Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/workflows/ci_test_java.yml
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,7 @@ jobs:

- uses: actions/checkout@v5
with:
ref: benchmark
submodules: recursive

- name: Setup Dafny
Expand Down
139 changes: 139 additions & 0 deletions .github/workflows/performance-benchmarks-go.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,139 @@
# This workflow performs benchmark testing in Go.
name: Performance Benchmarks Go

on:
workflow_call:
inputs:
dafny:
description: "The Dafny version to run"
required: true
type: string
regenerate-code:
description: "Regenerate code using smithy-dafny"
required: false
default: false
type: boolean
mpl-version:
description: "MPL version to use"
required: false
type: string
mpl-head:
description: "Running on MPL HEAD"
required: false
default: false
type: boolean
jobs:
testGo:
strategy:
fail-fast: false
matrix:
library: [DynamoDbEncryption]
benchmark-dir: [db-esdk-performance-testing/benchmarks]
os: [ubuntu-22.04, macos-15-intel]
go-version: ["1.23", "1.24", "1.25"]
runs-on: ${{ matrix.os }}
permissions:
id-token: write
contents: read
steps:
- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@v5
with:
aws-region: us-west-2
role-to-assume: arn:aws:iam::370957321024:role/GitHub-CI-DDBEC-Dafny-Role-us-west-2
role-session-name: DDBEC-Performance-Benchmarks-Go

- name: Support longpaths
run: |
git config --global core.longpaths true

- uses: actions/checkout@v5
with:
ref: benchmark
submodules: recursive
- name: Init Submodules
shell: bash
run: |
git submodule update --init --recursive submodules/smithy-dafny
git submodule update --init --recursive submodules/MaterialProviders

- name: Create temporary global.json
run: echo '{"sdk":{"rollForward":"latestFeature","version":"6.0.0"}}' > ./global.json

- name: Setup Java 17 for codegen
uses: actions/setup-java@v5
with:
distribution: "corretto"
java-version: "17"

- name: Update MPL submodule if using MPL HEAD
if: ${{ inputs.mpl-head == true }}
working-directory: submodules/MaterialProviders
run: |
git checkout main
git pull
git submodule update --init --recursive
git rev-parse HEAD

- name: Update project.properties if using MPL HEAD
if: ${{ inputs.mpl-head == true }}
run: |
sed "s/mplDependencyJavaVersion=.*/mplDependencyJavaVersion=${{inputs.mpl-version}}/g" project.properties > project.properties2; mv project.properties2 project.properties

- name: Install Go
uses: actions/setup-go@v6
with:
go-version: ${{ matrix.go-version }}

- name: Setup Dafny
uses: dafny-lang/setup-dafny-action@v1.8.0
with:
dafny-version: ${{ inputs.dafny }}

- name: Install Smithy-Dafny codegen dependencies
uses: ./.github/actions/install_smithy_dafny_codegen_dependencies

- name: Build ${{ matrix.library }} implementation
shell: bash
working-directory: ./
run: |
ls

- name: Build ${{ matrix.library }} implementation
shell: bash
working-directory: ./${{ matrix.library }}
run: |
# This works because `node` is installed by default on GHA runners
CORES=$(node -e 'console.log(os.cpus().length)')
make transpile_go CORES=$CORES

- name: Run Performance Benchmarks - Quick Mode
shell: bash
working-directory: ./${{matrix.benchmark-dir}}/go
run: |
go run . --config ../../config/test-scenarios.yaml --quick

- name: Parse and Format Logs
working-directory: ./${{matrix.benchmark-dir}}/results/raw-data/
run: |
LOG_FILE="go_results.json"
UPLOAD_FILE="cloudwatch_logs.json"
TIMESTAMP=$(date +%s%3N)
jq -c --arg ts "$(date +%s)000" '.results[] as $result | .metadata as $meta | {timestamp: ($ts | tonumber), message: ({metadata: $meta, result: $result} | tostring)}' $LOG_FILE > $UPLOAD_FILE

- name: Upload logs to CloudWatch
working-directory: ./${{matrix.benchmark-dir}}/results/raw-data/
run: |
LOG_FILE="cloudwatch_logs.json"
LOG_GROUP="aws-dbesdk-performance-benchmarks"
LOG_STREAM="go/quick_benchmarks/${{ github.workflow }}/${{ github.run_id }}"

# Create log stream (ignore if exists)
aws logs create-log-stream \
--log-group-name "$LOG_GROUP" \
--log-stream-name "$LOG_STREAM" 2>/dev/null || true

aws logs put-log-events \
--log-group-name "$LOG_GROUP" \
--log-stream-name "$LOG_STREAM" \
--log-events file://$LOG_FILE
32 changes: 32 additions & 0 deletions .github/workflows/performance-benchmarks.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
# This workflow runs every day 09:00 UTC (1AM PST)
name: Performance Benchmarks

on:
pull_request:
paths:
- ".github/workflows/performance-benchmarks.yml"
schedule:
- cron: "00 09 * * *"

jobs:
getVersion:
# Don't run the cron builds on forks
if: github.event_name != 'schedule' || github.repository_owner == 'aws'
uses: ./.github/workflows/dafny_version.yml
performance-benchmarks-go:
Comment on lines +14 to +16

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI about 2 months ago

In general, the problem is fixed by explicitly declaring a minimal permissions: block in the workflow, either at the root (applies to all jobs lacking their own block) or per job. This prevents the jobs from inheriting potentially over-privileged default permissions for the GITHUB_TOKEN.

For this workflow, the simplest, least-invasive fix is to add a root-level permissions: block that applies to all jobs. Since the top-level workflow only orchestrates reusable workflows and sends a Slack notification (which uses a secret, not the GITHUB_TOKEN), it can safely set contents: read as a minimal baseline. If any called reusable workflows need additional permissions, they should define their own permissions: blocks within those reusable workflow files; we must not assume or edit those here.

Concretely, in .github/workflows/performance-benchmarks.yml, add a permissions: section after the name: line (line 2) and before the on: block (line 4). The block should set contents: read, which is a reasonable minimal starting point for a workflow that only needs to read repository metadata. No imports or additional methods are needed, since this is a YAML configuration change only.

Suggested changeset 1
.github/workflows/performance-benchmarks.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/performance-benchmarks.yml b/.github/workflows/performance-benchmarks.yml
--- a/.github/workflows/performance-benchmarks.yml
+++ b/.github/workflows/performance-benchmarks.yml
@@ -1,5 +1,7 @@
 # This workflow runs every day 09:00 UTC (1AM PST)
 name: Performance Benchmarks
+permissions:
+  contents: read
 
 on:
   pull_request:
EOF
@@ -1,5 +1,7 @@
# This workflow runs every day 09:00 UTC (1AM PST)
name: Performance Benchmarks
permissions:
contents: read

on:
pull_request:
Copilot is powered by AI and may make mistakes. Always verify output.
needs: getVersion
uses: ./.github/workflows/performance-benchmarks-go.yml
with:
dafny: ${{needs.getVersion.outputs.version}}
notify:
Comment on lines +17 to +21

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI about 2 months ago

In general, the fix is to add an explicit permissions: block that scopes the GITHUB_TOKEN to the minimal access needed. This can be done at the workflow root (applies to all jobs that don’t override it) or per job. Since all jobs here only orchestrate other workflows and don’t manipulate repository contents directly, a safe and conservative default is permissions: contents: read at the workflow level, which still allows read access to the repo while avoiding unnecessary write permissions.

The single best fix with minimal functional impact is to add a top‑level permissions: block right under the name: field (or anywhere at the root) in .github/workflows/performance-benchmarks.yml, like:

permissions:
  contents: read

This constrains the GITHUB_TOKEN for all three jobs: getVersion, performance-benchmarks-go, and notify, unless any of the called reusable workflows override permissions themselves (which they are allowed to do, but outside the scope of this snippet). No other code changes, imports, or definitions are needed, as this only affects GitHub Actions configuration.

Suggested changeset 1
.github/workflows/performance-benchmarks.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/performance-benchmarks.yml b/.github/workflows/performance-benchmarks.yml
--- a/.github/workflows/performance-benchmarks.yml
+++ b/.github/workflows/performance-benchmarks.yml
@@ -1,6 +1,9 @@
 # This workflow runs every day 09:00 UTC (1AM PST)
 name: Performance Benchmarks
 
+permissions:
+  contents: read
+
 on:
   pull_request:
     paths:
EOF
@@ -1,6 +1,9 @@
# This workflow runs every day 09:00 UTC (1AM PST)
name: Performance Benchmarks

permissions:
contents: read

on:
pull_request:
paths:
Copilot is powered by AI and may make mistakes. Always verify output.
needs:
[
getVersion,
performance-benchmarks-go
]
if: ${{ failure() }}
uses: aws/aws-cryptographic-material-providers-library/.github/workflows/slack-notification.yml@main
with:
message: "Performance Benchmarks failed on `${{ github.repository }}`. View run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
secrets:
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL_CI }}
Comment on lines +22 to +32

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI about 2 months ago

In general, the fix is to explicitly define a permissions: block to restrict the GITHUB_TOKEN to the least privileges needed. This can be done at the workflow root (applies to all jobs that don’t override it) or per job. Since all jobs here are just invoking reusable workflows and don’t themselves interact with the repository, the minimal safe starting point is permissions: { contents: read } at the workflow level.

The best fix, without changing existing functionality, is to add a top‑level permissions: block after the on: section. This will apply to getVersion, performance-benchmarks-go, and notify unless those reusable workflows override permissions internally. Given the visible code, the jobs don’t appear to need any write permissions, so contents: read is sufficient and matches GitHub’s recommended minimal example. No other methods, imports, or definitions are needed; this is purely a YAML configuration change within .github/workflows/performance-benchmarks.yml.

Concretely:

  • Edit .github/workflows/performance-benchmarks.yml.
  • After line 10 (schedule: ... block), insert:
permissions:
  contents: read

This introduces explicit least‑privilege permissions for the GITHUB_TOKEN used by this workflow.

Suggested changeset 1
.github/workflows/performance-benchmarks.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/performance-benchmarks.yml b/.github/workflows/performance-benchmarks.yml
--- a/.github/workflows/performance-benchmarks.yml
+++ b/.github/workflows/performance-benchmarks.yml
@@ -8,6 +8,9 @@
   schedule:
     - cron: "00 09 * * *"
 
+permissions:
+  contents: read
+
 jobs:
   getVersion:
     # Don't run the cron builds on forks
EOF
@@ -8,6 +8,9 @@
schedule:
- cron: "00 09 * * *"

permissions:
contents: read

jobs:
getVersion:
# Don't run the cron builds on forks
Copilot is powered by AI and may make mistakes. Always verify output.
Loading