kn: merge to main

.brazil-1.x.json

@@ -0,0 +1,28 @@
+{
+  "dependencies": {
+    "org.jetbrains.kotlin:kotlin-gradle-plugin:2.*": "KotlinGradlePlugin-2.x",
+    "org.jetbrains.kotlin:kotlin-stdlib-common:2.*.*": "KotlinStdlibCommon-2.x",
+    "org.jetbrains.kotlin:kotlin-stdlib-jdk8:2.*.*": "KotlinStdlibJdk8-2.x",
+    "org.jetbrains.kotlin:kotlin-stdlib:2.*.*": "KotlinStdlib-2.x",
+    "org.jetbrains.kotlinx:atomicfu:0.*.*": "Atomicfu-0.x",
+    "org.jetbrains.kotlinx:kotlinx-coroutines-core-jvm:1.*": "KotlinxCoroutinesCoreJvm-1.x",
+    "org.jetbrains.kotlinx:kotlinx-coroutines-jdk8:1.*": "KotlinxCoroutinesJdk8-1.x",
+    "com.google.devtools.ksp:symbol-processing-api:2.*": "Maven-com-google-devtools-ksp_symbol-processing-api-2.x",
+    "com.google.devtools.ksp:symbol-processing-gradle-plugin:2.*": "Maven-com-google-devtools-ksp_symbol-processing-gradle-plugin-2.x"
+  },
+  "packageHandlingRules": {
+    "versioning": {
+      "defaultVersionLayout": "{MAJOR}.x"
+    },
+    "ignore": [
+      "aws.sdk.kotlin:bom",
+      "aws.sdk.kotlin:testing",
+      "aws.sdk.kotlin:version-catalog"
+    ],
+    "resolvesConflictDependencies": {
+      "org.jetbrains.kotlinx:kotlinx-coroutines-core-jvm:1.*" : ["KotlinxCoroutinesCoreJvm-1.x"],
+      "org.jetbrains.kotlinx:kotlinx-coroutines-jdk8:1.*": ["KotlinxCoroutinesJdk8-1.x"],
+      "aws.smithy.kotlin:aws-event-stream:1.*": ["KotlinxCoroutinesCoreJvm-1.x"]
+    }
+  }
+}

.brazil.json

@@ -8,7 +8,8 @@
     "org.jetbrains.kotlinx:kotlinx-coroutines-core-jvm:1.*": "KotlinxCoroutinesCoreJvm-1.x",
     "org.jetbrains.kotlinx:kotlinx-coroutines-jdk8:1.*": "KotlinxCoroutinesJdk8-1.x",
     "com.google.devtools.ksp:symbol-processing-api:2.*": "Maven-com-google-devtools-ksp_symbol-processing-api-2.x",
-    "com.google.devtools.ksp:symbol-processing-gradle-plugin:2.*": "Maven-com-google-devtools-ksp_symbol-processing-gradle-plugin-2.x"
+    "com.google.devtools.ksp:symbol-processing-gradle-plugin:2.*": "Maven-com-google-devtools-ksp_symbol-processing-gradle-plugin-2.x",
+    "com.google.devtools.ksp:com.google.devtools.ksp.gradle.plugin:2.*": "Maven-com-google-devtools-ksp_com_google_devtools_ksp_gradle_plugin-2.x"
   },
   "packageHandlingRules": {
     "versioning": {

.github/actions/setup-build/action.yml

@@ -13,12 +13,22 @@ runs:
         ref: '0.4.2'
         sparse-checkout: |
           .github
+
     - name: Checkout smithy-kotlin
       uses: ./aws-kotlin-repo-tools/.github/actions/checkout-head
       with:
         # checkout smithy-kotlin as a sibling which will automatically make it an included build
         path: 'smithy-kotlin'
         repository: 'smithy-lang/smithy-kotlin'
+
+    # FIXME Remove this checkout of aws-crt-kotlin once K/N artifacts are published to Maven
+    - name: Checkout aws-crt-kotlin
+      uses: ./aws-kotlin-repo-tools/.github/actions/checkout-head
+      with:
+        # checkout aws-crt-kotlin as a sibling which will automatically make it an included build (transitively, through smithy-kotlin)
+        path: 'aws-crt-kotlin'
+        repository: 'awslabs/aws-crt-kotlin'
+
     - name: Configure JDK
       uses: actions/setup-java@v3
       with:

.github/scripts/run-codebuild-batch-job.sh

@@ -94,7 +94,8 @@ START_RESULT=$(
   aws codebuild start-build-batch \
     --project-name ${PROJECT_NAME} \
     --source-version $SOURCE_VERSION \
-    --environment-variables-override file:///tmp/gh_env_vars.json
+    --environment-variables-override file:///tmp/gh_env_vars.json \
+    --source-location-override "https://github.com/awslabs/$GITHUB_REPOSITORY_NO_ORG.git"
 )
 
 if [ "$?" != "0" ]; then

.github/workflows/api-compat-verification.yml

@@ -7,6 +7,8 @@ on:
       - main
       - '*-main'
 
+permissions: { }
+
 jobs:
   api-compat-verification:
     runs-on: ubuntu-latest

.github/workflows/changelog-verification.yml

@@ -1,5 +1,8 @@
 name: Changelog verification
 
+permissions:
+  id-token: write
+
 on:
   pull_request:
     types: [ opened, synchronize, reopened, labeled, unlabeled ]
@@ -11,16 +14,11 @@ jobs:
   changelog-verification:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - name: Check for changelog entry
-        if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-changelog') }}
-        run: |
-          git fetch origin ${{ github.base_ref }} --depth 1 && \
-          git diff remotes/origin/${{ github.base_ref }} --name-only | grep -P "\.changes/[0-9a-f-]+\.json"
-      - name: Error message
-        if: ${{ failure() }}
-        run: |
-          echo "::error ::No new/updated changelog entry found in /.changes directory. Please either:"
-          echo "::error ::* Add a changelog entry (see CONTRIBUTING.md for instructions) –or–"
-          echo "::error ::* Add the 'no-changelog' label to this PR (in rare cases not warranting a changelog entry)"
-          exit 1
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.CI_AWS_ROLE_ARN }}
+          aws-region: us-west-2
+
+      - name: Verify changelog
+        uses: awslabs/aws-kotlin-repo-tools/.github/actions/changelog-verification@main

.github/workflows/closed-issue-message.yaml

@@ -1,7 +1,12 @@
 name: Closed Issue Message
+
 on:
     issues:
        types: [closed]
+
+permissions:
+  issues: write
+
 jobs:
     auto_comment:
         runs-on: ubuntu-latest

.github/workflows/codebuild-ci.yml

@@ -142,56 +142,9 @@ jobs:
           ./gradlew collectDelegatedArtifactSizeMetrics -PpullRequest=$PULL_REQUEST
       - name: Analyze Artifact Size Metrics
         run: ./gradlew analyzeArtifactSizeMetrics
-      - name: Show Results
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const getComments = 
-              `query { 
-                repository(owner:"${context.repo.owner}", name:"${context.repo.repo}"){
-                  pullRequest(number: ${context.issue.number ?? process.env.SDK_PR}) {
-                    id
-                    comments(last:100) {
-                      nodes {
-                        id
-                        body
-                        author {
-                          login
-                        }
-                        isMinimized
-                      }
-                    }
-                  }
-                } 
-              }`
-
-            const response = await github.graphql(getComments)
-            const comments = response.repository.pullRequest.comments.nodes
-
-            const mutations = comments
-              .filter(comment => comment.author.login == 'github-actions' && !comment.isMinimized && comment.body.startsWith('Affected Artifacts'))
-              .map(comment =>
-                github.graphql(
-                  `mutation {
-                    minimizeComment(input:{subjectId:"${comment.id}", classifier:OUTDATED}){
-                      clientMutationId
-                    }
-                  }`
-                )
-              )
-            await Promise.all(mutations)
 
-            const fs = require('node:fs')
-            const comment = fs.readFileSync('build/reports/metrics/artifact-analysis.md', 'utf8')
-
-            const writeComment = 
-              `mutation {
-                addComment(input:{body:"""${comment}""", subjectId:"${response.repository.pullRequest.id}"}){
-                  clientMutationId
-                }
-              }`
-
-            await github.graphql(writeComment)
+      - name: Show Results
+        uses: awslabs/aws-kotlin-repo-tools/.github/actions/artifact-size-metrics/show-results@main
 
       - name: Evaluate Result
         if: ${{ !contains(github.event.pull_request.labels.*.name, 'acknowledge-artifact-size-increase') }}

.github/workflows/continuous-integration.yml

@@ -4,6 +4,8 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions: { }
+
 # Allow one instance of this workflow per pull request, and cancel older runs when new changes are pushed
 concurrency:
   group: ci-pr-${{ github.ref }}
@@ -62,12 +64,23 @@ jobs:
         uses: actions/checkout@v4
         with:
           path: 'aws-sdk-kotlin'
+
       - name: Setup Build
         uses: ./aws-sdk-kotlin/.github/actions/setup-build
+
+      # FIXME Re-enable Kotlin/Native builds when artifacts are available
+      - name: Disable Kotlin/Native builds
+        shell: bash
+        run: |
+          echo -e "\naws.kotlin.native=false" >> ./aws-sdk-kotlin/gradle.properties
+          echo -e "\naws.kotlin.native=false" >> ./smithy-kotlin/gradle.properties
+          echo -e "\naws.kotlin.native=false" >> ./aws-crt-kotlin/gradle.properties
+
       - name: Configure Gradle - smithy-kotlin
         uses: awslabs/aws-kotlin-repo-tools/.github/actions/configure-gradle@main
         with:
           working-directory: ./smithy-kotlin
+
       - name: Build smithy-kotlin
         working-directory: ./smithy-kotlin
         shell: bash
@@ -76,10 +89,12 @@ jobs:
           pwd
           ./gradlew --parallel assemble 
           ./gradlew publishToMavenLocal
+
       - name: Configure Gradle aws-sdk-kotlin
         uses: awslabs/aws-kotlin-repo-tools/.github/actions/configure-gradle@main
         with:
           working-directory: ./aws-sdk-kotlin
+
       - name: Test
         working-directory: ./aws-sdk-kotlin
         shell: bash
@@ -90,6 +105,7 @@ jobs:
           ./gradlew apiCheck
           ./gradlew test jvmTest
           ./gradlew testAllProtocols
+
       - name: Save Test Reports
         if: failure()
         uses: actions/upload-artifact@v4

.github/workflows/issue-regression-labeler.yml

@@ -3,6 +3,7 @@ name: issue-regression-label
 on:
   issues:
     types: [opened, edited]
+permissions: { }
 jobs:
   add-regression-label:
     runs-on: ubuntu-latest

.github/workflows/kat-transform.yml

@@ -52,9 +52,10 @@ jobs:
         run: |
           pwd
           ls -lsa
-          kat bump-version  # Bump from `vNext-SNAPSHOT` to `vNext`. kat transform only works on non-SNAPSHOT versions 
-          ./gradlew build
-          ./gradlew publishAllPublicationsToTestLocalRepository
+          kat bump-version  # Bump from `vNext-SNAPSHOT` to `vNext`. kat transform only works on non-SNAPSHOT versions
+
+          ./gradlew -Paws.kotlin.native=false build
+          ./gradlew -Paws.kotlin.native=false publishAllPublicationsToTestLocalRepository
 
       - name: Transform
         working-directory: ./aws-sdk-kotlin

.github/workflows/lint.yml

@@ -12,6 +12,9 @@ on:
       - '*-main'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 env:
   PACKAGE_NAME: aws-sdk-kotlin
 

.github/workflows/merge-main.yml

@@ -1,14 +1,17 @@
 name: Merge main
 on:
-  schedule:
-    - cron: "0 7 * * 1-5"  # At 07:00 UTC (00:00 PST, 03:00 EST), Monday through Friday
+  push:
+    branches: [ main ]
   workflow_dispatch:
 
+permissions: { }
+
 jobs:
-  test:
+  merge:
     runs-on: ubuntu-latest
     steps:
       - name: Merge main
         uses: awslabs/aws-kotlin-repo-tools/.github/actions/merge-main@main
         with:
-          exempt-branches: # Add any if required
+          ci-user-pat: ${{ secrets.CI_USER_PAT }}
+          exempt-branches: # Add any if required

.github/workflows/release-readiness.yml

@@ -0,0 +1,71 @@
+name: Release readiness (snapshot dependency)
+description: >
+  Makes sure that we aren't relying on SNAPSHOT/dev versions of smithy-kotlin before merging
+  otherwise we could forget because the rest of CI is masking it.
+
+on:
+  pull_request:
+    types: [ opened, synchronize, reopened, labeled, unlabeled ]
+    branches: [ main ]
+
+permissions: { }
+
+jobs:
+  release-readiness:
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'ready-for-release') }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout SDK
+        uses: actions/checkout@v4
+        with:
+          path: 'aws-sdk-kotlin'
+
+      - name: Configure Gradle
+        uses: awslabs/aws-kotlin-repo-tools/.github/actions/configure-gradle@main
+        with:
+          working-directory: ./aws-sdk-kotlin
+
+      - name: Build SDK
+        working-directory: ./aws-sdk-kotlin
+        run: ./gradlew test jvmTest
+
+      - name: Build SDK client
+        working-directory: ./aws-sdk-kotlin
+        run: |
+          ./gradlew -Paws.kotlin.native=false -Paws.services=s3 bootstrap
+          ./gradlew -Paws.kotlin.native=false build
+
+      - name: Checkout smithy-kotlin
+        uses: awslabs/aws-kotlin-repo-tools/.github/actions/checkout-head@main
+        with:
+          path: 'smithy-kotlin'
+          repository: 'smithy-lang/smithy-kotlin'
+
+      - name: Check for smithy-kotlin unreleased changes
+        run: |
+          echo "aws-sdk-kotlin branch: $GITHUB_HEAD_REF"
+
+          cd smithy-kotlin
+          SMITHY_KOTLIN_BRANCH=$(git branch --show-current)
+          echo "smithy-kotlin branch: $SMITHY_KOTLIN_BRANCH"
+
+          if [ "$GITHUB_HEAD_REF" == "$SMITHY_KOTLIN_BRANCH" ]; then
+            cd ../aws-sdk-kotlin
+            git fetch origin
+
+            DIFF=$(git diff origin/main -- gradle/libs.versions.toml | grep '^[-+][^-+]'; exit 0)
+            SMITHY_KOTLIN_VERSION_BUMP=$(echo "$DIFF" | grep "smithy-kotlin-runtime-version =\|smithy-kotlin-codegen-version ="; exit 0)
+
+            if [ -z "$SMITHY_KOTLIN_VERSION_BUMP" ]; then
+              echo "::error::Matching smithy-kotlin and aws-sdk-kotlin branches but no smithy-kotlin version bump"
+              exit 1
+            else
+              echo "Matching smithy-kotlin and aws-sdk-kotlin branches with smithy-kotlin version bump detected"
+            fi
+          fi
+
+      - name: Emit error message
+        if: ${{ failure() }}
+        run: |
+          echo "::error::Did you forget to release smithy-kotlin and bump the dependency version?"
+          exit 1

.github/workflows/stale_issue.yaml

@@ -5,6 +5,9 @@ on:
   schedule:
   - cron: "0 0/3 * * *"
 
+permissions:
+  issues: write
+
 jobs:
   cleanup:
     name: Stale issue job