ci: add gate, preflight and verification to testing image release by nvasiu · Pull Request #718 · aws/aws-durable-execution-sdk-python

nvasiu · 2026-09-10T23:21:15Z

Issue #, if available:

Related to #716

Description of changes:

The ecr-release.yml action would previously run for every monorepo release, regardless if the release included a new version for the testing package or not. So it was possible for this action to publish the latest changes of the testing package before they were released. This PR updates the action to be safer.

.github/workflows/ecr-release.yml

Add a preflight job to parse the release tag, verify the tag matches the source, check if the version already exists in public ECR, and emit a plan.
Gates the build on the above preflight checks.
Add a post-publish verification that polls public ECR (polls 10 times with 15s wait = 150s total) and confirms that the new version was published.

.github/scripts/parse_testing_version.py

Separate script for parsing the testing version from a release tag.

.github/scripts/tests/test_parse_testing_version.py

Unit testing for the parsing script.

.github/workflows/test-parser.yml

Wire the new script and test into the script-test workflow.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

yaythomas

The preflight and verification confirm that an image tag exists. They do not confirm the image contains what the release names. The Dockerfile installs aws-durable-execution-sdk-python>=1.0.0, resolved at build time and unbounded, so two builds of one testing version can produce different images, and skip-if-exists assumes a version identifies one artifact.

(The other three points are on the relevant lines.)

nvasiu · 2026-09-14T21:05:49Z

@yaythomas
Re: #718 (review)

Yes, the preflight confirms that a tag exists, but it's not guaranteed that the image matches the release. And skip-if-exists assumes a version maps to one image, which is not true while we have an unbounded SDK dependency.

But this workflow's current policy is that if a version is already published to ECR, we won't ever overwrite it. So it shouldn't ever be a concern that the user will get different SDK versions from the same image version.

But for the sake of reproducing the image on the ECR in the future / visiblity into what SDK version the image is using, we could:

Pin the SDK dependency in the Dockerfile.
Or label images with which SDK version they are using (doesn't prevent different images per version, but lets us detect them).

I think either of these option would need some more discussion, and are out of scope for this PR. But if we want to implement either of those, they would be compatible with this PR.

Sign in to view

+    concurrency:
+      group: ecr-release-latest
+      cancel-in-progress: false


Sign in to view

+            echo "::error::Could not list existing tags in public ECR to decide the latest check."
+            exit 1
+          }
+          newest="$(python .github/scripts/is_newest_testing_version.py --candidate "$VERSION" $existing_tags)"


Sign in to view

+      - name: Require the ECR upload role secret
+        env:
+          ECR_UPLOAD_IAM_ROLE_ARN: ${{ secrets.ECR_UPLOAD_IAM_ROLE_ARN }}
+        run: |
+          if [[ -z "$ECR_UPLOAD_IAM_ROLE_ARN" ]]; then
+            echo "::error::Secret ECR_UPLOAD_IAM_ROLE_ARN is not set. Restore it before releasing."
+            exit 1
+          fi


github-actions · 2026-09-18T20:40:39Z

+          if ! existing_tags="$(aws ecr-public describe-images \
+            --region "${{ env.aws_region }}" \
+            --repository-name "$repo_name" \
+            --query 'imageDetails[].imageTags[]' --output text)"; then


Codex AI review · Finding arf_v1_otspk2nucjnfic2v5zdpbwiemx

[P1] This first registry read after pushing v$VERSION is performed only once. A successful but stale response can omit the new tag; the first release then fails, while later releases can repoint latest to an older image. Poll until the just-pushed version is visible, then compute the maximum from that successful snapshot before creating latest.

github-actions · 2026-09-18T20:40:41Z

+            continue
+        if highest is None or version > highest:
+            highest = version
+    return f"v{highest}" if highest is not None else ""


Codex AI review · Finding arf_v1_lyc34vjl7rp77kru74lga6sulz

[P2] Converting Version back to text normalizes the original tag. For the explicitly accepted v2.0.0-beta, this returns v2.0.0b0, so the workflow searches for architecture tags it never published and the release fails. Track and return the original highest tag, and add a -beta regression case.

github-actions · 2026-09-18T20:40:42Z

+          digest_for() {
+            aws ecr-public describe-images \
+              --region "${{ env.aws_region }}" \
+              --repository-name "$repo_name" \
+              --image-ids imageTag="$1" \
+              --query 'imageDetails[0].imageDigest' --output text 2>/dev/null || true


Codex AI review · Finding arf_v1_rrlqy3ac6xtucifop56pikyykn

[P2] digest_for converts every lookup failure into an empty value, and the later equality considers two empty values equal. Concurrent transient failures for latest and the newest version can therefore make verification pass without proving either digest exists. Propagate lookup failures and explicitly reject empty or None digests before comparing them.

github-actions · 2026-09-18T20:40:45Z

Codex AI review

Found three actionable release-path issues, including a race that can leave latest stale during normal registry propagation. The new tests do not cover these workflow-level failure modes.

Reviewed commit edaee67dd29442aca338074a3b3a7b6632e1d959. Workflow run

ci: gate testing image publish on testing release

a7ee0a9

nvasiu deployed to ai-pr-review-runtime September 10, 2026 23:21 — with GitHub Actions Active

nvasiu deployed to ai-pr-review-runtime September 10, 2026 23:29 — with GitHub Actions Active

github-actions Bot reviewed Sep 10, 2026

View reviewed changes