Merge upstream master to resolve mergeable_state=dirty on PR #2530

.github/dependabot.yml

@@ -3,12 +3,13 @@ updates:
 
   - package-ecosystem: "github-actions"
     directory: "/"
+    cooldown:
+      default-days: 7
     schedule:
       # Check for updates to GitHub Actions every quarter
       interval: "quarterly"
     labels:
       - "Release Not Needed"
-    target-branch: "dev"
     # Group all github-actions updates into a single PR
     groups:
       all-github-actions:

.github/workflows/auto-update-Dockerfiles.yml

@@ -34,7 +34,7 @@ jobs:
       # Checks-out the repository under $GITHUB_WORKSPACE
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
-          ref: 'dev'
+          ref: 'master'
 
       # Update .NET 8 AMD64 Dockerfile
       - name: Update .NET 8 AMD64
@@ -205,7 +205,7 @@ jobs:
         uses: repo-sync/pull-request@7e79a9f5dc3ad0ce53138f01df2fad14a04831c5 # v2
         with:
           source_branch: ${{ steps.commit-push.outputs.BRANCH }}
-          destination_branch: "dev"
+          destination_branch: "master"
           pr_title: 'chore: Daily ASP.NET Core version update in Dockerfiles'
           pr_body: "This PR automatically updates the Dockerfiles to use the latest ASP.NET Core version.
 

.github/workflows/aws-ci.yml

@@ -5,7 +5,6 @@ on:
   pull_request:
     branches:
       - master
-      - dev
       - "feature/**"
 
 permissions: {}

.github/workflows/conformance-tests.yml

@@ -0,0 +1,145 @@
+name: Durable Execution Conformance Tests
+
+# Full-integration conformance run for the .NET Durable Execution SDK: publishes
+# the .NET handlers, installs the language-agnostic runner from the
+# aws-durable-execution-conformance-tests repo, then deploys + invokes +
+# validates one SAM stack per suite. Suites are discovered from the
+# template_<suite>.yaml files under the Conformance directory (see
+# scripts/discover_suites.py) and each runs as its own parallel matrix job, so
+# adding a suite only requires shipping its template + handlers.
+
+on:
+  pull_request:
+    branches: [master]
+    paths:
+      - "Libraries/src/Amazon.Lambda.DurableExecution/**"
+      - "Libraries/test/Amazon.Lambda.DurableExecution.IntegrationTests/Conformance/**"
+      - ".github/workflows/conformance-tests.yml"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.head_ref || github.ref_name || github.run_id }}-conformance
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  id-token: write # Required for AWS OIDC credentials
+
+env:
+  CONFORMANCE_DIR: Libraries/test/Amazon.Lambda.DurableExecution.IntegrationTests/Conformance
+  RUNNER_PIP_SPEC: "git+https://github.com/aws/aws-durable-execution-conformance-tests.git@main#subdirectory=packages/aws-durable-execution-conformance-tests"
+
+jobs:
+  discover_suites:
+    name: discover conformance suites
+    runs-on: ubuntu-latest
+    outputs:
+      suites: ${{ steps.discover.outputs.suites }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Discover suites from templates
+        id: discover
+        working-directory: ${{ env.CONFORMANCE_DIR }}
+        run: echo "suites=$(python3 scripts/discover_suites.py)" >> "$GITHUB_OUTPUT"
+
+  conformance:
+    name: conformance (${{ matrix.suite }})
+    needs: discover_suites
+    runs-on: ubuntu-latest
+    # Global lock per suite stack: runs from different branches/PRs share the
+    # persistent conformance-dotnet-<suite> stacks, so deploys to the same stack
+    # must never overlap. Queued (not cancelled) so every run still executes.
+    concurrency:
+      group: conformance-stack-${{ matrix.suite }}
+      cancel-in-progress: false
+    strategy:
+      fail-fast: false
+      matrix:
+        suite: ${{ fromJSON(needs.discover_suites.outputs.suites) }}
+    defaults:
+      run:
+        working-directory: Libraries/test/Amazon.Lambda.DurableExecution.IntegrationTests/Conformance
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
+        with:
+          dotnet-version: "8.0.x"
+
+      - name: Setup Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.14"
+
+      - name: Setup SAM CLI
+        uses: aws-actions/setup-sam@f84ec7d548307efafe33230528756de3c5841a17 # v2
+        with:
+          use-installer: true
+
+      - name: Publish conformance handlers
+        run: ./scripts/build_examples.sh ${{ matrix.suite }}
+
+      - name: Install conformance runner
+        run: pip install "${RUNNER_PIP_SPEC}"
+
+      - name: Get AWS Credentials
+        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
+        with:
+          # SAM-capable deploy role (CloudFormation / S3 / IAM / Lambda / DynamoDB).
+          role-to-assume: ${{ secrets.CONFORMANCE_DEPLOY_ROLE_ARN }}
+          role-session-name: githubConformanceTest
+          aws-region: ${{ vars.CONFORMANCE_AWS_REGION || 'us-west-2' }}
+
+      - name: Inject Lambda execution role into template
+        env:
+          ROLE_ARN: ${{ secrets.CONFORMANCE_LAMBDA_EXECUTION_ROLE_ARN }}
+        run: |
+          if [ -z "$ROLE_ARN" ]; then
+            echo "CONFORMANCE_LAMBDA_EXECUTION_ROLE_ARN not set; template will create its own role."
+            exit 0
+          fi
+          # Point every function at the pre-existing execution role and drop the
+          # self-created DurableFunctionRole. Mutates only the CI checkout; the
+          # checked-in template stays self-contained for local runs.
+          python3 scripts/inject_execution_role.py \
+            --template template_${{ matrix.suite }}.yaml \
+            --role-arn "$ROLE_ARN"
+
+      - name: Compute stack-safe suite slug
+        run: |
+          # CloudFormation stack names allow only [a-zA-Z][-a-zA-Z0-9]*;
+          # suite names like wait_for_condition contain underscores.
+          echo "SUITE_SLUG=$(echo '${{ matrix.suite }}' | tr '_' '-')" >> "$GITHUB_ENV"
+
+      - name: Run conformance suite
+        # --fail-on failed+uncovered: the runner (and its test-requirements) are
+        # pinned to @main, so when upstream adds a new requirement to a suite it
+        # is pulled automatically. Without this, a new requirement with no .NET
+        # handler reports UNCOVERED and the run stays green — silently missing
+        # coverage. failed+uncovered turns that red so we notice and either add a
+        # handler or declare it under TestingMetadata.NotImplemented. Declared
+        # gaps report NOT_IMPLEMENTED, which never blocks.
+        run: |
+          python -m aws_durable_execution_conformance_tests.app \
+            --template template_${{ matrix.suite }}.yaml \
+            --language dotnet \
+            --suite ${{ matrix.suite }} \
+            --name conformance-dotnet-${SUITE_SLUG} \
+            --region ${{ vars.CONFORMANCE_AWS_REGION || 'us-west-2' }} \
+            --history-dir history-${{ matrix.suite }} \
+            --report junit \
+            --report-file report-${{ matrix.suite }} \
+            --fail-on failed+uncovered \
+            --no-cleanup
+
+      - name: Upload conformance report
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: conformance-report-${{ matrix.suite }}
+          path: |
+            ${{ env.CONFORMANCE_DIR }}/report-${{ matrix.suite }}.xml
+            ${{ env.CONFORMANCE_DIR }}/history-${{ matrix.suite }}/
+          if-no-files-found: warn