chore(ci): use OIDC and encrypt release secrets

.github/scripts/enforce_acknowledgment.js

@@ -0,0 +1,40 @@
+const {
+PR_ACTION,
+PR_AUTHOR,
+PR_BODY,
+PR_NUMBER,
+IGNORE_AUTHORS,
+LABEL_BLOCK,
+LABEL_BLOCK_REASON
+} = require("./constants")
+
+module.exports = async ({github, context, core}) => {
+    if (IGNORE_AUTHORS.includes(PR_AUTHOR)) {
+    return core.notice("Author in IGNORE_AUTHORS list; skipping...")
+    }
+
+    if (PR_ACTION != "opened") {
+    return core.notice("Only newly open PRs are labelled to avoid spam; skipping")
+    }
+
+    const RELATED_ISSUE_REGEX = /Issue number:[^\d\r\n]+(?<issue>\d+)/;
+    const isMatch = RELATED_ISSUE_REGEX.exec(PR_BODY);
+    if (isMatch == null) {
+        core.info(`No related issue found, maybe the author didn't use the template but there is one.`)
+
+        let msg = "No related issues found. Please ensure there is an open issue related to this change to avoid significant delays or closure.";
+        await github.rest.issues.createComment({
+        owner: context.repo.owner,
+        repo: context.repo.repo,
+        body: msg,
+        issue_number: PR_NUMBER,
+        });
+
+        return await github.rest.issues.addLabels({
+        issue_number: PR_NUMBER,
+        owner: context.repo.owner,
+        repo: context.repo.repo,
+        labels: [LABEL_BLOCK, LABEL_BLOCK_REASON]
+        })
+    }
+}

.github/workflows/on_opened_pr.yml

@@ -20,6 +20,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
+      - name: "Debug workflow_run event"
+        run: echo "${{ github }}"
       - name: "Ensure related issue is present"
         uses: actions/github-script@v6
         env:

.github/workflows/publish.yml

@@ -31,6 +31,7 @@ on:
 
 jobs:
   release:
+    environment: release
     runs-on: ubuntu-latest
     outputs:
       RELEASE_VERSION: ${{ steps.release_version.outputs.RELEASE_VERSION }}
@@ -84,16 +85,15 @@ jobs:
         env:
           PYPI_USERNAME: __token__
           PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}
+      - name: aws credentials
+        uses: aws-actions/configure-aws-credentials@v1
+        with:
+          aws-region: eu-west-1
+          role-to-assume: ${{ secrets.AWS_SAR_ROLE_ARN }}
       - name: publish lambda layer in SAR by triggering the internal codepipeline
         run: |
           aws ssm put-parameter --name "powertools-python-release-version" --value $RELEASE_VERSION --overwrite
-          aws codepipeline start-pipeline-execution --name ${{ secrets.CODEPIPELINE_NAME }}
-        env:
-          # Maintenance: Migrate to new OAuth mechanism
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          AWS_DEFAULT_REGION: eu-west-1
-          AWS_DEFAULT_OUTPUT: json
+          aws codepipeline start-pipeline-execution --name ${{ secrets.AWS_SAR_PIPELINE_NAME }}
 
   docs:
     needs: release