ci: run all workflows on CodeBuild-hosted runners#1715
Open
notgitika wants to merge 5 commits into
Open
Conversation
Move every job off ubuntu-latest onto our AWS CodeBuild-hosted GitHub Actions runner (project agentcore-e2e in the CI account, us-east-1). Motivation (E2E infra doc, Section 1): GitHub-hosted runner pickup in the aws/ org has been taking 5-10 min lately, and shared runner IPs trip the service WAF (403s) on AWS-calling jobs. CodeBuild ephemeral runners spin up per job in ~5s and run inside AWS, fixing both. Every runs-on: ubuntu-latest -> the codebuild label. Runners are ephemeral and per-job (each WORKFLOW_JOB_QUEUED event gets its own), bounded by the account concurrent-build quota (300 Linux/Small), so parallelism is preserved. Follow-up: the runner webhook is currently authed via a personal PAT because the AWS Connector GitHub App isn't scoped to this repo yet; migrate to the managed App connection once an org admin adds the repo.
github-actions
Bot
added
the
agentcore-harness-reviewing
agentcore-devx-automation
Bot
added
the
claude-security-reviewing
Contributor
|
Claude Security Review: no high-confidence findings. (run) |
agentcore-devx-automation
Bot
removed
the
claude-security-reviewing
Contributor
Package TarballHow to installgh release download pr-1715-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.23.0.tgz |
agentcore-cli-automation
left a comment
agentcore-cli-automation
left a comment
There was a problem hiding this comment.
Broad sweep looks good and the rationale (WAF 403s + GHA runner pickup latency) is well-motivated. One concern about a monitoring blind spot; the rest is fine to merge as-is.
github-actions
Bot
removed
the
agentcore-harness-reviewing
CodeQL query evaluation ran out of Java heap on the CodeBuild general1.small runner (3 GB cgroup limit; 'CodeQL is out of memory. Try running CodeQL on a larger runner'). CodeQL makes no AWS/service calls, so it has no WAF exposure and gains nothing from CodeBuild — revert this one workflow to ubuntu-latest. All other workflows stay on CodeBuild.
agentcore-devx-automation
Bot
added
the
claude-security-reviewing
Contributor
|
Claude Security Review: no high-confidence findings. (run) |
agentcore-devx-automation
Bot
removed
the
claude-security-reviewing
Now that agentcore-e2e is general1.medium (7 GB, up from the 3 GB small that OOMed), retry CodeQL on the CodeBuild runner. Reverts the temporary ubuntu-latest pin; if CodeQL still OOMs at 7 GB we'll bump to large or re-pin.
agentcore-devx-automation
Bot
added
the
claude-security-reviewing
Contributor
|
Claude Security Review: no high-confidence findings. (run) |
agentcore-devx-automation
Bot
removed
the
claude-security-reviewing
Per review: ci-failure-issue.yml opens a GitHub issue when main CI fails. Running it on the same CodeBuild runner it may need to report on creates a monitoring blind spot — if CodeBuild is unhealthy (webhook drift, quota exhaustion, broken image) the alarm couldn't start either and the failure is silently swallowed. It's GitHub-API-only (no AWS calls), so it gains nothing from CodeBuild. Keep it on ubuntu-latest for independence.
Contributor
Author
|
investigating the failing merge-reports CI |
agentcore-devx-automation
Bot
added
the
claude-security-reviewing
Contributor
|
Claude Security Review: no high-confidence findings. (run) |
agentcore-devx-automation
Bot
removed
the
claude-security-reviewing
…CodeBuild) Vitest blob reports store absolute test-file paths tied to the runner's working directory. On GitHub-hosted runners every job shares /home/runner/work/agentcore-cli/agentcore-cli, so merge-reports resolves the shard blobs fine. On CodeBuild-hosted runners each job gets a unique /codebuild/output/src<N>/... directory, so the merge job cannot find the shard-recorded paths and vitest exits 'No test files found, exiting with code 1' — deterministically red on CodeBuild, green on ubuntu-latest. Add a normalization step that rewrites each shard blob's recorded repo root to the merge job's own workspace before merging. The regex is anchored to the CodeBuild src<N> path so it cannot touch test titles or other blob content, and is a no-op on GitHub-hosted runners. Verified locally: a blob with a mismatched /codebuild/... path reproduces 'No test files found' (exit 1); after normalization the same merge passes (97 tests).
Contributor
Author
|
A "Normalize blob report paths" step in the merge-reports job rewrites each shard blob's Verified locally and it should not see the |
agentcore-devx-automation
Bot
added
the
claude-security-reviewing
Contributor
|
Claude Security Review: no high-confidence findings. (run) |
agentcore-devx-automation
Bot
removed
the
claude-security-reviewing
Contributor
Coverage Report
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves every job off ubuntu-latest onto our CodeBuild-hosted runner (agentcore-e2e, CI account us-east-1). Fixes the 5-10min GitHub-hosted runner pickup we've been hitting in the aws/ org, plus WAF 403s on AWS-calling jobs.
Runners are ephemeral/per-job, bounded by the 300 Linux/Small concurrency quota, so parallelism is preserved.
Follow-up: migrate the webhook from my PAT to the managed GitHub App connection once org admin scopes the repo.
edit: based on harness comment, keeping ci failure one still based on GH ubuntu runner