Skip to content

chore(ci): pin CLI references to hardened devtools #2749

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nborges-aws wants to merge 1 commit into
base: v1.x
Choose a base branch
from
Open

chore(ci): pin CLI references to hardened devtools #2749

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/canary-v0.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ jobs:
git config --global user.name "CI"
- uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
- name: Fetch E2E role from Secrets Manager
uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@75989f65f7f193deaf83c237c36572d1a8f800b2
uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@e68d09b0c33dfb7a798448d50e6b48beedf00a3b
with:
role-arn: ${{ secrets.WORKFLOW_SECRETS_READER_ROLE_ARN }}
repo: E2E_AWS_ROLE_ARN
Expand Down Expand Up @@ -96,7 +96,7 @@ jobs:
with:
persist-credentials: false
- name: Fetch E2E role from Secrets Manager
uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@75989f65f7f193deaf83c237c36572d1a8f800b2
uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@e68d09b0c33dfb7a798448d50e6b48beedf00a3b
with:
role-arn: ${{ secrets.WORKFLOW_SECRETS_READER_ROLE_ARN }}
repo: E2E_AWS_ROLE_ARN
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/canary.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ jobs:
with:
persist-credentials: false
- name: Fetch E2E role from Secrets Manager
uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@75989f65f7f193deaf83c237c36572d1a8f800b2
uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@e68d09b0c33dfb7a798448d50e6b48beedf00a3b
with:
role-arn: ${{ secrets.WORKFLOW_SECRETS_READER_ROLE_ARN }}
repo: E2E_AWS_ROLE_ARN
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/e2e-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,13 +57,13 @@ jobs:
is-authorized: ${{ github.workflow == 'canary' || steps.check.outputs.is_authorized == 'true' }}
steps:
- name: Fetch secrets from Secrets Manager
uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@75989f65f7f193deaf83c237c36572d1a8f800b2
uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@e68d09b0c33dfb7a798448d50e6b48beedf00a3b
with:
role-arn: ${{ secrets.WORKFLOW_SECRETS_READER_ROLE_ARN }}
repo: AUTHORIZED_USERS
- name: Check authorization
id: authz
uses: aws/agentcore-devx-devtools/.github/actions/check-authorized-user@31aa3b031a86664e29861d68956e44b07cf21a74
uses: aws/agentcore-devx-devtools/.github/actions/check-authorized-user@e68d09b0c33dfb7a798448d50e6b48beedf00a3b
with:
subject: ${{ github.actor }}
authorized-users: ${{ env.AUTHORIZED_USERS }}
Expand Down Expand Up @@ -115,7 +115,7 @@ jobs:
python-version: "3.14"
- run: bun install --frozen-lockfile
- name: Fetch E2E role from Secrets Manager
uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@75989f65f7f193deaf83c237c36572d1a8f800b2
uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@e68d09b0c33dfb7a798448d50e6b48beedf00a3b
with:
role-arn: ${{ secrets.WORKFLOW_SECRETS_READER_ROLE_ARN }}
repo: E2E_AWS_ROLE_ARN
Expand Down
10 changes: 5 additions & 5 deletions .github/workflows/pr-automation.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ jobs:
contents: read
pull-requests: write
statuses: write
uses: aws/agentcore-devx-devtools/.github/workflows/reusable-pr-size-title.yml@458c0a684af0f9e3a013ec05cd23851def4f9cab
uses: aws/agentcore-devx-devtools/.github/workflows/reusable-pr-size-title.yml@c2106996dd94e56f6c5fad625c83573e9724fb63
with:
runner: codebuild
secrets: inherit
Expand All @@ -42,7 +42,7 @@ jobs:
pull-requests: write
issues: write
contents: read
uses: aws/agentcore-devx-devtools/.github/workflows/reusable-pr-security-review.yml@4b3972e790e4cc312ddf6f1909a0b6ca8a749506
uses: aws/agentcore-devx-devtools/.github/workflows/reusable-pr-security-review.yml@c2106996dd94e56f6c5fad625c83573e9724fb63
with:
runner: codebuild
pr_number: ${{ inputs.pr_number || format('{0}', github.event.pull_request.number) }}
Expand All @@ -61,7 +61,7 @@ jobs:
pull-requests: write
issues: write
contents: read
uses: aws/agentcore-devx-devtools/.github/workflows/reusable-pr-ai-review.yml@4b3972e790e4cc312ddf6f1909a0b6ca8a749506
uses: aws/agentcore-devx-devtools/.github/workflows/reusable-pr-ai-review.yml@c2106996dd94e56f6c5fad625c83573e9724fb63
with:
runner: codebuild
model_id: us.anthropic.claude-opus-5
Expand Down Expand Up @@ -124,13 +124,13 @@ jobs:
echo "author=$author" >> "$GITHUB_OUTPUT"
echo "head_sha=$head_sha" >> "$GITHUB_OUTPUT"
- name: Fetch secrets from Secrets Manager
uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@31aa3b031a86664e29861d68956e44b07cf21a74
uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@e68d09b0c33dfb7a798448d50e6b48beedf00a3b
with:
role-arn: ${{ secrets.WORKFLOW_SECRETS_READER_ROLE_ARN }}
repo: AUTHORIZED_USERS
- name: Check authorization
id: authz
uses: aws/agentcore-devx-devtools/.github/actions/check-authorized-user@31aa3b031a86664e29861d68956e44b07cf21a74
uses: aws/agentcore-devx-devtools/.github/actions/check-authorized-user@e68d09b0c33dfb7a798448d50e6b48beedf00a3b
with:
subject: ${{ steps.pr.outputs.author }}
authorized-users: ${{ env.AUTHORIZED_USERS }}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/slack-issue-notification.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ permissions:

jobs:
call:
uses: aws/agentcore-devx-devtools/.github/workflows/reusable-slack-issue-notification.yml@458c0a684af0f9e3a013ec05cd23851def4f9cab
uses: aws/agentcore-devx-devtools/.github/workflows/reusable-slack-issue-notification.yml@c2106996dd94e56f6c5fad625c83573e9724fb63
with:
runner: codebuild
secrets: inherit
2 changes: 1 addition & 1 deletion .github/workflows/slack-open-prs-notification.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ permissions:

jobs:
call:
uses: aws/agentcore-devx-devtools/.github/workflows/reusable-slack-open-prs-notification.yml@458c0a684af0f9e3a013ec05cd23851def4f9cab
uses: aws/agentcore-devx-devtools/.github/workflows/reusable-slack-open-prs-notification.yml@c2106996dd94e56f6c5fad625c83573e9724fb63
with:
runner: codebuild
secrets: inherit
2 changes: 1 addition & 1 deletion .github/workflows/workflow-metrics.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ permissions:

jobs:
metrics:
uses: aws/agentcore-devx-devtools/.github/workflows/workflow-metrics.yml@d145deb62f1adc8be63fa4879a488499e1128a46
uses: aws/agentcore-devx-devtools/.github/workflows/workflow-metrics.yml@c2106996dd94e56f6c5fad625c83573e9724fb63
with:
namespace: AgentCoreCLI/Workflows
os: Linux
Expand Down
Loading