OIDC token, so role-to-assume + arrives empty. The action then does nothing, BASE_REGISTRY stays unset, and the + build falls back to its public.ecr.aws default. The calling job needs + `permissions: id-token: write`. + + The role's credentials and region are only given to the login step; nothing is + exported to the job environment, so later steps (make, mvn test, the docker + builds) never see them. + +inputs: + role-to-assume: + description: "ARN of the OIDC role allowed to pull through the cache. Empty skips the login." + required: false + default: "" + aws-region: + description: "Region of the pull-through cache." + required: false + default: "" + aws-account-id: + description: "Account that owns the pull-through cache." + required: false + default: "" + +runs: + using: composite + steps: + - name: Skip ECR login when no role is available + if: inputs.role-to-assume == '' + shell: bash + run: echo "No ECR pull-through role (fork PR or unset secret); base images come from public.ecr.aws." + + - name: Assume the ECR pull-through role + id: creds + if: inputs.role-to-assume != '' + continue-on-error: true + uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4 + with: + aws-region: ${{ inputs.aws-region }} + role-to-assume: ${{ inputs.role-to-assume }} + role-session-name: GitHubActionsEcrPullThrough + output-env-credentials: false + output-credentials: true + + # BASE_REGISTRY is only exported once the login succeeds and both JNI base + # images resolve through the cache (the first pull of a tag needs + # BatchImportUpstreamImage). On any failure the build keeps the + # public.ecr.aws default rather than failing on the private registry. + - name: Log in and export BASE_REGISTRY + if: inputs.role-to-assume != '' && steps.creds.outcome == 'success' + shell: bash + env: + AWS_ACCESS_KEY_ID: ${{ steps.creds.outputs.aws-access-key-id }} + AWS_SECRET_ACCESS_KEY: ${{ steps.creds.outputs.aws-secret-access-key }} + AWS_SESSION_TOKEN: ${{ steps.creds.outputs.aws-session-token }} + AWS_REGION: ${{ inputs.aws-region }} + ECR_REGISTRY: ${{ inputs.aws-account-id }}.dkr.ecr.${{ inputs.aws-region }}.amazonaws.com + run: | + if ! password=$(aws ecr get-login-password --region "$AWS_REGION"); then + echo "::warning::ECR login failed; base images come from public.ecr.aws." + exit 0 + fi + echo "::add-mask::$password" + if ! docker login --username AWS --password-stdin "$ECR_REGISTRY" <<< "$password"; then + echo "::warning::ECR login failed; base images come from public.ecr.aws." + exit 0 + fi + # Same images as src/main/jni/Dockerfile.glibc and Dockerfile.musl, plus the + # CodeBuild agent (test/integration/codebuild-local/Dockerfile.agent) and the + # local-builds image test_one.sh runs it with (tagged per architecture). + if [ "$(uname -m)" = "aarch64" ]; then local_builds_tag=aarch64; else local_builds_tag=latest; fi + for image in amazonlinux/amazonlinux:2 docker/library/alpine:3 amazoncorretto/amazoncorretto:8 \ + "codebuild/local-builds:$local_builds_tag"; do + if ! docker buildx imagetools inspect "$ECR_REGISTRY/ecr-public/$image" > /dev/null; then + echo "::warning::$image is not reachable through the ECR pull-through cache; base images come from public.ecr.aws." + exit 0 + fi + done + # The integration tests run docker inside a CodeBuild local container, which + # doesn't see this runner's docker login. test_one.sh hands it this + # file so the container can log in itself. + password_file="$RUNNER_TEMP/ecr-pull-through-password" + (umask 077 && printf '%s' "$password" > "$password_file") + echo "ECR_PASSWORD_FILE=$password_file" >> "$GITHUB_ENV" + echo "BASE_REGISTRY=$ECR_REGISTRY/ecr-public" >> "$GITHUB_ENV" + + - name: Warn on role assumption failure + if: inputs.role-to-assume != '' && steps.creds.outcome != 'success' + shell: bash + run: echo "::warning::Could not assume the ECR pull-through role; base images come from public.ecr.aws." diff --git a/.github/workflows/runtime-interface-client_merge_to_main.yml b/.github/workflows/runtime-interface-client_merge_to_main.yml index 2b9625983..44995d66f 100644 --- a/.github/workflows/runtime-interface-client_merge_to_main.yml +++ b/.github/workflows/runtime-interface-client_merge_to_main.yml @@ -17,6 +17,7 @@ on: paths: - 'aws-lambda-java-runtime-interface-client/**' - '.github/workflows/runtime-interface-client_*.yml' + - '.github/actions/**' jobs: @@ -47,7 +48,14 @@ jobs: - name: Available buildx platforms run: echo ${{ steps.buildx.outputs.platforms }} - + + - name: Log in to the ECR pull-through cache + uses: ./.github/actions/ecr-pull-through-login + with: + role-to-assume: ${{ secrets.AWS_ROLE_ECR_PULL_THROUGH }} + aws-region: ${{ vars.AWS_REGION_MAVEN_RELEASE }} + aws-account-id: ${{ secrets.AWS_ACCOUNT_ID }} + - name: Build and install serialization dependency locally working-directory: ./aws-lambda-java-serialization run: mvn clean install @@ -96,6 +104,7 @@ jobs: # codecov/project status on identical code. coverage: permissions: + id-token: write # ECR pull-through login contents: read strategy: fail-fast: false @@ -130,6 +139,13 @@ jobs: working-directory: ./aws-lambda-java-serialization run: mvn clean install + - name: Log in to the ECR pull-through cache + uses: ./.github/actions/ecr-pull-through-login + with: + role-to-assume: ${{ secrets.AWS_ROLE_ECR_PULL_THROUGH }} + aws-region: ${{ vars.AWS_REGION_MAVEN_RELEASE }} + aws-account-id: ${{ secrets.AWS_ACCOUNT_ID }} + - name: Build Runtime Interface Client - Run 'build-${{ matrix.arch }}' target working-directory: ./aws-lambda-java-runtime-interface-client run: make build-${{ matrix.arch }} diff --git a/.github/workflows/runtime-interface-client_pr.yml b/.github/workflows/runtime-interface-client_pr.yml index 885b952c7..39d8cedfc 100644 --- a/.github/workflows/runtime-interface-client_pr.yml +++ b/.github/workflows/runtime-interface-client_pr.yml @@ -16,6 +16,9 @@ permissions: jobs: smoke-test-arch: + permissions: + id-token: write # ECR pull-through login; forks don't get a token + contents: read strategy: fail-fast: true matrix: @@ -44,6 +47,13 @@ jobs: working-directory: ./aws-lambda-java-serialization run: mvn clean install + - name: Log in to the ECR pull-through cache + uses: ./.github/actions/ecr-pull-through-login + with: + role-to-assume: ${{ secrets.AWS_ROLE_ECR_PULL_THROUGH }} + aws-region: ${{ vars.AWS_REGION_MAVEN_RELEASE }} + aws-account-id: ${{ secrets.AWS_ACCOUNT_ID }} + - name: Runtime Interface Client smoke tests - Run 'pr-${{ matrix.arch }}' target working-directory: ./aws-lambda-java-runtime-interface-client run: make pr-${{ matrix.arch }} @@ -51,6 +61,9 @@ jobs: IS_JAVA_8: true build-arch: + permissions: + id-token: write # ECR pull-through login; forks don't get a token + contents: read strategy: fail-fast: true matrix: @@ -84,6 +97,13 @@ jobs: working-directory: ./aws-lambda-java-serialization run: mvn clean install + - name: Log in to the ECR pull-through cache + uses: ./.github/actions/ecr-pull-through-login + with: + role-to-assume: ${{ secrets.AWS_ROLE_ECR_PULL_THROUGH }} + aws-region: ${{ vars.AWS_REGION_MAVEN_RELEASE }} + aws-account-id: ${{ secrets.AWS_ACCOUNT_ID }} + - name: Test Runtime Interface Client build - Run 'build-${{ matrix.arch }}' target working-directory: ./aws-lambda-java-runtime-interface-client run: make build-${{ matrix.arch }} @@ -107,12 +127,16 @@ jobs: CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} integration-test-matrix: + permissions: + id-token: write # ECR pull-through login; forks don't get a token + contents: read runs-on: ${{ matrix.arch.runner }} strategy: # Run every OS/arch combination to completion so one failure doesn't mask the others. fail-fast: false - # Every shard pulls its images anonymously from public.ecr.aws, and shards - # started together trip its rate limit (429), so cap how many run at once. + # Fork PRs get no OIDC token for the ECR pull-through cache, so their shards + # pull anonymously from public.ecr.aws, and shards started together trip + # its rate limit (429). Cap how many run at once. max-parallel: 4 matrix: buildspec: @@ -146,6 +170,13 @@ jobs: with: install: true + - name: Log in to the ECR pull-through cache + uses: ./.github/actions/ecr-pull-through-login + with: + role-to-assume: ${{ secrets.AWS_ROLE_ECR_PULL_THROUGH }} + aws-region: ${{ vars.AWS_REGION_MAVEN_RELEASE }} + aws-account-id: ${{ secrets.AWS_ACCOUNT_ID }} + - name: Run OS integration test - 'test-integ' target working-directory: ./aws-lambda-java-runtime-interface-client run: make test-integ BUILDSPEC=test/integration/codebuild/${{ matrix.buildspec }} diff --git a/aws-lambda-java-runtime-interface-client/Makefile b/aws-lambda-java-runtime-interface-client/Makefile index 6d1a7762d..94a0a8baf 100644 --- a/aws-lambda-java-runtime-interface-client/Makefile +++ b/aws-lambda-java-runtime-interface-client/Makefile @@ -28,6 +28,7 @@ test: setup-codebuild-agent: test/integration/codebuild-local/docker-retry.sh docker build --load -t codebuild-agent \ --build-arg ARCHITECTURE=$(ARCHITECTURE_ALIAS) \ + --build-arg BASE_REGISTRY=$(or $(BASE_REGISTRY),public.ecr.aws) \ -f test/integration/codebuild-local/Dockerfile.agent \ test/integration/codebuild-local diff --git a/aws-lambda-java-runtime-interface-client/test/integration/codebuild-local/Dockerfile.agent b/aws-lambda-java-runtime-interface-client/test/integration/codebuild-local/Dockerfile.agent index b077df89d..9c04a6adf 100644 --- a/aws-lambda-java-runtime-interface-client/test/integration/codebuild-local/Dockerfile.agent +++ b/aws-lambda-java-runtime-interface-client/test/integration/codebuild-local/Dockerfile.agent @@ -1,5 +1,8 @@ -# syntax=docker/dockerfile:1.4 -FROM public.ecr.aws/amazoncorretto/amazoncorretto:8 +# No "# syntax=" directive: it would pull the frontend from Docker Hub, and the +# built-in one already supports the heredoc below. +# Set to the ECR pull-through cache by .github/actions/ecr-pull-through-login. +ARG BASE_REGISTRY=public.ecr.aws +FROM ${BASE_REGISTRY}/amazoncorretto/amazoncorretto:8 # Install docker and buildx extension. # gnupg2 provides gpg/gpgv/gpg-agent so build-jni-lib.sh can GPG-verify the prebuilt assets. diff --git a/aws-lambda-java-runtime-interface-client/test/integration/codebuild-local/test_one.sh b/aws-lambda-java-runtime-interface-client/test/integration/codebuild-local/test_one.sh index 172413b0f..b2f9fec10 100755 --- a/aws-lambda-java-runtime-interface-client/test/integration/codebuild-local/test_one.sh +++ b/aws-lambda-java-runtime-interface-client/test/integration/codebuild-local/test_one.sh @@ -18,12 +18,15 @@ function usage { >&2 echo " env Additional environment variables file." } -# codebuild/local-builds images are not multi-architectural +# codebuild/local-builds images are not multi-architectural. +# BASE_REGISTRY points at the ECR pull-through cache when +# .github/actions/ecr-pull-through-login has logged this runner in. function get_local_agent_image() { + local registry="${BASE_REGISTRY:-public.ecr.aws}" if [[ "$(arch)" == "aarch64" ]]; then - echo "public.ecr.aws/codebuild/local-builds:aarch64" + echo "$registry/codebuild/local-builds:aarch64" else - echo "public.ecr.aws/codebuild/local-builds:latest" + echo "$registry/codebuild/local-builds:latest" fi } @@ -58,6 +61,16 @@ main() { echo "PLATFORM=$PLATFORM" } >> "$ENVFILE" + # Set by .github/actions/ecr-pull-through-login. The build container has its + # own docker config, so it logs in to the pull-through cache with this token + # (see the install phase of the buildspecs). + if [ -n "${BASE_REGISTRY:-}" ] && [ -f "${ECR_PASSWORD_FILE:-}" ]; then + { + echo "BASE_REGISTRY=$BASE_REGISTRY" + echo "ECR_PASSWORD=$(cat "$ECR_PASSWORD_FILE")" + } >> "$ENVFILE" + fi + ARTIFACTS_DIR="$CODEBUILD_TEMP_DIR/artifacts" mkdir -p "$ARTIFACTS_DIR" diff --git a/aws-lambda-java-runtime-interface-client/test/integration/codebuild/buildspec.os.alpine.yml b/aws-lambda-java-runtime-interface-client/test/integration/codebuild/buildspec.os.alpine.yml index 595de79f3..f28541d81 100644 --- a/aws-lambda-java-runtime-interface-client/test/integration/codebuild/buildspec.os.alpine.yml +++ b/aws-lambda-java-runtime-interface-client/test/integration/codebuild/buildspec.os.alpine.yml @@ -25,14 +25,8 @@ batch: phases: install: commands: - - > - if [[ -z "${DOCKERHUB_USERNAME}" && -z "${DOCKERHUB_PASSWORD}" ]]; - then - echo "DockerHub credentials not set as CodeBuild environment variables. Continuing without docker login." - else - echo "Performing DockerHub login . . ." - docker login -u $DOCKERHUB_USERNAME -p $DOCKERHUB_PASSWORD - fi + # Sourced, not run: it unsets BASE_REGISTRY here when the ECR login fails. + - . aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/docker_login.sh - aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/configure_multi_arch_env.sh pre_build: commands: @@ -75,7 +69,8 @@ phases: -t "${IMAGE_TAG}" \ --platform="${PLATFORM}" \ --build-arg RUNTIME_VERSION="${RUNTIME_VERSION}" \ - --build-arg DISTRO_VERSION="${DISTRO_VERSION}" + --build-arg DISTRO_VERSION="${DISTRO_VERSION}" \ + --build-arg BASE_REGISTRY="${BASE_REGISTRY:-public.ecr.aws}" build: commands: - aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/run_invocation_test.sh diff --git a/aws-lambda-java-runtime-interface-client/test/integration/codebuild/buildspec.os.amazoncorretto.yml b/aws-lambda-java-runtime-interface-client/test/integration/codebuild/buildspec.os.amazoncorretto.yml index efa99cec8..d9f46d50e 100644 --- a/aws-lambda-java-runtime-interface-client/test/integration/codebuild/buildspec.os.amazoncorretto.yml +++ b/aws-lambda-java-runtime-interface-client/test/integration/codebuild/buildspec.os.amazoncorretto.yml @@ -26,14 +26,8 @@ batch: phases: install: commands: - - > - if [[ -z "${DOCKERHUB_USERNAME}" && -z "${DOCKERHUB_PASSWORD}" ]]; - then - echo "DockerHub credentials not set as CodeBuild environment variables. Continuing without docker login." - else - echo "Performing DockerHub login . . ." - docker login -u $DOCKERHUB_USERNAME -p $DOCKERHUB_PASSWORD - fi + # Sourced, not run: it unsets BASE_REGISTRY here when the ECR login fails. + - . aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/docker_login.sh - aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/configure_multi_arch_env.sh pre_build: commands: @@ -73,7 +67,8 @@ phases: -t "${IMAGE_TAG}" \ --platform="${PLATFORM}" \ --build-arg RUNTIME_VERSION="${RUNTIME_VERSION}" \ - --build-arg DISTRO_VERSION="${DISTRO_VERSION}" + --build-arg DISTRO_VERSION="${DISTRO_VERSION}" \ + --build-arg BASE_REGISTRY="${BASE_REGISTRY:-public.ecr.aws}" build: commands: - aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/run_invocation_test.sh diff --git a/aws-lambda-java-runtime-interface-client/test/integration/codebuild/buildspec.os.amazonlinux.1.yml b/aws-lambda-java-runtime-interface-client/test/integration/codebuild/buildspec.os.amazonlinux.1.yml index 0398ca642..57fc0abbb 100644 --- a/aws-lambda-java-runtime-interface-client/test/integration/codebuild/buildspec.os.amazonlinux.1.yml +++ b/aws-lambda-java-runtime-interface-client/test/integration/codebuild/buildspec.os.amazonlinux.1.yml @@ -22,14 +22,8 @@ batch: phases: install: commands: - - > - if [[ -z "${DOCKERHUB_USERNAME}" && -z "${DOCKERHUB_PASSWORD}" ]]; - then - echo "DockerHub credentials not set as CodeBuild environment variables. Continuing without docker login." - else - echo "Performing DockerHub login . . ." - docker login -u $DOCKERHUB_USERNAME -p $DOCKERHUB_PASSWORD - fi + # Sourced, not run: it unsets BASE_REGISTRY here when the ECR login fails. + - . aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/docker_login.sh pre_build: commands: # Log some environment variables for troubleshooting @@ -59,7 +53,8 @@ phases: -f "${SCRATCH_DIR}/Dockerfile.function.${OS_DISTRIBUTION}.tmp" \ -t "${IMAGE_TAG}" \ --build-arg RUNTIME_VERSION="${RUNTIME_VERSION}" \ - --build-arg DISTRO_VERSION="${DISTRO_VERSION}" + --build-arg DISTRO_VERSION="${DISTRO_VERSION}" \ + --build-arg BASE_REGISTRY="${BASE_REGISTRY:-public.ecr.aws}" build: commands: - aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/run_invocation_test.sh diff --git a/aws-lambda-java-runtime-interface-client/test/integration/codebuild/buildspec.os.amazonlinux.2.yml b/aws-lambda-java-runtime-interface-client/test/integration/codebuild/buildspec.os.amazonlinux.2.yml index a229defbc..21a2a0750 100644 --- a/aws-lambda-java-runtime-interface-client/test/integration/codebuild/buildspec.os.amazonlinux.2.yml +++ b/aws-lambda-java-runtime-interface-client/test/integration/codebuild/buildspec.os.amazonlinux.2.yml @@ -25,14 +25,8 @@ batch: phases: install: commands: - - > - if [[ -z "${DOCKERHUB_USERNAME}" && -z "${DOCKERHUB_PASSWORD}" ]]; - then - echo "DockerHub credentials not set as CodeBuild environment variables. Continuing without docker login." - else - echo "Performing DockerHub login . . ." - docker login -u $DOCKERHUB_USERNAME -p $DOCKERHUB_PASSWORD - fi + # Sourced, not run: it unsets BASE_REGISTRY here when the ECR login fails. + - . aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/docker_login.sh - aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/configure_multi_arch_env.sh pre_build: commands: @@ -72,7 +66,8 @@ phases: -t "${IMAGE_TAG}" \ --platform="${PLATFORM}" \ --build-arg RUNTIME_VERSION="${RUNTIME_VERSION}" \ - --build-arg DISTRO_VERSION="${DISTRO_VERSION}" + --build-arg DISTRO_VERSION="${DISTRO_VERSION}" \ + --build-arg BASE_REGISTRY="${BASE_REGISTRY:-public.ecr.aws}" build: commands: - aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/run_invocation_test.sh diff --git a/aws-lambda-java-runtime-interface-client/test/integration/codebuild/buildspec.os.debian.yml b/aws-lambda-java-runtime-interface-client/test/integration/codebuild/buildspec.os.debian.yml index 02f3915c3..101582258 100644 --- a/aws-lambda-java-runtime-interface-client/test/integration/codebuild/buildspec.os.debian.yml +++ b/aws-lambda-java-runtime-interface-client/test/integration/codebuild/buildspec.os.debian.yml @@ -26,14 +26,8 @@ batch: phases: install: commands: - - > - if [[ -z "${DOCKERHUB_USERNAME}" && -z "${DOCKERHUB_PASSWORD}" ]]; - then - echo "DockerHub credentials not set as CodeBuild environment variables. Continuing without docker login." - else - echo "Performing DockerHub login . . ." - docker login -u $DOCKERHUB_USERNAME -p $DOCKERHUB_PASSWORD - fi + # Sourced, not run: it unsets BASE_REGISTRY here when the ECR login fails. + - . aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/docker_login.sh - aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/configure_multi_arch_env.sh pre_build: commands: @@ -76,7 +70,8 @@ phases: -t "${IMAGE_TAG}" \ --platform="${PLATFORM}" \ --build-arg RUNTIME_VERSION="${RUNTIME_VERSION}" \ - --build-arg DISTRO_VERSION="${DISTRO_VERSION}" + --build-arg DISTRO_VERSION="${DISTRO_VERSION}" \ + --build-arg BASE_REGISTRY="${BASE_REGISTRY:-public.ecr.aws}" build: commands: - aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/run_invocation_test.sh diff --git a/aws-lambda-java-runtime-interface-client/test/integration/codebuild/buildspec.os.ubuntu.yml b/aws-lambda-java-runtime-interface-client/test/integration/codebuild/buildspec.os.ubuntu.yml index cb63814d0..dadf3e862 100644 --- a/aws-lambda-java-runtime-interface-client/test/integration/codebuild/buildspec.os.ubuntu.yml +++ b/aws-lambda-java-runtime-interface-client/test/integration/codebuild/buildspec.os.ubuntu.yml @@ -26,14 +26,8 @@ batch: phases: install: commands: - - > - if [[ -z "${DOCKERHUB_USERNAME}" && -z "${DOCKERHUB_PASSWORD}" ]]; - then - echo "DockerHub credentials not set as CodeBuild environment variables. Continuing without docker login." - else - echo "Performing DockerHub login . . ." - docker login -u $DOCKERHUB_USERNAME -p $DOCKERHUB_PASSWORD - fi + # Sourced, not run: it unsets BASE_REGISTRY here when the ECR login fails. + - . aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/docker_login.sh - aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/configure_multi_arch_env.sh pre_build: commands: @@ -76,7 +70,8 @@ phases: -t "${IMAGE_TAG}" \ --platform="${PLATFORM}" \ --build-arg RUNTIME_VERSION="${RUNTIME_VERSION}" \ - --build-arg DISTRO_VERSION="${DISTRO_VERSION}" + --build-arg DISTRO_VERSION="${DISTRO_VERSION}" \ + --build-arg BASE_REGISTRY="${BASE_REGISTRY:-public.ecr.aws}" build: commands: - aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/run_invocation_test.sh diff --git a/aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/configure_multi_arch_env.sh b/aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/configure_multi_arch_env.sh index 7e1ed3b1e..b3161db69 100755 --- a/aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/configure_multi_arch_env.sh +++ b/aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/configure_multi_arch_env.sh @@ -15,8 +15,10 @@ else fi echo "Installing ${TARGET_EMULATOR} emulator" -"$(dirname "$0")"/../../codebuild-local/docker-retry.sh docker pull public.ecr.aws/eks-distro-build-tooling/binfmt-misc:qemu-v6.1.0 -docker run --rm --privileged public.ecr.aws/eks-distro-build-tooling/binfmt-misc:qemu-v6.1.0 --install ${TARGET_EMULATOR} +# BASE_REGISTRY is the ECR pull-through cache when the buildspec logged in to it. +BINFMT_IMAGE="${BASE_REGISTRY:-public.ecr.aws}/eks-distro-build-tooling/binfmt-misc:qemu-v6.1.0" +"$(dirname "$0")"/../../codebuild-local/docker-retry.sh docker pull "$BINFMT_IMAGE" +docker run --rm --privileged "$BINFMT_IMAGE" --install ${TARGET_EMULATOR} echo "Setting docker build command to default to buildx" echo "Docker buildx version: $(docker buildx version)" docker buildx install diff --git a/aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/docker_login.sh b/aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/docker_login.sh new file mode 100644 index 000000000..1d2ca9202 --- /dev/null +++ b/aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/docker_login.sh @@ -0,0 +1,35 @@ +# Copyright 2026 Amazon.com, Inc. or its affiliates. All Rights Reserved. +# +# Docker registry logins for the buildspec install phase. Source it, don't run +# it (". path/to/docker_login.sh"): when the ECR pull-through cache login fails +# it unsets BASE_REGISTRY in the caller's shell, so the JNI and function images +# fall back to public.ecr.aws. +# POSIX sh, no "exit" and no "set -e": it runs in the buildspec's shell. + +# docker_login +# Skips the login when any argument is empty. A failed or skipped login only +# returns non-zero; the caller decides what to fall back to. +docker_login() { + if [ -z "${1:-}" ] || [ -z "${2:-}" ] || [ -z "${3:-}" ]; then + echo "No credentials for $1; continuing without docker login." + return 1 + fi + if printf '%s' "$3" | docker login --username "$2" --password-stdin "$1"; then + echo "Logged in to $1." + else + echo "Docker login to $1 failed; continuing without it." + return 1 + fi +} + +# ECR pull-through cache. BASE_REGISTRY and ECR_PASSWORD come from test_one.sh +# when the runner is logged in to it (.github/actions/ecr-pull-through-login); +# fork PRs get neither. +if [ -z "${BASE_REGISTRY:-}" ] || ! docker_login "${BASE_REGISTRY%%/*}" AWS "${ECR_PASSWORD:-}"; then + echo "No ECR pull-through cache login; base images come from public.ecr.aws." + unset BASE_REGISTRY +fi +unset ECR_PASSWORD + +# Docker Hub, when the CodeBuild project sets credentials. +docker_login docker.io "${DOCKERHUB_USERNAME:-}" "${DOCKERHUB_PASSWORD:-}" || true diff --git a/aws-lambda-java-runtime-interface-client/test/integration/docker/Dockerfile.function.alpine b/aws-lambda-java-runtime-interface-client/test/integration/docker/Dockerfile.function.alpine index bfd288901..3aa07a2e4 100644 --- a/aws-lambda-java-runtime-interface-client/test/integration/docker/Dockerfile.function.alpine +++ b/aws-lambda-java-runtime-interface-client/test/integration/docker/Dockerfile.function.alpine @@ -1,6 +1,7 @@ ARG DISTRO_VERSION +ARG BASE_REGISTRY=public.ecr.aws -FROM public.ecr.aws/docker/library/alpine:${DISTRO_VERSION} +FROM ${BASE_REGISTRY}/docker/library/alpine:${DISTRO_VERSION} RUN apk update && \ apk add openjdk8 diff --git a/aws-lambda-java-runtime-interface-client/test/integration/docker/Dockerfile.function.amazoncorretto b/aws-lambda-java-runtime-interface-client/test/integration/docker/Dockerfile.function.amazoncorretto index a6958cb05..5aee05745 100644 --- a/aws-lambda-java-runtime-interface-client/test/integration/docker/Dockerfile.function.amazoncorretto +++ b/aws-lambda-java-runtime-interface-client/test/integration/docker/Dockerfile.function.amazoncorretto @@ -1,6 +1,7 @@ ARG RUNTIME_VERSION +ARG BASE_REGISTRY=public.ecr.aws -FROM public.ecr.aws/amazoncorretto/amazoncorretto:${RUNTIME_VERSION} +FROM ${BASE_REGISTRY}/amazoncorretto/amazoncorretto:${RUNTIME_VERSION} ADD aws-lambda-java-runtime-interface-client/test/integration/test-handler/target/HelloWorld-1.0.jar . diff --git a/aws-lambda-java-runtime-interface-client/test/integration/docker/Dockerfile.function.amazonlinux b/aws-lambda-java-runtime-interface-client/test/integration/docker/Dockerfile.function.amazonlinux index b3d152fc1..6079611a1 100644 --- a/aws-lambda-java-runtime-interface-client/test/integration/docker/Dockerfile.function.amazonlinux +++ b/aws-lambda-java-runtime-interface-client/test/integration/docker/Dockerfile.function.amazonlinux @@ -1,6 +1,7 @@ ARG DISTRO_VERSION +ARG BASE_REGISTRY=public.ecr.aws -FROM public.ecr.aws/amazonlinux/amazonlinux:${DISTRO_VERSION} +FROM ${BASE_REGISTRY}/amazonlinux/amazonlinux:${DISTRO_VERSION} RUN yum install -y java-1.8.0-openjdk diff --git a/aws-lambda-java-runtime-interface-client/test/integration/docker/Dockerfile.function.debian b/aws-lambda-java-runtime-interface-client/test/integration/docker/Dockerfile.function.debian index 019b46a62..dc5ab9a12 100644 --- a/aws-lambda-java-runtime-interface-client/test/integration/docker/Dockerfile.function.debian +++ b/aws-lambda-java-runtime-interface-client/test/integration/docker/Dockerfile.function.debian @@ -1,6 +1,7 @@ ARG DISTRO_VERSION +ARG BASE_REGISTRY=public.ecr.aws -FROM public.ecr.aws/debian/debian:${DISTRO_VERSION} as build-image +FROM ${BASE_REGISTRY}/debian/debian:${DISTRO_VERSION} as build-image RUN apt-get update && \ apt-get install -y wget gnupg ca-certificates && \ @@ -9,7 +10,7 @@ RUN apt-get update && \ apt-get update && \ apt-get install -y java-11-amazon-corretto-jdk -FROM public.ecr.aws/debian/debian:${DISTRO_VERSION} +FROM ${BASE_REGISTRY}/debian/debian:${DISTRO_VERSION} COPY --from=build-image /usr/lib/jvm /usr/lib/jvm diff --git a/aws-lambda-java-runtime-interface-client/test/integration/docker/Dockerfile.function.ubuntu b/aws-lambda-java-runtime-interface-client/test/integration/docker/Dockerfile.function.ubuntu index 09107c469..797938607 100644 --- a/aws-lambda-java-runtime-interface-client/test/integration/docker/Dockerfile.function.ubuntu +++ b/aws-lambda-java-runtime-interface-client/test/integration/docker/Dockerfile.function.ubuntu @@ -1,6 +1,7 @@ ARG DISTRO_VERSION +ARG BASE_REGISTRY=public.ecr.aws -FROM public.ecr.aws/ubuntu/ubuntu:${DISTRO_VERSION} as build-image +FROM ${BASE_REGISTRY}/ubuntu/ubuntu:${DISTRO_VERSION} as build-image RUN apt-get update && \ apt-get install -y apt-transport-https ca-certificates && \ @@ -10,7 +11,7 @@ RUN apt-get update && \ apt-get update && \ apt-get install -y java-11-amazon-corretto-jdk -FROM public.ecr.aws/ubuntu/ubuntu:${DISTRO_VERSION} +FROM ${BASE_REGISTRY}/ubuntu/ubuntu:${DISTRO_VERSION} COPY --from=build-image /usr/lib/jvm /usr/lib/jvm