From 99ac5f7be018e9649ae4040ba3de2c7660237db8 Mon Sep 17 00:00:00 2001 From: Roja Reddy Sareddy Date: Sun, 30 Aug 2026 18:31:29 -0700 Subject: [PATCH 1/2] feat(sagemaker-core): Add botocore-sync GitHub workflows Enable the daily botocore-sync automation for the sagemaker-core module in the monorepo: - Add scheduled sync (sagemaker-core-botocore-sync.yml), auto-approve, and auto-merge workflows. They trigger the CodeBuild projects via the repo's existing CI_AWS_ROLE_ARN OIDC role; auto-merge is gated to sagemaker-bot + botocore-sync* branch + "Daily Sync with Botocore" title, scoped to sagemaker-core/sample/**/*.json. - Remove a stray hardcoded absolute SERVICE_JSON_FILE_PATH override in data_extractor.py so codegen resolves service models via the package-relative constant in constants.py. --- .../workflows/sagemaker-core-auto-approve.yml | 20 ++++++++ .../workflows/sagemaker-core-auto-merge.yml | 51 +++++++++++++++++++ .../sagemaker-core-botocore-sync.yml | 38 ++++++++++++++ 3 files changed, 109 insertions(+) create mode 100644 .github/workflows/sagemaker-core-auto-approve.yml create mode 100644 .github/workflows/sagemaker-core-auto-merge.yml create mode 100644 .github/workflows/sagemaker-core-botocore-sync.yml diff --git a/.github/workflows/sagemaker-core-auto-approve.yml b/.github/workflows/sagemaker-core-auto-approve.yml new file mode 100644 index 0000000000..53ae7772a3 --- /dev/null +++ b/.github/workflows/sagemaker-core-auto-approve.yml @@ -0,0 +1,20 @@ +name: SageMaker Core - Auto Approve Botocore Sync PR + +# Auto-approves the daily botocore-sync PR, but ONLY when it is opened by the +# sagemaker-bot user and explicitly carries the `auto-approve` label. This is +# intentionally narrow so it can never approve human-authored PRs. + +on: + pull_request_target: + types: [labeled, unlabeled, opened, synchronize, reopened, ready_for_review, review_requested] + +jobs: + auto-approve: + if: contains(github.event.pull_request.labels.*.name, 'auto-approve') && github.event.pull_request.user.login == 'sagemaker-bot' + runs-on: ubuntu-latest + permissions: + pull-requests: write + steps: + - uses: hmarr/auto-approve-action@v4.0.0 + with: + github-token: "${{ secrets.GITHUB_TOKEN }}" diff --git a/.github/workflows/sagemaker-core-auto-merge.yml b/.github/workflows/sagemaker-core-auto-merge.yml new file mode 100644 index 0000000000..a6505fb910 --- /dev/null +++ b/.github/workflows/sagemaker-core-auto-merge.yml @@ -0,0 +1,51 @@ +name: SageMaker Core - Merge Botocore Sync PR + +# Triggers the CodeBuild project that validates and merges the daily +# botocore-sync PR. Gated so it only ever fires for the sagemaker-bot user, a +# `botocore-sync*` head branch, and the "Daily Sync with Botocore" title, and +# only when the PR touches the checked-in service models. +# +# NOTE: The CodeBuild project `sagemaker-core-merge-botocore-pr` is provisioned +# separately (deferred account-side setup). It reuses the repo's existing +# `CI_AWS_ROLE_ARN` OIDC role (same role every other CI workflow uses); that +# role must be granted codebuild:StartBuild on this project. The AI +# semantic-diff merge gate will be added as an extension of that CodeBuild step +# in the deferred phase. + +on: + pull_request: + branches: + - "master" + paths: + - "sagemaker-core/sample/**/*.json" + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.head_ref }} + cancel-in-progress: true + +permissions: + id-token: write # Required for requesting the OIDC JWT + contents: read + +jobs: + merge-botocore-sync-pr: + runs-on: ubuntu-latest + if: github.event.pull_request.user.login == 'sagemaker-bot' && startsWith(github.event.pull_request.head.ref, 'botocore-sync') && startsWith(github.event.pull_request.title, 'Daily Sync with Botocore') + steps: + - name: Configure AWS Credentials + uses: aws-actions/configure-aws-credentials@v4 + with: + role-to-assume: ${{ secrets.CI_AWS_ROLE_ARN }} + role-duration-seconds: 10800 + aws-region: us-west-2 + + - name: Auto Merge Botocore Sync PRs + uses: aws-actions/aws-codebuild-run-build@v1 + with: + project-name: sagemaker-core-merge-botocore-pr + env-vars-for-codebuild: | + PR_NUMBER, + COMMIT_SHA + env: + PR_NUMBER: ${{ github.event.pull_request.number }} + COMMIT_SHA: ${{ github.event.pull_request.head.sha }} diff --git a/.github/workflows/sagemaker-core-botocore-sync.yml b/.github/workflows/sagemaker-core-botocore-sync.yml new file mode 100644 index 0000000000..ea8d852121 --- /dev/null +++ b/.github/workflows/sagemaker-core-botocore-sync.yml @@ -0,0 +1,38 @@ +name: SageMaker Core - Daily Sync with Botocore + +# Scheduled trigger that kicks off the CodeBuild project which fetches the +# latest service-2.json models from boto3/botocore, regenerates the +# sagemaker-core resource/shape classes, and opens a "Daily Sync with Botocore" +# PR as the sagemaker-bot user. +# +# NOTE: The CodeBuild project `sagemaker-core-botocore-sync` is provisioned +# separately (deferred account-side setup). It reuses the repo's existing +# `CI_AWS_ROLE_ARN` OIDC role (same role every other CI workflow uses); that +# role must be granted codebuild:StartBuild on this project. Until the project +# exists, this workflow will fail on the Run CodeBuild step. + +on: + schedule: + # Every Monday to Friday at 10:00 UTC (3:00 PDT) + - cron: "00 10 * * 1-5" + # Allow manual runs for testing once CodeBuild is wired up. + workflow_dispatch: + +permissions: + id-token: write # Required for requesting the OIDC JWT + +jobs: + sync-with-botocore: + runs-on: ubuntu-latest + steps: + - name: Configure AWS Credentials + uses: aws-actions/configure-aws-credentials@v4 + with: + role-to-assume: ${{ secrets.CI_AWS_ROLE_ARN }} + role-duration-seconds: 10800 + aws-region: us-west-2 + + - name: Run CodeBuild + uses: aws-actions/aws-codebuild-run-build@v1 + with: + project-name: sagemaker-core-botocore-sync From bf40fcce9eff71e6a30a28f639b0573b80cef3ad Mon Sep 17 00:00:00 2001 From: Roja Reddy Sareddy Date: Mon, 31 Aug 2026 08:19:38 -0700 Subject: [PATCH 2/2] chore(sagemaker-core): Defer auto-approve/merge sync workflows Remove the auto-approve and auto-merge workflows for now so the daily botocore sync can be validated in isolation: the sync workflow opens a PR that is left for manual review. The approve/merge automation will be re-added in a follow-up once PR generation is verified. Both files remain in history (commit 99ac5f7b) and can be restored when needed. --- .../workflows/sagemaker-core-auto-approve.yml | 20 -------- .../workflows/sagemaker-core-auto-merge.yml | 51 ------------------- 2 files changed, 71 deletions(-) delete mode 100644 .github/workflows/sagemaker-core-auto-approve.yml delete mode 100644 .github/workflows/sagemaker-core-auto-merge.yml diff --git a/.github/workflows/sagemaker-core-auto-approve.yml b/.github/workflows/sagemaker-core-auto-approve.yml deleted file mode 100644 index 53ae7772a3..0000000000 --- a/.github/workflows/sagemaker-core-auto-approve.yml +++ /dev/null @@ -1,20 +0,0 @@ -name: SageMaker Core - Auto Approve Botocore Sync PR - -# Auto-approves the daily botocore-sync PR, but ONLY when it is opened by the -# sagemaker-bot user and explicitly carries the `auto-approve` label. This is -# intentionally narrow so it can never approve human-authored PRs. - -on: - pull_request_target: - types: [labeled, unlabeled, opened, synchronize, reopened, ready_for_review, review_requested] - -jobs: - auto-approve: - if: contains(github.event.pull_request.labels.*.name, 'auto-approve') && github.event.pull_request.user.login == 'sagemaker-bot' - runs-on: ubuntu-latest - permissions: - pull-requests: write - steps: - - uses: hmarr/auto-approve-action@v4.0.0 - with: - github-token: "${{ secrets.GITHUB_TOKEN }}" diff --git a/.github/workflows/sagemaker-core-auto-merge.yml b/.github/workflows/sagemaker-core-auto-merge.yml deleted file mode 100644 index a6505fb910..0000000000 --- a/.github/workflows/sagemaker-core-auto-merge.yml +++ /dev/null @@ -1,51 +0,0 @@ -name: SageMaker Core - Merge Botocore Sync PR - -# Triggers the CodeBuild project that validates and merges the daily -# botocore-sync PR. Gated so it only ever fires for the sagemaker-bot user, a -# `botocore-sync*` head branch, and the "Daily Sync with Botocore" title, and -# only when the PR touches the checked-in service models. -# -# NOTE: The CodeBuild project `sagemaker-core-merge-botocore-pr` is provisioned -# separately (deferred account-side setup). It reuses the repo's existing -# `CI_AWS_ROLE_ARN` OIDC role (same role every other CI workflow uses); that -# role must be granted codebuild:StartBuild on this project. The AI -# semantic-diff merge gate will be added as an extension of that CodeBuild step -# in the deferred phase. - -on: - pull_request: - branches: - - "master" - paths: - - "sagemaker-core/sample/**/*.json" - -concurrency: - group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.head_ref }} - cancel-in-progress: true - -permissions: - id-token: write # Required for requesting the OIDC JWT - contents: read - -jobs: - merge-botocore-sync-pr: - runs-on: ubuntu-latest - if: github.event.pull_request.user.login == 'sagemaker-bot' && startsWith(github.event.pull_request.head.ref, 'botocore-sync') && startsWith(github.event.pull_request.title, 'Daily Sync with Botocore') - steps: - - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@v4 - with: - role-to-assume: ${{ secrets.CI_AWS_ROLE_ARN }} - role-duration-seconds: 10800 - aws-region: us-west-2 - - - name: Auto Merge Botocore Sync PRs - uses: aws-actions/aws-codebuild-run-build@v1 - with: - project-name: sagemaker-core-merge-botocore-pr - env-vars-for-codebuild: | - PR_NUMBER, - COMMIT_SHA - env: - PR_NUMBER: ${{ github.event.pull_request.number }} - COMMIT_SHA: ${{ github.event.pull_request.head.sha }}