From 053ad51a13062eecf6f4f4b08a8a3301321357ff Mon Sep 17 00:00:00 2001 From: svozza Date: Tue, 21 Jul 2026 11:41:32 +0200 Subject: [PATCH 1/3] feat(ci): auto-trigger make-release and docs rebuild on PR merge Adds on_release_pr_merge.yml to remove the last two manual triggers in the release pipeline: dispatching make-release.yml after a ci-bump-* version PR merges, and rebuild_latest_docs.yml after a ci-layer-docs-* ARN-doc PR merges. --- .github/workflows/on_release_pr_merge.yml | 80 +++++++++++++++++++++++ 1 file changed, 80 insertions(+) create mode 100644 .github/workflows/on_release_pr_merge.yml diff --git a/.github/workflows/on_release_pr_merge.yml b/.github/workflows/on_release_pr_merge.yml new file mode 100644 index 0000000000..fe81a4eb16 --- /dev/null +++ b/.github/workflows/on_release_pr_merge.yml @@ -0,0 +1,80 @@ +name: Auto-trigger release pipeline on PR merge + +# PROCESS +# +# Two manual triggers remain in an otherwise-automated release pipeline: +# 1. After `make-version.yml`'s version-bump PR (branch `ci-bump-`) is merged, +# a maintainer has to manually trigger `make-release.yml`. +# 2. After `publish_layer.yml`'s ARN-doc PR (branch `ci-layer-docs-`) is merged, +# a maintainer has to manually trigger `rebuild_latest_docs.yml` with the released version. +# +# This workflow watches for those two PRs merging to `main` and dispatches the next +# workflow automatically, so the only human actions left are the ones that require +# actual review: approving the version PR, approving npm publish, and approving the +# final ARN-doc PR. +# +# SECURITY NOTE +# +# Deliberately uses `pull_request` (not `pull_request_target`), so PRs from forks keep +# GitHub's default read-only token and no secrets - a forked PR could never reach the +# `gh workflow run` step even if every other condition below matched. +# +# `github.event.pull_request.user.login` is set by GitHub from the identity that actually +# called the API to open the PR - it isn't spoofable via branch name, PR title, or body. +# Both `ci-bump-*` and `ci-layer-docs-*` PRs are opened by aws-powertools/actions' +# `create-pr` action using the default `GITHUB_TOKEN`, so `.user.login` is always +# `github-actions[bot]` (confirmed against real PR history - this is NOT the same as +# `aws-powertools-bot`, which is only the git commit-author identity `create-pr` sets +# locally via `git config`, not what GitHub exposes as the PR's author). +# +# Combined with `head.repo.full_name == github.repository` (rejects forks explicitly) +# and `base.ref == 'main'`, only genuine automation-opened, same-repo, main-targeted +# PRs can reach the dispatch step. + +on: + pull_request: + types: [closed] + +permissions: {} + +jobs: + trigger-make-release: + if: > + github.event.pull_request.merged == true && + github.event.pull_request.base.ref == 'main' && + github.event.pull_request.head.repo.full_name == github.repository && + github.event.pull_request.user.login == 'github-actions[bot]' && + startsWith(github.event.pull_request.head.ref, 'ci-bump-') + runs-on: ubuntu-latest + permissions: + actions: write + steps: + - name: Dispatch Make Release + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: gh workflow run make-release.yml --repo ${{ github.repository }} --ref main + + trigger-rebuild-docs: + if: > + github.event.pull_request.merged == true && + github.event.pull_request.base.ref == 'main' && + github.event.pull_request.head.repo.full_name == github.repository && + github.event.pull_request.user.login == 'github-actions[bot]' && + startsWith(github.event.pull_request.head.ref, 'ci-layer-docs-') + runs-on: ubuntu-latest + permissions: + contents: read + actions: write + steps: + - name: Checkout main + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + ref: main + - name: Resolve latest published version + id: version + run: echo "version=$(cat packages/commons/package.json | jq .version -r)" >> "$GITHUB_OUTPUT" + - name: Dispatch Rebuild latest docs + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + VERSION: ${{ steps.version.outputs.version }} + run: gh workflow run rebuild_latest_docs.yml --repo ${{ github.repository }} --ref main --field latest_published_version="$VERSION" From ee88c3dc6f22459a938ac7a22e5c64515f0b5bb4 Mon Sep 17 00:00:00 2001 From: svozza Date: Tue, 21 Jul 2026 11:44:21 +0200 Subject: [PATCH 2/3] docs(maintainers): reflect auto-triggered release steps Updates the release checklist to describe Make Release and Rebuild latest docs as automatically triggered by PR merge, since manual dispatch is no longer needed. --- docs/maintainers.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/docs/maintainers.md b/docs/maintainers.md index 3d4fcfd90d..5232b23afa 100644 --- a/docs/maintainers.md +++ b/docs/maintainers.md @@ -228,16 +228,16 @@ Releasing a new version is a multi-step process that requires up to 3 hours to c 1. **End to end tests**: Run the [e2e tests](#run-end-to-end-tests) and ensure they pass. 2. **Version bump**: Run the `Make Version` workflow to bump the version. This will create a PR with the new version and -a changelog. Visually inspect the diff and make sure the changelog and version are correct, then merge the PR. -3. **Make Release**: Run the `Make Release` workflow. This will: 1/ run the unit tests again, 2/ build and publish to npmjs.com, +a changelog. Visually inspect the diff and make sure the changelog and version are correct, then merge the PR. Merging +this PR automatically triggers the `Make Release` workflow. +3. **Make Release**: The `Make Release` workflow will: 1/ run the unit tests again, 2/ build and publish to npmjs.com, 3/ build and deploy the Lambda layers to the `Beta` and `Prod` environments in all commercial Regions, 4/ run canary tests, 5/ deploy the Lambda layers to the `GovCloud` and `China` partitions (Gamma then Prod, both in parallel) once the -commercial Prod deployment finishes, 6/ update the documentation with the new version once all three (commercial, -GovCloud, China) Prod deployments are complete. +commercial Prod deployment finishes, 6/ open a PR to update the documentation with the new layer ARNs once all three +(commercial, GovCloud, China) Prod deployments are complete. 4. **Review and merge docs PR**: Once the `Make Release` workflow is complete, a PR will be created to update the -documentation with the new version. Review and merge this PR. -5. **Update Docs**: Run the `Rebuild latest docs` workflow with the `main` branch using the package version from -npm (i.e. `2.20.0`). This will update the documentation with the new version. +documentation with the new version. Review and merge this PR. Merging this PR automatically triggers the +`Rebuild latest docs` workflow, which updates the documentation with the new version. Once complete, you can start drafting the release notes to let customers know **what changed and what's in it for them (a.k.a why they should care)**. We have guidelines in the release notes section so you know what good looks like. From 5ec72cc92d682b70b3c6c20f048162a0477a31dc Mon Sep 17 00:00:00 2001 From: svozza Date: Thu, 23 Jul 2026 14:02:36 +0300 Subject: [PATCH 3/3] refactor(ci): split release-trigger workflow, rewrite header comment Addresses review feedback: separates the ci-bump and ci-layer-docs triggers into their own workflow files, and rewrites the header comment to describe the workflow's purpose going forward rather than the manual process it replaces. --- ...r_merge.yml => on_layer_docs_pr_merge.yml} | 42 ++++------------ .../workflows/on_version_bump_pr_merge.yml | 49 +++++++++++++++++++ 2 files changed, 59 insertions(+), 32 deletions(-) rename .github/workflows/{on_release_pr_merge.yml => on_layer_docs_pr_merge.yml} (50%) create mode 100644 .github/workflows/on_version_bump_pr_merge.yml diff --git a/.github/workflows/on_release_pr_merge.yml b/.github/workflows/on_layer_docs_pr_merge.yml similarity index 50% rename from .github/workflows/on_release_pr_merge.yml rename to .github/workflows/on_layer_docs_pr_merge.yml index fe81a4eb16..43c753625a 100644 --- a/.github/workflows/on_release_pr_merge.yml +++ b/.github/workflows/on_layer_docs_pr_merge.yml @@ -1,17 +1,11 @@ -name: Auto-trigger release pipeline on PR merge +name: Auto-trigger docs rebuild on layer ARN docs PR merge # PROCESS # -# Two manual triggers remain in an otherwise-automated release pipeline: -# 1. After `make-version.yml`'s version-bump PR (branch `ci-bump-`) is merged, -# a maintainer has to manually trigger `make-release.yml`. -# 2. After `publish_layer.yml`'s ARN-doc PR (branch `ci-layer-docs-`) is merged, -# a maintainer has to manually trigger `rebuild_latest_docs.yml` with the released version. -# -# This workflow watches for those two PRs merging to `main` and dispatches the next -# workflow automatically, so the only human actions left are the ones that require -# actual review: approving the version PR, approving npm publish, and approving the -# final ARN-doc PR. +# This workflow watches for `publish_layer.yml`'s `update_layer_arn_docs` job PR (branch +# `ci-layer-docs-`) merging to `main` so it can dispatch `rebuild_latest_docs.yml` +# automatically, leaving only the human action that requires actual review: approving the +# ARN-doc PR. # # SECURITY NOTE # @@ -21,11 +15,11 @@ name: Auto-trigger release pipeline on PR merge # # `github.event.pull_request.user.login` is set by GitHub from the identity that actually # called the API to open the PR - it isn't spoofable via branch name, PR title, or body. -# Both `ci-bump-*` and `ci-layer-docs-*` PRs are opened by aws-powertools/actions' -# `create-pr` action using the default `GITHUB_TOKEN`, so `.user.login` is always -# `github-actions[bot]` (confirmed against real PR history - this is NOT the same as -# `aws-powertools-bot`, which is only the git commit-author identity `create-pr` sets -# locally via `git config`, not what GitHub exposes as the PR's author). +# `ci-layer-docs-*` PRs are opened by aws-powertools/actions' `create-pr` action using the +# default `GITHUB_TOKEN`, so `.user.login` is always `github-actions[bot]` (confirmed +# against real PR history - this is NOT the same as `aws-powertools-bot`, which is only +# the git commit-author identity `create-pr` sets locally via `git config`, not what +# GitHub exposes as the PR's author). # # Combined with `head.repo.full_name == github.repository` (rejects forks explicitly) # and `base.ref == 'main'`, only genuine automation-opened, same-repo, main-targeted @@ -38,22 +32,6 @@ on: permissions: {} jobs: - trigger-make-release: - if: > - github.event.pull_request.merged == true && - github.event.pull_request.base.ref == 'main' && - github.event.pull_request.head.repo.full_name == github.repository && - github.event.pull_request.user.login == 'github-actions[bot]' && - startsWith(github.event.pull_request.head.ref, 'ci-bump-') - runs-on: ubuntu-latest - permissions: - actions: write - steps: - - name: Dispatch Make Release - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: gh workflow run make-release.yml --repo ${{ github.repository }} --ref main - trigger-rebuild-docs: if: > github.event.pull_request.merged == true && diff --git a/.github/workflows/on_version_bump_pr_merge.yml b/.github/workflows/on_version_bump_pr_merge.yml new file mode 100644 index 0000000000..561f86cdca --- /dev/null +++ b/.github/workflows/on_version_bump_pr_merge.yml @@ -0,0 +1,49 @@ +name: Auto-trigger Make Release on version bump PR merge + +# PROCESS +# +# This workflow watches for `make-version.yml`'s version-bump PR (branch `ci-bump-`) +# merging to `main` so it can dispatch `make-release.yml` automatically, leaving only the +# human actions that require actual review: approving the version PR and approving npm +# publish. +# +# SECURITY NOTE +# +# Deliberately uses `pull_request` (not `pull_request_target`), so PRs from forks keep +# GitHub's default read-only token and no secrets - a forked PR could never reach the +# `gh workflow run` step even if every other condition below matched. +# +# `github.event.pull_request.user.login` is set by GitHub from the identity that actually +# called the API to open the PR - it isn't spoofable via branch name, PR title, or body. +# `ci-bump-*` PRs are opened by aws-powertools/actions' `create-pr` action using the +# default `GITHUB_TOKEN`, so `.user.login` is always `github-actions[bot]` (confirmed +# against real PR history - this is NOT the same as `aws-powertools-bot`, which is only +# the git commit-author identity `create-pr` sets locally via `git config`, not what +# GitHub exposes as the PR's author). +# +# Combined with `head.repo.full_name == github.repository` (rejects forks explicitly) +# and `base.ref == 'main'`, only genuine automation-opened, same-repo, main-targeted +# PRs can reach the dispatch step. + +on: + pull_request: + types: [closed] + +permissions: {} + +jobs: + trigger-make-release: + if: > + github.event.pull_request.merged == true && + github.event.pull_request.base.ref == 'main' && + github.event.pull_request.head.repo.full_name == github.repository && + github.event.pull_request.user.login == 'github-actions[bot]' && + startsWith(github.event.pull_request.head.ref, 'ci-bump-') + runs-on: ubuntu-latest + permissions: + actions: write + steps: + - name: Dispatch Make Release + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: gh workflow run make-release.yml --repo ${{ github.repository }} --ref main