Merge branch 'main' into RFC30/tests

Author: thomas-k-cameron

.cargo/config.toml

@@ -1,7 +1,3 @@
 [build]
 # Share one `target` directory at the project root for all Cargo projects and workspaces in smithy-rs
 target-dir = "target"
-
-# TODO(https://github.com/awslabs/smithy-rs/issues/2766): The sparse registry config can be removed when upgrading to Rust 1.70
-[registries.crates-io]
-protocol = "sparse"

.github/scripts/get-or-create-release-branch.sh

@@ -14,15 +14,15 @@ set -eux
 # is the beginning of a new release series.
 
 if [ -z "$SEMANTIC_VERSION" ]; then
-    echo "'SEMANTIC_VERSION' must be populated."
-    exit 1
+  echo "'SEMANTIC_VERSION' must be populated."
+  exit 1
 fi
 
 if [ -z "$1" ]; then
-    echo "You need to specify the path of the file where you want to collect the output"
-    exit 1
+  echo "You need to specify the path of the file where you want to collect the output"
+  exit 1
 else
-    output_file="$1"
+  output_file="$1"
 fi
 
 # Split on the dots
@@ -31,41 +31,50 @@ major=${version_array[0]}
 minor=${version_array[1]}
 patch=${version_array[2]}
 if [[ "${major}" == "" || "${minor}" == "" || "${patch}" == "" ]]; then
-    echo "'${SEMANTIC_VERSION}' is not a valid semver tag"
-    exit 1
+  echo "'${SEMANTIC_VERSION}' is not a valid semver tag"
+  exit 1
 fi
 if [[ $major == 0 ]]; then
-    branch_name="smithy-rs-release-${major}.${minor}.x"
-    if [[ $patch == 0 ]]; then
-        echo "new_release_series=true" >"${output_file}"
-    fi
+  branch_name="smithy-rs-release-${major}.${minor}.x"
+  if [[ $patch == 0 ]]; then
+    echo "new_release_series=true" >"${output_file}"
+  fi
 else
-    branch_name="smithy-rs-release-${major}.x.y"
-    if [[ $minor == 0 && $patch == 0 ]]; then
-        echo "new_release_series=true" >"${output_file}"
-    fi
+  branch_name="smithy-rs-release-${major}.x.y"
+  if [[ $minor == 0 && $patch == 0 ]]; then
+    echo "new_release_series=true" >"${output_file}"
+  fi
 fi
 
 if [[ "${DRY_RUN}" == "true" ]]; then
-    branch_name="${branch_name}-preview"
+  branch_name="${branch_name}-preview"
 fi
 echo "release_branch=${branch_name}" >"${output_file}"
 
-if [[ "${DRY_RUN}" == "true" ]]; then
-    git push --force origin "HEAD:refs/heads/${branch_name}"
-else
-    commit_sha=$(git rev-parse --short HEAD)
-    if ! git ls-remote --exit-code --heads origin "${branch_name}"; then
-        # The release branch does not exist.
-        # We need to make sure that the commit SHA that we are releasing is on `main`.
-        git fetch origin main
-        if git branch --contains "${commit_sha}" | grep main; then
-            # We can then create the release branch and set the current commit as its tip
-            git checkout -b "${branch_name}"
-            git push origin "${branch_name}"
-        else
-            echo "You must choose a commit from main to create a new release branch!"
-            exit 1
-        fi
+commit_sha=$(git rev-parse --short HEAD)
+# the git repo is in a weird state because **main has never been checked out**!
+# This prevents the `git branch --contains` from working because there is no _local_ ref for main
+git checkout main
+git checkout "${commit_sha}"
+if ! git ls-remote --exit-code --heads origin "${branch_name}"; then
+  # The release branch does not exist.
+  # We need to make sure that the commit SHA that we are releasing is on `main`.
+  git fetch origin main
+  echo "Branches: "
+  git branch --contains "${commit_sha}"
+  git show origin/main | head -n 1
+  if git branch --contains "${commit_sha}" | grep main; then
+    # We can then create the release branch and set the current commit as its tip
+    if [[ "${DRY_RUN}" == "true" ]]; then
+      git push --force origin "HEAD:refs/heads/${branch_name}"
+    else
+      git checkout -b "${branch_name}"
+      git push origin "${branch_name}"
     fi
+  else
+    echo "You must choose a commit from main to create a new release branch!"
+    exit 1
+  fi
+else
+  echo "Patch release ${branch_name} already exists"
 fi

.github/workflows/ci-merge-queue.yml

@@ -84,7 +84,7 @@ jobs:
     needs:
     - save-docker-login-token
     - acquire-base-image
-    if: ${{ github.event.pull_request.head.repo.full_name == 'awslabs/smithy-rs' || toJSON(github.event.merge_group) != '{}' }}
+    if: ${{ github.event.pull_request.head.repo.full_name == 'smithy-lang/smithy-rs' || toJSON(github.event.merge_group) != '{}' }}
     uses: ./.github/workflows/ci.yml
     with:
       run_sdk_examples: true

.github/workflows/ci-pr-forks.yml

@@ -18,7 +18,7 @@ jobs:
   # it uploads the image as a build artifact for other jobs to download and use.
   acquire-base-image:
     name: Acquire Base Image
-    if: ${{ github.event.pull_request.head.repo.full_name != 'awslabs/smithy-rs' }}
+    if: ${{ github.event.pull_request.head.repo.full_name != 'smithy-lang/smithy-rs' }}
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v3
@@ -39,7 +39,7 @@ jobs:
   # Run shared CI after the Docker build image has either been rebuilt or found in ECR
   ci:
     needs: acquire-base-image
-    if: ${{ github.event.pull_request.head.repo.full_name != 'awslabs/smithy-rs' }}
+    if: ${{ github.event.pull_request.head.repo.full_name != 'smithy-lang/smithy-rs' }}
     uses: ./.github/workflows/ci.yml
     with:
       run_sdk_examples: true

.github/workflows/ci-pr.yml

@@ -21,7 +21,7 @@ jobs:
   # The login password is encrypted with the repo secret DOCKER_LOGIN_TOKEN_PASSPHRASE
   save-docker-login-token:
     name: Save a docker login token
-    if: ${{ github.event.pull_request.head.repo.full_name == 'awslabs/smithy-rs' }}
+    if: ${{ github.event.pull_request.head.repo.full_name == 'smithy-lang/smithy-rs' }}
     outputs:
       docker-login-password: ${{ steps.set-token.outputs.docker-login-password }}
     permissions:
@@ -51,8 +51,8 @@ jobs:
   acquire-base-image:
     name: Acquire Base Image
     needs: save-docker-login-token
-    if: ${{ github.event.pull_request.head.repo.full_name == 'awslabs/smithy-rs' }}
-    runs-on: ubuntu-latest
+    if: ${{ github.event.pull_request.head.repo.full_name == 'smithy-lang/smithy-rs' }}
+    runs-on: smithy_ubuntu-latest_8-core
     env:
       ENCRYPTED_DOCKER_PASSWORD: ${{ needs.save-docker-login-token.outputs.docker-login-password }}
       DOCKER_LOGIN_TOKEN_PASSPHRASE: ${{ secrets.DOCKER_LOGIN_TOKEN_PASSPHRASE }}
@@ -86,7 +86,7 @@ jobs:
     needs:
     - save-docker-login-token
     - acquire-base-image
-    if: ${{ github.event.pull_request.head.repo.full_name == 'awslabs/smithy-rs' }}
+    if: ${{ github.event.pull_request.head.repo.full_name == 'smithy-lang/smithy-rs' }}
     uses: ./.github/workflows/ci.yml
     with:
       run_sdk_examples: true
@@ -97,7 +97,7 @@ jobs:
   # The PR bot requires a Docker build image, so make it depend on the `acquire-base-image` job.
   pr_bot:
     name: PR Bot
-    if: ${{ github.event.pull_request.head.repo.full_name == 'awslabs/smithy-rs' }}
+    if: ${{ github.event.pull_request.head.repo.full_name == 'smithy-lang/smithy-rs' }}
     needs: acquire-base-image
     uses: ./.github/workflows/pull-request-bot.yml
     with:
@@ -114,6 +114,12 @@ jobs:
     needs:
     - save-docker-login-token
     - acquire-base-image
+    # We need `always` here otherwise this job won't run if the previous job has been skipped
+    # See https://samanpavel.medium.com/github-actions-conditional-job-execution-e6aa363d2867
+    if: |
+      always() &&
+      !contains(needs.*.result, 'failure') &&
+      !contains(needs.*.result, 'cancelled')
     steps:
     - uses: actions/checkout@v3
       with:

.github/workflows/ci-tls.yml

@@ -0,0 +1,81 @@
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+# This workflow tests the TLS configuration of the smithy-rs client
+# To run on an Ubuntu machine, run each step in this order.
+# Each script can be run on your Ubuntu host.
+# You will have to install Docker and rustc/cargo manually.
+
+env:
+  rust_version: 1.68.2
+
+name: Verify client TLS configuration
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  verify-tls-config:
+    name: Verify TLS configuration
+    runs-on: ubuntu-latest
+    steps:
+    - name: Install packages
+      shell: bash
+      run: |
+        sudo apt-get update
+        sudo apt-get -y install gcc make python3-pip nginx git ruby openjdk-17-jre pkg-config libssl-dev faketime
+        pip3 install certbuilder crlbuilder
+    - name: Stop nginx
+      run: sudo systemctl stop nginx
+    - name: Checkout smithy-rs
+      uses: actions/checkout@v3
+      with:
+        path: ./smithy-rs
+    - name: Checkout trytls
+      uses: actions/checkout@v3
+      with:
+        repository: ouspg/trytls
+        path: ./trytls
+    - name: Checkout badtls
+      uses: actions/checkout@v3
+      with:
+        repository: wbond/badtls.io
+        path: ./badtls.io
+    - name: Checkout badssl
+      uses: actions/checkout@v3
+      with:
+        repository: chromium/badssl.com
+        path: ./badssl.com
+    - name: Install Rust
+      uses: dtolnay/rust-toolchain@master
+      with:
+        toolchain: ${{ env.rust_version }}
+    - name: Build badssl.com
+      shell: bash
+      working-directory: badssl.com
+      env:
+        DOCKER_BUILDKIT: 1
+      run: ../smithy-rs/tools/ci-scripts/configure-tls/configure-badssl
+    - name: Build SDK
+      working-directory: smithy-rs
+      run: ./gradlew :aws:sdk:assemble -Paws.services=+sts,+sso,+ssooidc
+    - name: Build trytls
+      shell: bash
+      working-directory: trytls
+      run: ../smithy-rs/tools/ci-scripts/configure-tls/configure-trytls
+    - name: Build badtls.io
+      working-directory: badtls.io
+      shell: bash
+      run: ../smithy-rs/tools/ci-scripts/configure-tls/configure-badtls
+    - name: Update TLS configuration
+      shell: bash
+      run: smithy-rs/tools/ci-scripts/configure-tls/update-certs
+    - name: Build TLS stub
+      working-directory: smithy-rs/tools/ci-resources/tls-stub
+      shell: bash
+      run: cargo build
+    - name: Test TLS configuration
+      working-directory: smithy-rs/tools
+      shell: bash
+      run: trytls https target/debug/stub

.github/workflows/ci.yml

@@ -29,7 +29,7 @@ on:
         required: false
 
 env:
-  rust_version: 1.68.2
+  rust_version: 1.70.0
   rust_toolchain_components: clippy,rustfmt
   ENCRYPTED_DOCKER_PASSWORD: ${{ secrets.ENCRYPTED_DOCKER_PASSWORD }}
   DOCKER_LOGIN_TOKEN_PASSPHRASE: ${{ secrets.DOCKER_LOGIN_TOKEN_PASSPHRASE }}
@@ -84,9 +84,6 @@ jobs:
         test:
         - action: check-aws-sdk-adhoc-tests
           runner: ubuntu-latest
-        # TODO(enableNewSmithyRuntimeCleanup): Remove `check-aws-sdk-orchestrator-impl` when cleaning up middleware
-        - action: check-aws-sdk-orchestrator-impl
-          runner: smithy_ubuntu-latest_8-core
         - action: check-client-codegen-integration-tests
           runner: smithy_ubuntu-latest_8-core
         - action: check-client-codegen-unit-tests
@@ -189,6 +186,9 @@ jobs:
       with:
         toolchain: ${{ env.rust_version }}
         components: ${{ env.rust_toolchain_components }}
+      # To fix OpenSSL not found on Windows: https://github.com/sfackler/rust-openssl/issues/1542
+    - run: echo "VCPKG_ROOT=$env:VCPKG_INSTALLATION_ROOT" | Out-File -FilePath $env:GITHUB_ENV -Append
+    - run: vcpkg install openssl:x64-windows-static-md
     - name: Run tests
       shell: bash
       run: |

.github/workflows/claim-crate-names.yml

@@ -10,7 +10,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  rust_version: 1.68.2
+  rust_version: 1.70.0
 
 name: Claim unpublished crate names on crates.io
 run-name: ${{ github.workflow }}

.github/workflows/github-pages.yml

@@ -8,7 +8,7 @@ on:
 name: Update GitHub Pages
 
 env:
-  rust_version: 1.68.2
+  rust_version: 1.70.0
 
 # Allow only one doc pages build to run at a time for the entire smithy-rs repo
 concurrency:
@@ -37,7 +37,7 @@ jobs:
 
         pushd design &>/dev/null
         cargo install mdbook
-        cargo install mdbook-mermaid
+        cargo install --locked mdbook-mermaid
         mdbook build --dest-dir ../../output
         popd &>/dev/null
 

.github/workflows/pull-request-bot.yml

@@ -28,13 +28,11 @@ concurrency:
 
 env:
   java_version: 11
-  rust_version: 1.68.2
   rust_toolchain_components: clippy,rustfmt
   apt_dependencies: libssl-dev gnuplot jq
-
 jobs:
   generate-diff:
-    runs-on: ubuntu-latest
+    runs-on: smithy_ubuntu-latest_8-core
     name: Generate diff and upload to S3
     env:
       AWS_REGION: us-west-2
@@ -69,7 +67,7 @@ jobs:
         fi
 
   generate-doc-preview:
-    runs-on: ubuntu-latest
+    runs-on: smithy_ubuntu-latest_8-core
     name: Generate rustdoc preview and upload to S3
     env:
       AWS_REGION: us-west-2
@@ -100,14 +98,14 @@ jobs:
         java-version: ${{ env.java_version }}
     - uses: dtolnay/rust-toolchain@master
       with:
-        toolchain: ${{ env.rust_version }}
+        toolchain: nightly
     - name: Generate doc preview
       id: generate-preview
       # Only generate three of the smallest services since the doc build can be very large. STS and SSO must be
       # included since aws-config depends on them. Transcribe Streaming and DynamoDB (paginators/waiters) were chosen
       # below to stay small while still representing most features. Combined, they are about ~20MB at time of writing.
       run: |
-        ./gradlew -Paws.services=+sts,+sso,+transcribestreaming,+dynamodb :aws:sdk:assemble
+        ./gradlew -Paws.services=+sts,+sso,+ssooidc,+transcribestreaming,+dynamodb :aws:sdk:assemble
 
         # Copy the Server runtime crate(s) in
         cp -r rust-runtime/aws-smithy-http-server rust-runtime/aws-smithy-http-server-python rust-runtime/aws-smithy-http-server-typescript aws/sdk/build/aws-sdk/sdk
@@ -120,7 +118,8 @@ jobs:
         # Add server runtime crates to the workspace
         sed -i 's/"sdk\/sts",/"sdk\/sts","sdk\/aws-smithy-http-server","sdk\/aws-smithy-http-server-python","sdk\/aws-smithy-http-server-typescript",/' Cargo.toml
 
-        cargo doc --no-deps --all-features
+        RUSTDOCFLAGS="--cfg docsrs" cargo +nightly doc --all-features --no-deps
+
         popd
         ./tools/ci-scripts/generate-doc-preview-index.sh ${{ inputs.base_revision }}