Merge pull request #632 from aws/fabisev/release-toolchains-fix

fix(ci): write JDK 8 toolchains.xml for release builds

Author: fabisev

.github/actions/configure-release-aws-credentials/action.yml

@@ -23,5 +23,6 @@ runs:
         aws-region: ${{ inputs.aws-region }}
         role-to-assume: ${{ inputs.role-to-assume }}
         role-session-name: ${{ inputs.role-session-name }}
-        # Short-lived: the job only needs the role briefly to read two secrets.
-        role-duration-seconds: 300
+        # Kept short: the job only needs the role briefly to read two secrets.
+        # 900s is STS's minimum for assume-role; anything lower is rejected.
+        role-duration-seconds: 900

.github/workflows/release-runtime-interface-client.yml

@@ -40,6 +40,11 @@ env:
   MAVEN_ARGS: "-B --no-transfer-progress"
   AWS_REGION: ${{ vars.AWS_REGION_MAVEN_RELEASE }}
   OIDC_ROLE_ARN: ${{ secrets.AWS_ROLE_MAVEN_RELEASE }}
+  # ECR pull-through cache used for the native JNI base images. ECR_REGISTRY is
+  # the login target; BASE_REGISTRY (with the /ecr-public prefix) is passed to
+  # the Dockerfiles as a build-arg.
+  ECR_REGISTRY: ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ vars.AWS_REGION_MAVEN_RELEASE }}.amazonaws.com
+  BASE_REGISTRY: ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ vars.AWS_REGION_MAVEN_RELEASE }}.amazonaws.com/ecr-public
 
 jobs:
   # Build each architecture's native libs (glibc + musl) on a native runner.
@@ -79,6 +84,17 @@ jobs:
           echo "JAVA_HOME=$JAVA_8_HOME" >> "$GITHUB_ENV"
           echo "$JAVA_8_HOME/bin" >> "$GITHUB_PATH"
           "$JAVA_8_HOME/bin/java" -version
+          mkdir -p "$HOME/.m2"
+          cat > "$HOME/.m2/toolchains.xml" <<EOF
+          <?xml version="1.0" encoding="UTF-8"?>
+          <toolchains>
+            <toolchain>
+              <type>jdk</type>
+              <provides><version>8</version></provides>
+              <configuration><jdkHome>$JAVA_8_HOME</jdkHome></configuration>
+            </toolchain>
+          </toolchains>
+          EOF
 
       # Route all mvn resolution through the CodeArtifact mirror. Must precede
       # resolve-release-version, which invokes `mvn help:evaluate`. Ambient
@@ -92,6 +108,14 @@ jobs:
           module: ${{ env.MODULE }}
           release-version-override: ${{ env.RELEASE_VERSION_INPUT }}
 
+      # The native JNI build shells out to `docker build` against the ECR
+      # pull-through cache (see src/main/jni/Dockerfile.*). Authenticate first so
+      # the base-image pulls don't hit public.ecr.aws. Uses ambient runner creds.
+      - name: Log in to Amazon ECR (pull-through cache)
+        run: |
+          aws ecr get-login-password --region "$AWS_REGION" \
+            | docker login --username AWS --password-stdin "$ECR_REGISTRY"
+
       # -DskipTests: only installed so the module compiles, not released here.
       - name: Install intra-repo dependencies
         run: |
@@ -149,6 +173,17 @@ jobs:
           echo "JAVA_HOME=$JAVA_8_HOME" >> "$GITHUB_ENV"
           echo "$JAVA_8_HOME/bin" >> "$GITHUB_PATH"
           "$JAVA_8_HOME/bin/java" -version
+          mkdir -p "$HOME/.m2"
+          cat > "$HOME/.m2/toolchains.xml" <<EOF
+          <?xml version="1.0" encoding="UTF-8"?>
+          <toolchains>
+            <toolchain>
+              <type>jdk</type>
+              <provides><version>8</version></provides>
+              <configuration><jdkHome>$JAVA_8_HOME</jdkHome></configuration>
+            </toolchain>
+          </toolchains>
+          EOF
 
       # Route all mvn resolution through the CodeArtifact mirror. Must precede
       # resolve-release-version (which invokes `mvn help:evaluate`) and the OIDC
@@ -163,6 +198,14 @@ jobs:
           module: ${{ env.MODULE }}
           release-version-override: ${{ env.RELEASE_VERSION_INPUT }}
 
+      # The native JNI build shells out to `docker build` against the ECR
+      # pull-through cache (see src/main/jni/Dockerfile.*). Authenticate first so
+      # the base-image pulls don't hit public.ecr.aws. Uses ambient runner creds.
+      - name: Log in to Amazon ECR (pull-through cache)
+        run: |
+          aws ecr get-login-password --region "$AWS_REGION" \
+            | docker login --username AWS --password-stdin "$ECR_REGISTRY"
+
       - name: Resolve next development version and tag
         run: |
           # Next development version: use the override, or bump the patch.
@@ -200,7 +243,7 @@ jobs:
       - name: Run tests
         env:
           IS_JAVA_8: true
-        run: mvn test --file "$MODULE/pom.xml"
+        run: mvn test -DargLineForReflectionTestOnly="" --file "$MODULE/pom.xml"
 
       # JARs to attach + .so files for the fat main JAR.
       - name: Download native artifacts

.github/workflows/release.yml

@@ -95,6 +95,17 @@ jobs:
           echo "JAVA_HOME=$JAVA_8_HOME" >> "$GITHUB_ENV"
           echo "$JAVA_8_HOME/bin" >> "$GITHUB_PATH"
           "$JAVA_8_HOME/bin/java" -version
+          mkdir -p "$HOME/.m2"
+          cat > "$HOME/.m2/toolchains.xml" <<EOF
+          <?xml version="1.0" encoding="UTF-8"?>
+          <toolchains>
+            <toolchain>
+              <type>jdk</type>
+              <provides><version>8</version></provides>
+              <configuration><jdkHome>$JAVA_8_HOME</jdkHome></configuration>
+            </toolchain>
+          </toolchains>
+          EOF
 
       # Route all mvn resolution through the CodeArtifact mirror. Runs before the
       # OIDC step (which would shadow the runner-role creds this needs) and on

aws-lambda-java-runtime-interface-client/src/main/jni/Dockerfile.glibc

@@ -1,6 +1,10 @@
-FROM public.ecr.aws/amazonlinux/amazonlinux:2
+ARG BASE_REGISTRY=public.ecr.aws
+FROM ${BASE_REGISTRY}/amazonlinux/amazonlinux:2
 
 ARG CURL_VERSION
+ARG AWS_REGION
+
+RUN if [ -n "${AWS_REGION}" ]; then echo "${AWS_REGION}" > /etc/yum/vars/awsregion; fi
 
 RUN yum install -y \
         cmake3 \

aws-lambda-java-runtime-interface-client/src/main/jni/Dockerfile.musl

@@ -1,4 +1,5 @@
-FROM public.ecr.aws/docker/library/alpine:3
+ARG BASE_REGISTRY=public.ecr.aws
+FROM ${BASE_REGISTRY}/docker/library/alpine:3
 
 ARG CURL_VERSION
 

aws-lambda-java-runtime-interface-client/src/main/jni/build-jni-lib.sh

@@ -9,6 +9,11 @@ MULTI_ARCH=${2}
 BUILD_OS=${3}
 BUILD_ARCH=${4}
 CURL_VERSION=7.83.1
+# Registry hosting the base images. Defaults to public.ecr.aws for local and
+# GitHub-hosted builds; the release workflow overrides it with the ECR
+# pull-through cache so egress-locked runners don't hit public.ecr.aws.
+BASE_REGISTRY="${BASE_REGISTRY:-public.ecr.aws}"
+AWS_REGION="${AWS_REGION:-${AWS_DEFAULT_REGION:-}}"
 
 function get_docker_platform() {
   arch=$1
@@ -45,7 +50,7 @@ function build_for_libc_arch() {
 
   if [[ "${MULTI_ARCH}" == "true" ]]; then
       docker build --platform="${docker_platform}" -f "${SRC_DIR}/Dockerfile.${libc_impl}" \
-            --build-arg CURL_VERSION=${CURL_VERSION} "${SRC_DIR}" -o - \
+            --build-arg CURL_VERSION=${CURL_VERSION} --build-arg BASE_REGISTRY=${BASE_REGISTRY} --build-arg AWS_REGION=${AWS_REGION} "${SRC_DIR}" -o - \
       | tar -xOf - src/aws-lambda-runtime-interface-client.so > "${artifact}"
   else
       echo "multi-arch not requested, assuming this is a workaround to goofyness when docker buildx is enabled on Linux CI environments."
@@ -63,7 +68,7 @@ function build_for_libc_arch() {
       docker build --platform="${docker_platform}" \
             -t "${image_name}" \
             -f "${SRC_DIR}/Dockerfile.${libc_impl}" \
-            --build-arg CURL_VERSION=${CURL_VERSION} "${SRC_DIR}" ${EXTRA_LOAD_ARG}
+            --build-arg CURL_VERSION=${CURL_VERSION} --build-arg BASE_REGISTRY=${BASE_REGISTRY} --build-arg AWS_REGION=${AWS_REGION} "${SRC_DIR}" ${EXTRA_LOAD_ARG}
 
       echo "Docker image has been successfully built"
 

aws-lambda-java-runtime-interface-client/src/test/java/com/amazonaws/services/lambda/crac/DNSCacheManagerTest.java

@@ -69,7 +69,7 @@ public void positiveDnsCacheShouldBeEmpty() throws CheckpointException, RestoreE
         StatefulResource resource = new StatefulResource();
         Core.getGlobalContext().register(resource);
 
-        String[] hosts = {"www.stackoverflow.com", "www.amazon.com", "www.yahoo.com"};
+        String[] hosts = {"github.com", "amazonaws.com"};
         for(String singleHost : hosts) {
             InetAddress address = InetAddress.getByName(singleHost);
         }