Update dock check syntax issue by bkhouri · Pull Request #290 · swiftlang/github-workflows

bkhouri · 2026-06-25T19:09:03Z

Fixes: #291

This PR delivers the v2 plugin system, replacing the legacy single-purpose `archive` plugin with three focused SwiftPM command plugins that cover the end-to-end developer experience: - **`lambda-init`** — Scaffold a new Lambda function from a template - **`lambda-build`** — Compile and package for Amazon Linux 2023 (via Docker or Apple container) - **`lambda-deploy`** — Deploy to AWS Lambda (create, update, or delete) The legacy `archive` command is preserved as a deprecated passthrough to `lambda-build`. ## Quick Start ```bash # Create a new project swift package init --type executable --name MyLambda # Scaffold a Lambda function swift package lambda-init --allow-writing-to-package-directory # Build for Amazon Linux swift package --allow-network-connections docker lambda-build # Deploy to AWS swift package --allow-network-connections all:443 lambda-deploy # Delete when done swift package --allow-network-connections all:443 lambda-deploy --delete ``` ## Key Changes ### Architecture - All plugins are thin wrappers that spawn a shared `AWSLambdaPluginHelper` executable - The helper dispatches to `Initializer`, `Builder`, or `Deployer` based on `argv[1]` - AWS API calls use generated service clients (Lambda, IAM, S3, STS) built on SotoCore ### Builder (`lambda-build`) - Default base image changed from `amazonlinux2` to `amazonlinux2023` - AL2 blanket deprecation warning removed; targeted warning only when AL2 explicitly chosen - New `--cross-compile` option (replaces `--container-cli`): `docker`, `container`, `swift-static-sdk`, `custom-sdk` - Default binary stripping with `-Xlinker -s` and `--no-strip` opt-out - `--output-directory` accepted as deprecated alias for `--output-path` - Container CLI existence check with helpful install URLs ### Deployer (`lambda-deploy`) - Creates/updates/deletes Lambda functions with full IAM role lifecycle - Auto-creates IAM role with `AWSLambdaBasicExecutionRole` - S3 staging for archives > 50 MB - Function URL support with IAM auth (account-scoped, not world-accessible) - Auto-detects `FunctionURLRequest` usage in source code to enable URL without explicit `--with-url` - Ready-to-use invocation commands in deploy output ### Initializer (`lambda-init`) - Detects the actual entry point file (supports both `Sources/main.swift` and `Sources/<Name>/<Name>.swift`) - Backs up existing file before overwriting ### Dependencies - Added `soto-core` for AWS credential management, SigV4 signing, and HTTP transport - Removed vendored crypto/signer/HTTP code under `Vendored/` - Generated AWS service clients committed to the repository (maintainer-run generation script) ### Backward Compatibility - `swift package archive` preserved as deprecated alias (emits warning, delegates to `lambda-build`) - `--container-cli` accepted as deprecated alias for `--cross-compile` - `--output-directory` accepted as deprecated alias for `--output-path` - All original `archive` CLI options continue to work ## Documentation - Updated DocC articles, tutorials, and quick-setup guide - Updated all example READMEs with new plugin commands - SAM/CDK examples preserved with their respective deployment tools ## Known Limitations - Static Linux SDK CI uses `--build-system native`. On Swift 6.4 the new default build system (Swift Build) fails to statically link `AWSLambdaPluginHelper`: SotoCore transitively pulls in two vendored BoringSSL copies (swift-crypto's `CCryptoBoringSSL` and swift-nio-ssl's `CNIOBoringSSL`), and Swift Build emits duplicate C++ symbols at link time. The legacy build system links the same package cleanly, so the CI static build is pinned to `--build-system native` until the upstream issue is fixed: https://github.com/swiftlang/swift-build/issues/1485. - The `nightly-main` (6.5-dev) Linux job is expected to fail. The 6.5-dev compiler crashes while compiling `AWSLambdaRuntimeTests` (a SIL verification error in the `OwnershipModelEliminator` pass on a `Mutex` captured by a nested `Task` inside a task group). This is a toolchain bug, not a problem in this PR: the same code compiles on 6.1 through 6.4. Reported upstream with a minimal reproducer: swiftlang/swift#90211. `nightly-main` tracks an unreleased toolchain and is not a release target, so we are not working around it here. - SwiftPM prompts for network permission on first run (known [SPM issue swiftlang/swift#9763](swiftlang/swift-package-manager#9763)) - The shared documentation soundness check is temporarily disabled (`docs_check_enabled: false`). A regression in `swiftlang/github-workflows` (#282) passes the `.spi.yml` documentation target to `--target` with literal quotes, so the check fails with `no target named '"AWSLambdaRuntime"'`. Pinning the workflow version does not help because the reusable workflow always fetches its `check-docs.sh` from `main`. Re-enable once the upstream fix lands: swiftlang/github-workflows#290 (tracked in swiftlang/github-workflows#291). The SotoCore `LoginCredentialProvider` token-persistence issue in the SwiftPM sandbox is now resolved upstream ([soto-core#692](soto-project/soto-core#692), released in soto-core 7.14.0), and this PR already requires `from: "7.14.0"`. ## Testing - Unit tests for BuilderConfiguration and DeployerConfiguration argument parsing - Property-based tests for correctness properties (alias equivalence, cross-compile round-trip, mutual exclusion, bucket naming, archive threshold, AL2 warning logic) - End-to-end integration test script (`scripts/integration-test.sh`) - Manually tested: full create → invoke → update → delete lifecycle on AWS --------- Co-authored-by: Sebastien Stormacq <stormacq@amazon.lu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

FranzBusch

Can we add a test for this so we don't regress this again?

bkhouri · 2026-06-26T13:40:58Z

Can we add a test for this so we don't regress this again?

The is a test in the Workflow. It was previously giving a false positive :(

FranzBusch · 2026-06-26T14:33:53Z

-      - name: Pre-build
-        if: ${{ inputs.linux_pre_build_command }}
-        # zizmor: ignore[template-injection]
-        run: ${{ inputs.linux_pre_build_command }}


Why have we moved this inline?

Great question and I'm glad someone asked. The GitHub-workflows PR builds call this soundness check and set a linux_pre_build_command as following:

github-workflows/.github/workflows/pull_request.yml

Lines 117 to 119 in d65527a

linux_pre_build_command: "cd tests/TestPackage && ${{ matrix.post_command }}"

docs_check_enabled: true

docs_check_targets: ${{ matrix.override_target_name}}

We essentially do a cd tests/TestPackage to change directory to the Sample package. However, when Run documentation check step was executed, it was against the repository root. This was one solution I found that address the use case, but I also considered adding a new input parameter with docs_check_package_root_directory, that would specify a relative directory to the SwiftPM Package to build for the docs.

This PR restores CI doc check now that swiftlang/github-workflows#290 is merged

bkhouri force-pushed the t/main/gh281_fix_doc_workflow branch 5 times, most recently from 0ec112d to f87ef4d Compare June 25, 2026 19:30

sebsto mentioned this pull request Jun 25, 2026

v2 Plugin System: lambda-init, lambda-build, lambda-deploy awslabs/swift-aws-lambda-runtime#567

Merged

bkhouri marked this pull request as ready for review June 25, 2026 21:57

bkhouri requested a review from a team as a code owner June 25, 2026 21:57

FranzBusch approved these changes Jun 26, 2026

View reviewed changes

FranzBusch reviewed Jun 26, 2026

View reviewed changes

Comment thread .github/workflows/soundness.yml Outdated

FranzBusch requested changes Jun 26, 2026

View reviewed changes

allevato mentioned this pull request Jun 26, 2026

Fix #endif gluing onto the following token swiftlang/swift-format#1225

Merged

bkhouri marked this pull request as draft June 26, 2026 14:03

bkhouri force-pushed the t/main/gh281_fix_doc_workflow branch 4 times, most recently from c9cdad3 to b61d9dc Compare June 26, 2026 14:24

FranzBusch approved these changes Jun 26, 2026

View reviewed changes

Update dock check syntax issue

2d1d8c6

bkhouri force-pushed the t/main/gh281_fix_doc_workflow branch from b61d9dc to 2d1d8c6 Compare June 26, 2026 14:26

bkhouri marked this pull request as ready for review June 26, 2026 14:27

bkhouri mentioned this pull request Jun 26, 2026

[WIP] Add a Required job that depends on all others #292

Draft

FranzBusch reviewed Jun 26, 2026

View reviewed changes

FranzBusch approved these changes Jun 26, 2026

View reviewed changes

bkhouri merged commit 6078937 into swiftlang:main Jun 26, 2026
388 of 391 checks passed

bkhouri deleted the t/main/gh281_fix_doc_workflow branch June 26, 2026 14:56

sebsto mentioned this pull request Jun 26, 2026

Enable soundness docs check awslabs/swift-aws-lambda-runtime#674

Merged

sebsto added a commit to awslabs/swift-aws-lambda-runtime that referenced this pull request Jun 26, 2026

Enable soundness docs check (#674)

d6a7eef

This PR restores CI doc check now that swiftlang/github-workflows#290 is merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update dock check syntax issue#290

Update dock check syntax issue#290
bkhouri merged 1 commit into
swiftlang:mainfrom
bkhouri:t/main/gh281_fix_doc_workflow

bkhouri commented Jun 25, 2026 •

edited

Loading

Uh oh!

Uh oh!

FranzBusch left a comment

Uh oh!

bkhouri commented Jun 26, 2026

Uh oh!

FranzBusch Jun 26, 2026

Uh oh!

bkhouri Jun 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	linux_pre_build_command: "cd tests/TestPackage && ${{ matrix.post_command }}"
	docs_check_enabled: true
	docs_check_targets: ${{ matrix.override_target_name}}

Uh oh!

Conversation

bkhouri commented Jun 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

FranzBusch left a comment

Choose a reason for hiding this comment

Uh oh!

bkhouri commented Jun 26, 2026

Uh oh!

FranzBusch Jun 26, 2026

Choose a reason for hiding this comment

Uh oh!

bkhouri Jun 26, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

bkhouri commented Jun 25, 2026 •

edited

Loading