Add top-level id-token permissions for reusable workflow calls

.github/config/file-filters.yml

@@ -3,6 +3,8 @@ lint:
   - '**/*.sh'
   - '.golangci.yml'
   - 'packaging/**'
+  - 'go.mod'
+  - 'Makefile'
 
 build:
   - 'Makefile'

.github/pull_request_template.md

@@ -11,10 +11,13 @@ By submitting this pull request, I confirm that you can use, modify, copy, and r
 _Describe what tests you have done._
 
 # Requirements
-_Before commit the code, please do the following steps._
+_Before commiting your code, please do the following steps._
 1. Run `make fmt` and `make fmt-sh`
 2. Run `make lint`
 
+-------
+### Integration Tests
+To run integration tests against this PR, add the `ready for testing` label.
 
 
 

.github/scripts/free-disk-space.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+set -e
+
+echo "=== Disk usage before cleanup ==="
+df -h
+
+echo "=== Freeing up disk space ==="
+sudo rm -rf /usr/share/dotnet
+sudo rm -rf /usr/local/share/powershell
+sudo rm -rf /usr/local/lib/android
+sudo rm -rf /opt/ghc
+
+echo "=== Disk usage after cleanup ==="
+df -h

.github/workflows/PR-build.yml

@@ -48,7 +48,7 @@ jobs:
         if: needs.changes.outputs.lint == 'true'
         uses: actions/setup-go@v4
         with:
-          go-version: ~1.22.2
+          go-version: ~1.25
           cache: false
 
       - name: Check out code
@@ -78,19 +78,19 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-2019, windows-latest, macos-13]
+        os: [ubuntu-latest, windows-2022, windows-latest, macos-15]
         include:
           - os: ubuntu-latest
             family: linux
             cache-path: |
               ~/.cache/go-build
               ~/go/pkg/mod
-          - os: macos-13
+          - os: macos-15
             family: darwin
             cache-path: |
               ~/Library/Caches/go-build
               ~/go/pkg/mod
-          - os: windows-2019
+          - os: windows-2022
             family: windows
             cache-path: |
               ~\AppData\Local\go-build
@@ -105,13 +105,17 @@ jobs:
         if: needs.changes.outputs.build == 'true'
         uses: actions/setup-go@v4
         with:
-          go-version: ~1.22.2
+          go-version: ~1.25
           cache: false
 
       - name: Check out code
         if: needs.changes.outputs.build == 'true'
         uses: actions/checkout@v3
 
+      - name: Free up disk space
+        if: needs.changes.outputs.build == 'true' && matrix.family == 'linux'
+        run: .github/scripts/free-disk-space.sh
+
       - name: Cache binaries
         id: cached_binaries
         if: needs.changes.outputs.build == 'true'
@@ -148,7 +152,7 @@ jobs:
         if: needs.changes.outputs.build == 'true'
         uses: actions/setup-go@v4
         with:
-          go-version: ~1.22.2
+          go-version: ~1.25
           cache: false
 
       - name: Check out code
@@ -157,4 +161,40 @@ jobs:
 
       - name: Test data race
         if: needs.changes.outputs.build == 'true'
-        run: make test-data-race
+        run: make test-data-race
+
+  verify-all:
+    name: Verify All PR Build Jobs
+    needs: [ changes, lint, build, test-data-race ]
+    runs-on: ubuntu-latest
+    if: always()
+    steps:
+      - name: Check Job Status
+        run: |
+          # Convert needs context to JSON and process with jq
+          needs_json='${{ toJSON(needs) }}'
+
+          failed_jobs=()
+          successful_jobs=()
+
+          # Loop through all jobs in needs context
+          for job in $(echo "$needs_json" | jq -r 'keys[]'); do
+            result=$(echo "$needs_json" | jq -r ".[\"$job\"].result")
+
+            if [[ "$result" == "failure" ]]; then
+              failed_jobs+=("$job")
+            elif [[ "$result" == "success" ]]; then
+              successful_jobs+=("$job")
+            fi
+          done
+
+          echo "Successfully validated jobs:"
+          printf '%s\n' "${successful_jobs[@]}"
+
+          if [ ${#failed_jobs[@]} -ne 0 ]; then
+            echo -e "\nFailed jobs:"
+            printf '%s\n' "${failed_jobs[@]}"
+            exit 1
+          fi
+
+          echo -e "\nAll required jobs completed without failures!"

.github/workflows/PR-test.yml

@@ -23,13 +23,30 @@ on:
       - synchronize
       - reopened
       - ready_for_review
+      - labeled
+      - unlabeled
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref_name }}
   cancel-in-progress: true
 
 jobs:
+  CheckLabel:
+    runs-on: ubuntu-latest
+    outputs:
+      should_run: ${{ steps.check.outputs.has_label }}
+    steps:
+      - id: check
+        run: |
+          if [[ "${{ contains(github.event.pull_request.labels.*.name, 'ready for testing') }}" == "true" ]]; then
+            echo "has_label=true" >> $GITHUB_OUTPUT
+          else
+            echo "has_label=false" >> $GITHUB_OUTPUT
+          fi
+
   BuildAndUpload:
+    needs: [ CheckLabel ]
+    if: needs.CheckLabel.outputs.should_run == 'true'
     uses: ./.github/workflows/test-build.yml
     secrets: inherit
     permissions:
@@ -43,6 +60,8 @@ jobs:
 
   OutputEnvVariables:
     name: 'OutputEnvVariables'
+    needs: [ CheckLabel ]
+    if: needs.CheckLabel.outputs.should_run == 'true'
     runs-on: ubuntu-latest
     outputs:
       CWA_GITHUB_TEST_REPO_NAME: ${{ steps.set-outputs.outputs.CWA_GITHUB_TEST_REPO_NAME }}
@@ -73,11 +92,12 @@ jobs:
       - name: Set up Go 1.x
         uses: actions/setup-go@v4
         with:
-          go-version: ~1.22.2
+          go-version: ~1.25
 
   StartLocalStack:
     name: 'StartLocalStack'
-    needs: [OutputEnvVariables]
+    needs: [ CheckLabel, OutputEnvVariables ]
+    if: needs.CheckLabel.outputs.should_run == 'true'
     uses: ./.github/workflows/start-localstack.yml
     secrets: inherit
     permissions:
@@ -93,8 +113,9 @@ jobs:
       s3_integration_bucket: ${{ vars.S3_INTEGRATION_BUCKET }}
 
   GenerateTestMatrix:
-    needs: [OutputEnvVariables]
     name: 'GenerateTestMatrix'
+    needs: [ CheckLabel, OutputEnvVariables ]
+    if: needs.CheckLabel.outputs.should_run == 'true'
     runs-on: ubuntu-latest
     outputs:
       ec2_linux_matrix: ${{ steps.set-matrix.outputs.ec2_linux_matrix }}
@@ -109,7 +130,7 @@ jobs:
       - name: Set up Go 1.x
         uses: actions/setup-go@v4
         with:
-          go-version: ~1.22.2
+          go-version: ~1.25
 
       - name: Install jq
         run: sudo apt-get install -y jq
@@ -136,9 +157,13 @@ jobs:
 
 
   EC2LinuxIntegrationTest:
-    needs: [ GenerateTestMatrix, OutputEnvVariables, StartLocalStack, BuildAndUpload ]
     name: 'EC2LinuxTests'
+    needs: [ CheckLabel, GenerateTestMatrix, OutputEnvVariables, StartLocalStack, BuildAndUpload ]
+    if: needs.CheckLabel.outputs.should_run == 'true'
     uses:  ./.github/workflows/ec2-integration-test.yml
+    permissions:
+      id-token: write
+      contents: read
     with:
       build_id: ${{ github.sha }}
       test_dir: terraform/ec2/linux
@@ -155,9 +180,13 @@ jobs:
     secrets: inherit
 
   EC2SELinuxIntegrationTest:
-    needs: [ GenerateTestMatrix, OutputEnvVariables, StartLocalStack ]
     name: 'EC2SELinuxTests'
+    needs: [ CheckLabel, GenerateTestMatrix, OutputEnvVariables, StartLocalStack, BuildAndUpload ]
+    if: needs.CheckLabel.outputs.should_run == 'true'
     uses:  ./.github/workflows/ec2-integration-test.yml
+    permissions:
+      id-token: write
+      contents: read
     with:
       build_id: ${{ github.sha }}
       test_dir: terraform/ec2/linux
@@ -175,8 +204,8 @@ jobs:
 
   StopLocalStack:
     name: 'StopLocalStack'
-    if: ${{ always() && needs.StartLocalStack.result == 'success' }}
-    needs: [ StartLocalStack, EC2LinuxIntegrationTest, OutputEnvVariables ]
+    needs: [ CheckLabel, StartLocalStack, EC2LinuxIntegrationTest, OutputEnvVariables ]
+    if: ${{ always() && needs.StartLocalStack.result == 'success' && needs.CheckLabel.outputs.should_run == 'true'}}
     uses: ./.github/workflows/stop-localstack.yml
     secrets: inherit
     permissions:
@@ -189,3 +218,59 @@ jobs:
       terraform_assume_role: ${{ vars.TERRAFORM_AWS_ASSUME_ROLE }}
       github_sha: ${{ github.sha }}
       s3_integration_bucket: ${{ vars.S3_INTEGRATION_BUCKET }}
+
+  IntegrationTestGate:
+    name: Check ready for testing label
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check for ready for testing label
+        run: |
+          if [[ "${{ github.event.pull_request.draft }}" == "true" ]]; then
+            echo "Draft PR - skipping label check."
+            exit 0
+          fi
+
+          if [[ "${{ contains(github.event.pull_request.labels.*.name, 'ready for testing') }}" != "true" ]]; then
+            echo "Missing 'ready for testing' label. Please add before merging."
+            exit 1
+          fi
+
+          echo "'ready for testing' label found!"
+
+  verify-all:
+    name: Verify All PR Test Jobs
+    needs: [IntegrationTestGate, CheckLabel, BuildAndUpload, OutputEnvVariables, StartLocalStack,
+            GenerateTestMatrix, EC2LinuxIntegrationTest, EC2SELinuxIntegrationTest,
+            StopLocalStack]
+    runs-on: ubuntu-latest
+    if: always()
+    steps:
+      - name: Check Job Status
+        run: |
+          # Convert needs context to JSON and process with jq
+          needs_json='${{ toJSON(needs) }}'
+
+          failed_jobs=()
+          successful_jobs=()
+
+          # Loop through all jobs in needs context
+          for job in $(echo "$needs_json" | jq -r 'keys[]'); do
+            result=$(echo "$needs_json" | jq -r ".[\"$job\"].result")
+
+            if [[ "$result" == "failure" ]]; then
+              failed_jobs+=("$job")
+            elif [[ "$result" == "success" ]]; then
+              successful_jobs+=("$job")
+            fi
+          done
+
+          echo "Successfully validated jobs:"
+          printf '%s\n' "${successful_jobs[@]}"
+
+          if [ ${#failed_jobs[@]} -ne 0 ]; then
+            echo -e "\nFailed jobs:"
+            printf '%s\n' "${failed_jobs[@]}"
+            exit 1
+          fi
+
+          echo -e "\nAll required jobs completed without failures!"