From 8073aa96223bc490f33c3a9204803e173e6e5c6b Mon Sep 17 00:00:00 2001 From: Lucas McDonald Date: Mon, 26 Oct 2026 16:28:07 +0000 Subject: [PATCH 1/6] chore: declare the default-cmm-reproduced-encryption-context feature --- test-server/feature-config.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/test-server/feature-config.json b/test-server/feature-config.json index d32c5f0bc..f00cf404b 100644 --- a/test-server/feature-config.json +++ b/test-server/feature-config.json @@ -11,7 +11,8 @@ "aws-kms-mrk", "aws-kms-mrk-multi", "aws-kms-mrk-discovery", - "caching" + "caching", + "default-cmm-reproduced-encryption-context" ], "unsupportedFeatures": [ "MPL", From 5a941af8a9f1313953d1bc6cdc282e8e1d9f35ad Mon Sep 17 00:00:00 2001 From: Lucas McDonald Date: Mon, 2 Nov 2026 22:30:18 +0000 Subject: [PATCH 2/6] chore(test-server): declare default-cmm-reproduced-encryption-context unsupported --- test-server/feature-config.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/test-server/feature-config.json b/test-server/feature-config.json index f00cf404b..cce5e16af 100644 --- a/test-server/feature-config.json +++ b/test-server/feature-config.json @@ -11,14 +11,14 @@ "aws-kms-mrk", "aws-kms-mrk-multi", "aws-kms-mrk-discovery", - "caching", - "default-cmm-reproduced-encryption-context" + "caching" ], "unsupportedFeatures": [ "MPL", "raw-ecdh", "aws-kms-rsa", "aws-kms-ecdh", - "required-encryption-context" + "required-encryption-context", + "default-cmm-reproduced-encryption-context" ] } From dff485984e2ff4a46e67c82111bbdba4ac731761 Mon Sep 17 00:00:00 2001 From: Lucas McDonald Date: Mon, 2 Nov 2026 22:47:58 +0000 Subject: [PATCH 3/6] ci(test-server): honor Test-Server-Override lines --- .github/workflows/test-server.yml | 40 +++++++++++++++++++++++++++++++ test-server/Makefile | 3 +++ 2 files changed, 43 insertions(+) diff --git a/.github/workflows/test-server.yml b/.github/workflows/test-server.yml index fa4316b30..9cdb9e160 100644 --- a/.github/workflows/test-server.yml +++ b/.github/workflows/test-server.yml @@ -164,6 +164,42 @@ jobs: test -n "$PAT" || { echo "::error::COMMONS_REPO_PAT is empty/unset in this repo"; exit 1; } git config --global url."https://x-access-token:${PAT}@github.com/".insteadOf "git@github.com:" + - name: Resolve Test-Server-Override lines in the pull request description + id: override + env: + REPOSITORY: ${{ github.repository }} + SHA: ${{ github.sha }} + PR_NUMBER: ${{ github.event.pull_request.number }} + HEAD_REF: ${{ github.head_ref }} + EVENT_BODY: ${{ github.event.pull_request.body }} + GH_TOKEN: ${{ github.token }} + REPO_PAT: ${{ secrets.COMMONS_REPO_PAT }} + run: | + set -euo pipefail + script="$RUNNER_TEMP/resolve-test-server-refs.sh" + GH_TOKEN=$REPO_PAT gh api -H "Accept: application/vnd.github.raw" \ + "repos/aws/aws-crypto-tools-commons/contents/.github/scripts/resolve-test-server-refs.sh?ref=main" > "$script" + chmod +x "$script" + "$script" resolve + + - name: Pick the commons branch named by an override + id: commons + env: + COMMONS_REF: ${{ steps.override.outputs.commons_ref }} + PAT: ${{ secrets.COMMONS_REPO_PAT }} + run: | + set -euo pipefail + branch="" + if [[ $COMMONS_REF =~ ^[0-9a-f]{40}$ ]]; then + branch=$(git ls-remote --heads "https://x-access-token:${PAT}@github.com/aws/aws-crypto-tools-commons.git" | + awk -v s="$COMMONS_REF" '$1 == s { sub("refs/heads/", "", $2); print $2; exit }') + if [ -z "$branch" ]; then + echo "::error::no commons branch is at $COMMONS_REF" >&2 + exit 1 + fi + fi + echo "branch=$branch" >> "$GITHUB_OUTPUT" + - name: Configure AWS credentials via OIDC (required KMS scenarios) id: aws-credentials continue-on-error: true @@ -181,6 +217,10 @@ jobs: - name: Run the orchestrated TestServer working-directory: test-server + env: + COMMONS_BRANCH: ${{ steps.commons.outputs.branch }} + LANGUAGE_BRANCHES: ${{ steps.override.outputs.language_branches }} + RESOLVE_SCRIPT: ${{ runner.temp }}/resolve-test-server-refs.sh run: make test-server - name: Save build caches diff --git a/test-server/Makefile b/test-server/Makefile index 89927c715..95b32dc31 100644 --- a/test-server/Makefile +++ b/test-server/Makefile @@ -90,6 +90,9 @@ test-server: check-java ## Run the complete cross-language TestServer via the co if [ ! -d "$(CLONE_ORCH_DIR)" ]; then \ echo "ERROR: branch $$branch of $$url has no orchestrator at esdk/test-server/orchestrator." >&2; exit 1; \ fi; \ + if [ -n "$${LANGUAGE_BRANCHES//[[:space:]]/}" ]; then \ + (cd "$(CLONE_DIR)" && "$${RESOLVE_SCRIPT:-.github/scripts/resolve-test-server-refs.sh}" apply); \ + fi; \ echo "==> Delegating: context=language:javascript languageRepoRoot=$(REPO_ROOT)"; \ cd "$(CLONE_ORCH_DIR)" && ./gradlew --console=plain run \ --args="context=language:javascript languageRepoRoot=$(REPO_ROOT) commonsOrigin.url=$$url commonsOrigin.branch=$$branch commonsOrigin.reason=$$reason" From 158a55196956a9e553a6a48766da7f018659e0aa Mon Sep 17 00:00:00 2001 From: Lucas McDonald Date: Mon, 2 Nov 2026 22:52:27 +0000 Subject: [PATCH 4/6] ci(test-server): run the shared commons orchestrator when present --- test-server/Makefile | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/test-server/Makefile b/test-server/Makefile index 95b32dc31..5a355bf24 100644 --- a/test-server/Makefile +++ b/test-server/Makefile @@ -87,14 +87,16 @@ test-server: check-java ## Run the complete cross-language TestServer via the co if ! git clone --depth 1 --single-branch --branch "$$branch" "$$url" "$(CLONE_DIR)"; then \ echo "ERROR: failed to clone $$url at branch $$branch; no Tests will run." >&2; exit 1; \ fi; \ - if [ ! -d "$(CLONE_ORCH_DIR)" ]; then \ - echo "ERROR: branch $$branch of $$url has no orchestrator at esdk/test-server/orchestrator." >&2; exit 1; \ + orch="$(CLONE_DIR)/test-server-common/orchestrator"; root_flag="-Dtestserver.root=$(CLONE_DIR)/esdk/test-server"; \ + if [ ! -d "$$orch" ]; then orch="$(CLONE_ORCH_DIR)"; root_flag=""; fi; \ + if [ ! -d "$$orch" ]; then \ + echo "ERROR: branch $$branch of $$url has no orchestrator at test-server-common/orchestrator or esdk/test-server/orchestrator." >&2; exit 1; \ fi; \ if [ -n "$${LANGUAGE_BRANCHES//[[:space:]]/}" ]; then \ (cd "$(CLONE_DIR)" && "$${RESOLVE_SCRIPT:-.github/scripts/resolve-test-server-refs.sh}" apply); \ fi; \ echo "==> Delegating: context=language:javascript languageRepoRoot=$(REPO_ROOT)"; \ - cd "$(CLONE_ORCH_DIR)" && ./gradlew --console=plain run \ + cd "$$orch" && ./gradlew --console=plain run $$root_flag \ --args="context=language:javascript languageRepoRoot=$(REPO_ROOT) commonsOrigin.url=$$url commonsOrigin.branch=$$branch commonsOrigin.reason=$$reason" clean: ## Remove build output, server scratch files, and the commons clone From 88221bbffd9ff5b975fc811d72e4337fb7075f52 Mon Sep 17 00:00:00 2001 From: Lucas McDonald Date: Mon, 2 Nov 2026 23:33:37 +0000 Subject: [PATCH 5/6] ci(test-server): run the cross-language suite from the commons reusable workflow --- .github/workflows/test-server.yml | 206 ++---------------------------- 1 file changed, 14 insertions(+), 192 deletions(-) diff --git a/.github/workflows/test-server.yml b/.github/workflows/test-server.yml index 9cdb9e160..cfb0c7477 100644 --- a/.github/workflows/test-server.yml +++ b/.github/workflows/test-server.yml @@ -43,198 +43,20 @@ jobs: working-directory: test-server run: npm test - # The complete cross-language TestServer run: `make test-server` clones commons and - # the orchestrator materializes + builds + launches every configured Language_Server - # (this working tree is the live server), runs the full pairwise matrix, and tears - # down. Provisions the full toolchain matrix + the commons build caches. Needs the - # COMMONS_REPO_PAT secret (read on commons + java + rust). + # The cross-language TestServer run, from the shared commons workflow. This + # checkout supplies the javascript server and library; every other server comes from + # its configured branch. Only the pairs involving javascript run; the full matrix + # runs in commons. repo-pat reads the private aws-crypto-tools-rust clones. test-server: - name: Cross-language TestServer run - runs-on: ubuntu-latest + name: TestServer permissions: - id-token: write contents: read - env: - AWS_REGION: us-west-2 - GRADLE_OPTS: -Dorg.gradle.daemon=false - # Cold builds (Java gradle/maven, Rust aws-lc-sys, .NET dafny transpile) exceed - # the orchestrator's 180s default server-readiness window; widen it so the first - # (cold-cache) run fits. Warm runs are fast via the build caches above. - ESDK_TESTSERVER_READY_TIMEOUT_SECONDS: "1800" - steps: - - uses: actions/checkout@v4 - with: - persist-credentials: false - - - name: Set up JDK 17 (Temurin) — exposes JAVA_HOME_17_X64 for the MPL stub jar - uses: actions/setup-java@v4 - with: - distribution: temurin - java-version: "17" - - - name: Set up JDK 21 (Temurin) — the commons orchestrator (smithy-java) needs 21+ - uses: actions/setup-java@v4 - with: - distribution: temurin - java-version: "21" - - - name: Set up Python 3.11 (the materialized Python Language_Server needs >=3.11) - uses: actions/setup-python@v5 - with: - python-version: "3.11" - - - name: Set up Node.js 22 (the materialized JavaScript Language_Server build needs 17+) - uses: actions/setup-node@v4 - with: - node-version: "22" - - - name: Set up Go (Go Language_Server + the Rust servers' aws-lc-sys native builds) - uses: actions/setup-go@v5 - with: - go-version: "stable" - - - name: Set up the Rust toolchain (Rust Language_Server builds) - run: | - set -euo pipefail - rustup toolchain install stable --profile minimal - rustup default stable - cargo --version - - - name: Set up .NET (the materialized .NET Language_Server build) - uses: actions/setup-dotnet@v5 - with: - dotnet-version: | - 6.0.x - 8.0.x - - - name: Install Dafny 4.9.0 (the .NET library transpile in the materialized clone) - run: | - set -euo pipefail - dotnet tool install --global dafny --version 4.9.0 - echo "$HOME/.dotnet/tools" >> "$GITHUB_PATH" - "$HOME/.dotnet/tools/dafny" --version - - - name: Build aws-c-common (the materialized C Language_Server cmake requires it) - run: | - set -euo pipefail - git clone --depth 1 https://github.com/awslabs/aws-c-common "$RUNNER_TEMP/aws-c-common" - cmake -S "$RUNNER_TEMP/aws-c-common" -B "$RUNNER_TEMP/aws-c-common-build" \ - -DCMAKE_INSTALL_PREFIX="${{ github.workspace }}/.aws-c-common-install" \ - -DBUILD_TESTING=OFF - cmake --build "$RUNNER_TEMP/aws-c-common-build" --target install -- -j - echo "CMAKE_PREFIX_PATH=${{ github.workspace }}/.aws-c-common-install" >> "$GITHUB_ENV" - - - name: Restore build caches (Gradle/Maven/Cargo/NuGet/Go/npm) - uses: actions/cache/restore@v4 - with: - path: | - ~/.gradle/caches - ~/.gradle/wrapper - ~/.m2/repository - ~/.cargo/registry - ~/.cargo/git - ~/.nuget/packages - ~/go/pkg/mod - ~/.cache/go-build - ~/.npm - key: ${{ runner.os }}-esdk-ts-build-${{ github.run_id }} - restore-keys: | - ${{ runner.os }}-esdk-ts-build- - - - name: Install stub for the unpublished MPL test-vectors artifact - # The materialized Java Language_Server build runs `mvn install`, which - # resolves a test-scope MPL artifact (TestAwsCryptographicMaterialProviders) - # that is not on Maven Central; a stub jar satisfies resolution (tests skip). - run: | - set -euo pipefail - tmp="$(mktemp -d)" - echo placeholder > "$tmp/README.txt" - "$JAVA_HOME_17_X64/bin/jar" cf "$tmp/stub.jar" -C "$tmp" README.txt - mvn -q -e org.apache.maven.plugins:maven-install-plugin:3.1.1:install-file \ - -Dfile="$tmp/stub.jar" \ - -DgroupId=software.amazon.cryptography \ - -DartifactId=TestAwsCryptographicMaterialProviders \ - -Dversion=1.7.0 \ - -Dpackaging=jar - - - name: Authenticate the private clones (commons, java, rust) - env: - PAT: ${{ secrets.COMMONS_REPO_PAT }} - run: | - test -n "$PAT" || { echo "::error::COMMONS_REPO_PAT is empty/unset in this repo"; exit 1; } - git config --global url."https://x-access-token:${PAT}@github.com/".insteadOf "git@github.com:" - - - name: Resolve Test-Server-Override lines in the pull request description - id: override - env: - REPOSITORY: ${{ github.repository }} - SHA: ${{ github.sha }} - PR_NUMBER: ${{ github.event.pull_request.number }} - HEAD_REF: ${{ github.head_ref }} - EVENT_BODY: ${{ github.event.pull_request.body }} - GH_TOKEN: ${{ github.token }} - REPO_PAT: ${{ secrets.COMMONS_REPO_PAT }} - run: | - set -euo pipefail - script="$RUNNER_TEMP/resolve-test-server-refs.sh" - GH_TOKEN=$REPO_PAT gh api -H "Accept: application/vnd.github.raw" \ - "repos/aws/aws-crypto-tools-commons/contents/.github/scripts/resolve-test-server-refs.sh?ref=main" > "$script" - chmod +x "$script" - "$script" resolve - - - name: Pick the commons branch named by an override - id: commons - env: - COMMONS_REF: ${{ steps.override.outputs.commons_ref }} - PAT: ${{ secrets.COMMONS_REPO_PAT }} - run: | - set -euo pipefail - branch="" - if [[ $COMMONS_REF =~ ^[0-9a-f]{40}$ ]]; then - branch=$(git ls-remote --heads "https://x-access-token:${PAT}@github.com/aws/aws-crypto-tools-commons.git" | - awk -v s="$COMMONS_REF" '$1 == s { sub("refs/heads/", "", $2); print $2; exit }') - if [ -z "$branch" ]; then - echo "::error::no commons branch is at $COMMONS_REF" >&2 - exit 1 - fi - fi - echo "branch=$branch" >> "$GITHUB_OUTPUT" - - - name: Configure AWS credentials via OIDC (required KMS scenarios) - id: aws-credentials - continue-on-error: true - uses: aws-actions/configure-aws-credentials@v4 - with: - role-to-assume: ${{ vars.ESDK_TEST_SERVER_KMS_ROLE_ARN || 'arn:aws:iam::370957321024:role/esdk-test-server-ci-kms-role' }} - aws-region: us-west-2 - - - name: Verify AWS credentials are active (gates the orchestrated run) - run: | - if ! aws sts get-caller-identity; then - echo "::error::No usable AWS credentials for the required KMS scenarios." >&2 - exit 1 - fi - - - name: Run the orchestrated TestServer - working-directory: test-server - env: - COMMONS_BRANCH: ${{ steps.commons.outputs.branch }} - LANGUAGE_BRANCHES: ${{ steps.override.outputs.language_branches }} - RESOLVE_SCRIPT: ${{ runner.temp }}/resolve-test-server-refs.sh - run: make test-server - - - name: Save build caches - if: always() - uses: actions/cache/save@v4 - with: - path: | - ~/.gradle/caches - ~/.gradle/wrapper - ~/.m2/repository - ~/.cargo/registry - ~/.cargo/git - ~/.nuget/packages - ~/go/pkg/mod - ~/.cache/go-build - ~/.npm - key: ${{ runner.os }}-esdk-ts-build-${{ github.run_id }} + actions: read + id-token: write + uses: aws/aws-crypto-tools-commons/.github/workflows/esdk-test-server-reusable.yml@main + with: + focus: javascript + checkout-languages: javascript + runner: ubuntu-latest + secrets: + repo-pat: ${{ secrets.COMMONS_REPO_PAT }} From e6f80a146787456f8cc88a184ddb426548127ad1 Mon Sep 17 00:00:00 2001 From: Lucas McDonald Date: Tue, 3 Nov 2026 00:29:33 +0000 Subject: [PATCH 6/6] ci(test-server): run push builds on master only; drop --unsafe-perm --- .github/workflows/test-server.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/test-server.yml b/.github/workflows/test-server.yml index cfb0c7477..4b3fe2579 100644 --- a/.github/workflows/test-server.yml +++ b/.github/workflows/test-server.yml @@ -8,6 +8,8 @@ on: - "test-server/**" - ".github/workflows/test-server.yml" push: + branches: + - master paths: - "test-server/**" - ".github/workflows/test-server.yml" @@ -30,7 +32,7 @@ jobs: cache: "npm" - name: Install dependencies - run: npm ci --unsafe-perm + run: npm ci - name: Build modules run: npm run build-node