Skip to content

Commit 8a786c8

Browse files
josecorellajosecorella
authored
fix: validate encryption materials from cmm are compatible with kc policy (#796)
1 parent e55db0a commit 8a786c8

12 files changed

Lines changed: 208 additions & 28 deletions

File tree

‎.github/workflows/ci_decrypt-oracle.yaml‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,10 @@
11
name: Continuous Integration tests for the decrypt oracle
22

33
on:
4-
pull_request:
5-
push:
6-
# Run once a day
7-
schedule:
8-
- cron: '0 0 * * *'
4+
workflow_call:
5+
6+
permissions:
7+
contents: read
98

109
jobs:
1110
tests:

‎.github/workflows/ci_static-analysis.yaml‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,10 @@
11
name: Static analysis checks
22

33
on:
4-
pull_request:
5-
push:
6-
# Run once a day
7-
schedule:
8-
- cron: '0 0 * * *'
4+
workflow_call:
5+
6+
permissions:
7+
contents: read
98

109
jobs:
1110
analysis:

‎.github/workflows/ci_test-vector-handler.yaml‎

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,13 @@
11
name: Continuous Integration tests for the test vector handler
22

33
on:
4-
pull_request:
5-
push:
6-
# Run once a day
7-
schedule:
8-
- cron: '0 0 * * *'
4+
workflow_call:
5+
# Define any secrets that need to be passed from the caller
6+
secrets:
7+
INTEG_AWS_ACCESS_KEY_ID:
8+
required: true
9+
INTEG_AWS_SECRET_ACCESS_KEY:
10+
required: true
911

1012
jobs:
1113
tests:
@@ -19,10 +21,10 @@ jobs:
1921
os:
2022
- ubuntu-latest
2123
- windows-latest
22-
- macos-12
24+
- macos-latest
2325
python:
2426
- 3.8
25-
- 3.x
27+
- "3.12"
2628
architecture:
2729
- x64
2830
- x86
@@ -34,8 +36,10 @@ jobs:
3436
# x86 builds are only meaningful for Windows
3537
- os: ubuntu-latest
3638
architecture: x86
37-
- os: macos-12
39+
- os: macos-latest
3840
architecture: x86
41+
- os: macos-latest
42+
python: 3.8
3943
steps:
4044
- uses: aws-actions/configure-aws-credentials@v4
4145
with:

‎.github/workflows/ci_tests.yaml‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,7 @@
11
name: Continuous Integration tests
22

33
on:
4-
pull_request:
5-
push:
6-
# Run once a day
7-
schedule:
8-
- cron: '0 0 * * *'
4+
workflow_call:
95

106
env:
117
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID: |
@@ -26,14 +22,13 @@ jobs:
2622
os:
2723
- ubuntu-latest
2824
- windows-latest
29-
- macos-12
25+
- macos-latest
3026
python:
3127
- 3.8
3228
- 3.9
3329
- "3.10"
3430
- "3.11"
3531
- "3.12"
36-
- 3.x
3732
architecture:
3833
- x64
3934
- x86
@@ -48,8 +43,15 @@ jobs:
4843
# x86 builds are only meaningful for Windows
4944
- os: ubuntu-latest
5045
architecture: x86
51-
- os: macos-12
46+
- os: macos-latest
5247
architecture: x86
48+
# Skip older Python versions on macOS
49+
- os: macos-latest
50+
python: 3.8
51+
- os: macos-latest
52+
python: 3.9
53+
- os: macos-latest
54+
python: "3.10"
5355
steps:
5456
- uses: actions/checkout@v4
5557
- uses: actions/setup-python@v4

‎.github/workflows/daily_ci.yml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# This workflow runs every weekday at 15:00 UTC (8AM PDT)
2+
name: Daily CI
3+
4+
on:
5+
schedule:
6+
- cron: "00 15 * * 1-5"
7+
pull_request:
8+
paths:
9+
.github/workflows/daily_ci.yml
10+
11+
permissions:
12+
contents: read
13+
id-token: write
14+
15+
jobs:
16+
decrypt_oracle:
17+
# Don't run the cron builds on forks
18+
if: github.event_name != 'schedule' || github.repository_owner == 'aws'
19+
uses: ./.github/workflows/ci_decrypt-oracle.yaml
20+
static_analysis:
21+
# Don't run the cron builds on forks
22+
if: github.event_name != 'schedule' || github.repository_owner == 'aws'
23+
uses: ./.github/workflows/ci_static-analysis.yaml
24+
test_vector_handler:
25+
# Don't run the cron builds on forks
26+
if: github.event_name != 'schedule' || github.repository_owner == 'aws'
27+
uses: ./.github/workflows/ci_test-vector-handler.yaml
28+
secrets:
29+
INTEG_AWS_ACCESS_KEY_ID: ${{ secrets.INTEG_AWS_ACCESS_KEY_ID }}
30+
INTEG_AWS_SECRET_ACCESS_KEY: ${{ secrets.INTEG_AWS_SECRET_ACCESS_KEY }}
31+
tests:
32+
# Don't run the cron builds on forks
33+
if: github.event_name != 'schedule' || github.repository_owner == 'aws'
34+
uses: ./.github/workflows/ci_tests.yaml
35+
36+
notify:
37+
needs:
38+
[
39+
decrypt_oracle,
40+
static_analysis,
41+
test_vector_handler,
42+
tests
43+
]
44+
if: ${{ failure() }}
45+
uses: aws/aws-cryptographic-material-providers-library/.github/workflows/slack-notification.yml@main
46+
with:
47+
message: "Daily CI failed on `${{ github.repository }}`. View run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
48+
secrets:
49+
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL_CI }}
50+

‎.github/workflows/pull.yml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
name: Pull Request Workflow
2+
3+
on:
4+
pull_request:
5+
6+
# Concurrency control helps avoid CodeBuild throttling.
7+
# When new commits are pushed, the previous workflow run is cancelled.
8+
concurrency:
9+
group: ${{ github.workflow }}-${{ github.ref }}
10+
cancel-in-progress: true
11+
12+
permissions:
13+
id-token: write
14+
contents: read
15+
16+
jobs:
17+
# Call each workflow with appropriate parameters
18+
decrypt_oracle:
19+
uses: ./.github/workflows/ci_decrypt-oracle.yaml
20+
static_analysis:
21+
uses: ./.github/workflows/ci_static-analysis.yaml
22+
test_vector_handler:
23+
uses: ./.github/workflows/ci_test-vector-handler.yaml
24+
secrets:
25+
INTEG_AWS_ACCESS_KEY_ID: ${{ secrets.INTEG_AWS_ACCESS_KEY_ID }}
26+
INTEG_AWS_SECRET_ACCESS_KEY: ${{ secrets.INTEG_AWS_SECRET_ACCESS_KEY }}
27+
tests:
28+
uses: ./.github/workflows/ci_tests.yaml
29+
pr-ci-all-required:
30+
if: always()
31+
needs:
32+
- decrypt_oracle
33+
- static_analysis
34+
- test_vector_handler
35+
- tests
36+
runs-on: ubuntu-22.04
37+
steps:
38+
- name: Verify all required jobs passed
39+
uses: re-actors/alls-green@release/v1
40+
with:
41+
jobs: ${{ toJSON(needs) }}

‎.github/workflows/push.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
name: Push Workflow
2+
3+
on:
4+
push:
5+
branches: master
6+
7+
permissions:
8+
id-token: write
9+
contents: read
10+
11+
jobs:
12+
decrypt_oracle:
13+
uses: ./.github/workflows/ci_decrypt-oracle.yaml
14+
15+
static_analysis:
16+
uses: ./.github/workflows/ci_static-analysis.yaml
17+
18+
test_vector_handler:
19+
uses: ./.github/workflows/ci_test-vector-handler.yaml
20+
secrets:
21+
INTEG_AWS_ACCESS_KEY_ID: ${{ secrets.INTEG_AWS_ACCESS_KEY_ID }}
22+
INTEG_AWS_SECRET_ACCESS_KEY: ${{ secrets.INTEG_AWS_SECRET_ACCESS_KEY }}
23+
24+
tests:
25+
uses: ./.github/workflows/ci_tests.yaml

‎decrypt_oracle/src/pylintrc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
[MESSAGES CONTROL]
22
# Disabling messages that we either don't care about for tests or are necessary to break for tests.
33
disable =
4+
too-many-positional-arguments, # on 2026-04-17 aws_encryption_sdk_decrypt_oracle started failing because of this
45
ungrouped-imports, # we let isort handle this
56
consider-using-f-string # disable until 2022-05-05; 6 months after 3.5 deprecation
67

‎dev_requirements/linter-requirements.txt‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,9 @@ flake8-bugbear==22.9.11
66
flake8-docstrings==1.7.0
77
flake8-print==5.0.0
88
isort==5.11.4
9+
pbr>=5.5.0
910
pyflakes==2.4.0
1011
pylint==2.13.5
1112
readme_renderer==37.3
1213
seed-isort-config==2.2.0
13-
vulture==2.9.1
14+
vulture==2.9.1

‎dev_requirements/test-requirements.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
mock==4.0.3
22
pytest==7.2.1
33
pytest-cov==4.0.0
4-
pytest-mock==3.6.1
4+
pytest-mock==3.6.1

0 commit comments

Comments
 (0)