chore: proposal

.github/actions/ecr-pull-through-login/action.yml

@@ -0,0 +1,97 @@
+name: "Log in to the ECR pull-through cache (OIDC)"
+description: >
+  Assumes the repo's OIDC role, logs Docker in to the ECR pull-through cache and
+  exports BASE_REGISTRY so the native JNI build (src/main/jni/build-jni-lib.sh)
+  pulls its base images from there instead of public.ecr.aws. Anonymous pulls
+  from shared GitHub-hosted runner IPs regularly hit public.ecr.aws's 429
+  "Data limit exceeded".
+
+  Pull requests from forks get neither secrets nor an OIDC token, so role-to-assume
+  arrives empty. The action then does nothing, BASE_REGISTRY stays unset, and the
+  build falls back to its public.ecr.aws default. The calling job needs
+  `permissions: id-token: write`.
+
+  The role's credentials and region are only given to the login step; nothing is
+  exported to the job environment, so later steps (make, mvn test, the docker
+  builds) never see them.
+
+inputs:
+  role-to-assume:
+    description: "ARN of the OIDC role allowed to pull through the cache. Empty skips the login."
+    required: false
+    default: ""
+  aws-region:
+    description: "Region of the pull-through cache."
+    required: false
+    default: ""
+  aws-account-id:
+    description: "Account that owns the pull-through cache."
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    - name: Skip ECR login when no role is available
+      if: inputs.role-to-assume == ''
+      shell: bash
+      run: echo "No ECR pull-through role (fork PR or unset secret); base images come from public.ecr.aws."
+
+    - name: Assume the ECR pull-through role
+      id: creds
+      if: inputs.role-to-assume != ''
+      continue-on-error: true
+      uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
+      with:
+        aws-region: ${{ inputs.aws-region }}
+        role-to-assume: ${{ inputs.role-to-assume }}
+        role-session-name: GitHubActionsEcrPullThrough
+        output-env-credentials: false
+        output-credentials: true
+
+    # BASE_REGISTRY is only exported once the login succeeds and both JNI base
+    # images resolve through the cache (the first pull of a tag needs
+    # BatchImportUpstreamImage). On any failure the build keeps the
+    # public.ecr.aws default rather than failing on the private registry.
+    - name: Log in and export BASE_REGISTRY
+      if: inputs.role-to-assume != '' && steps.creds.outcome == 'success'
+      shell: bash
+      env:
+        AWS_ACCESS_KEY_ID: ${{ steps.creds.outputs.aws-access-key-id }}
+        AWS_SECRET_ACCESS_KEY: ${{ steps.creds.outputs.aws-secret-access-key }}
+        AWS_SESSION_TOKEN: ${{ steps.creds.outputs.aws-session-token }}
+        AWS_REGION: ${{ inputs.aws-region }}
+        ECR_REGISTRY: ${{ inputs.aws-account-id }}.dkr.ecr.${{ inputs.aws-region }}.amazonaws.com
+      run: |
+        if ! password=$(aws ecr get-login-password --region "$AWS_REGION"); then
+          echo "::warning::ECR login failed; base images come from public.ecr.aws."
+          exit 0
+        fi
+        echo "::add-mask::$password"
+        if ! docker login --username AWS --password-stdin "$ECR_REGISTRY" <<< "$password"; then
+          echo "::warning::ECR login failed; base images come from public.ecr.aws."
+          exit 0
+        fi
+        # Same images as src/main/jni/Dockerfile.glibc and Dockerfile.musl, plus the
+        # CodeBuild agent (test/integration/codebuild-local/Dockerfile.agent) and the
+        # local-builds image test_one.sh runs it with (tagged per architecture).
+        if [ "$(uname -m)" = "aarch64" ]; then local_builds_tag=aarch64; else local_builds_tag=latest; fi
+        for image in amazonlinux/amazonlinux:2 docker/library/alpine:3 amazoncorretto/amazoncorretto:8 \
+            "codebuild/local-builds:$local_builds_tag"; do
+          if ! docker buildx imagetools inspect "$ECR_REGISTRY/ecr-public/$image" > /dev/null; then
+            echo "::warning::$image is not reachable through the ECR pull-through cache; base images come from public.ecr.aws."
+            exit 0
+          fi
+        done
+        # The integration tests run docker inside a CodeBuild local container, which
+        # doesn't see this runner's docker login. test_one.sh hands it this
+        # file so the container can log in itself.
+        password_file="$RUNNER_TEMP/ecr-pull-through-password"
+        (umask 077 && printf '%s' "$password" > "$password_file")
+        echo "ECR_PASSWORD_FILE=$password_file" >> "$GITHUB_ENV"
+        echo "BASE_REGISTRY=$ECR_REGISTRY/ecr-public" >> "$GITHUB_ENV"
+
+    - name: Warn on role assumption failure
+      if: inputs.role-to-assume != '' && steps.creds.outcome != 'success'
+      shell: bash
+      run: echo "::warning::Could not assume the ECR pull-through role; base images come from public.ecr.aws."

.github/workflows/runtime-interface-client_merge_to_main.yml

@@ -17,6 +17,7 @@ on:
     paths:
     - 'aws-lambda-java-runtime-interface-client/**'
     - '.github/workflows/runtime-interface-client_*.yml'
+    - '.github/actions/**'
 
 jobs:
 
@@ -47,7 +48,14 @@ jobs:
 
     - name: Available buildx platforms
       run: echo ${{ steps.buildx.outputs.platforms }}
-
+
+    - name: Log in to the ECR pull-through cache
+      uses: ./.github/actions/ecr-pull-through-login
+      with:
+        role-to-assume: ${{ secrets.AWS_ROLE_ECR_PULL_THROUGH }}
+        aws-region: ${{ vars.AWS_REGION_MAVEN_RELEASE }}
+        aws-account-id: ${{ secrets.AWS_ACCOUNT_ID }}
+
     - name: Build and install serialization dependency locally
       working-directory: ./aws-lambda-java-serialization
       run: mvn clean install
@@ -96,6 +104,7 @@ jobs:
   # codecov/project status on identical code.
   coverage:
     permissions:
+      id-token: write  # ECR pull-through login
       contents: read
     strategy:
       fail-fast: false
@@ -130,6 +139,13 @@ jobs:
       working-directory: ./aws-lambda-java-serialization
       run: mvn clean install
 
+    - name: Log in to the ECR pull-through cache
+      uses: ./.github/actions/ecr-pull-through-login
+      with:
+        role-to-assume: ${{ secrets.AWS_ROLE_ECR_PULL_THROUGH }}
+        aws-region: ${{ vars.AWS_REGION_MAVEN_RELEASE }}
+        aws-account-id: ${{ secrets.AWS_ACCOUNT_ID }}
+
     - name: Build Runtime Interface Client - Run 'build-${{ matrix.arch }}' target
       working-directory: ./aws-lambda-java-runtime-interface-client
       run: make build-${{ matrix.arch }}

.github/workflows/runtime-interface-client_pr.yml

@@ -16,6 +16,9 @@ permissions:
 jobs:
 
   smoke-test-arch:
+    permissions:
+      id-token: write  # ECR pull-through login; forks don't get a token
+      contents: read
     strategy:
       fail-fast: true
       matrix:
@@ -44,13 +47,23 @@ jobs:
       working-directory: ./aws-lambda-java-serialization
       run: mvn clean install
 
+    - name: Log in to the ECR pull-through cache
+      uses: ./.github/actions/ecr-pull-through-login
+      with:
+        role-to-assume: ${{ secrets.AWS_ROLE_ECR_PULL_THROUGH }}
+        aws-region: ${{ vars.AWS_REGION_MAVEN_RELEASE }}
+        aws-account-id: ${{ secrets.AWS_ACCOUNT_ID }}
+
     - name: Runtime Interface Client smoke tests - Run 'pr-${{ matrix.arch }}' target
       working-directory: ./aws-lambda-java-runtime-interface-client
       run: make pr-${{ matrix.arch }}
       env:
         IS_JAVA_8: true
 
   build-arch:
+    permissions:
+      id-token: write  # ECR pull-through login; forks don't get a token
+      contents: read
     strategy:
       fail-fast: true
       matrix:
@@ -84,6 +97,13 @@ jobs:
       working-directory: ./aws-lambda-java-serialization
       run: mvn clean install
 
+    - name: Log in to the ECR pull-through cache
+      uses: ./.github/actions/ecr-pull-through-login
+      with:
+        role-to-assume: ${{ secrets.AWS_ROLE_ECR_PULL_THROUGH }}
+        aws-region: ${{ vars.AWS_REGION_MAVEN_RELEASE }}
+        aws-account-id: ${{ secrets.AWS_ACCOUNT_ID }}
+
     - name: Test Runtime Interface Client build - Run 'build-${{ matrix.arch }}' target
       working-directory: ./aws-lambda-java-runtime-interface-client
       run: make build-${{ matrix.arch }}
@@ -107,12 +127,16 @@ jobs:
         CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
   integration-test-matrix:
+    permissions:
+      id-token: write  # ECR pull-through login; forks don't get a token
+      contents: read
     runs-on: ${{ matrix.arch.runner }}
     strategy:
       # Run every OS/arch combination to completion so one failure doesn't mask the others.
       fail-fast: false
-      # Every shard pulls its images anonymously from public.ecr.aws, and shards
-      # started together trip its rate limit (429), so cap how many run at once.
+      # Fork PRs get no OIDC token for the ECR pull-through cache, so their shards
+      # pull anonymously from public.ecr.aws, and shards started together trip
+      # its rate limit (429). Cap how many run at once.
       max-parallel: 4
       matrix:
         buildspec:
@@ -146,6 +170,13 @@ jobs:
       with:
         install: true
 
+    - name: Log in to the ECR pull-through cache
+      uses: ./.github/actions/ecr-pull-through-login
+      with:
+        role-to-assume: ${{ secrets.AWS_ROLE_ECR_PULL_THROUGH }}
+        aws-region: ${{ vars.AWS_REGION_MAVEN_RELEASE }}
+        aws-account-id: ${{ secrets.AWS_ACCOUNT_ID }}
+
     - name: Run OS integration test - 'test-integ' target
       working-directory: ./aws-lambda-java-runtime-interface-client
       run: make test-integ BUILDSPEC=test/integration/codebuild/${{ matrix.buildspec }}

aws-lambda-java-runtime-interface-client/Makefile

@@ -28,6 +28,7 @@ test:
 setup-codebuild-agent:
 	test/integration/codebuild-local/docker-retry.sh docker build --load -t codebuild-agent \
 	 --build-arg ARCHITECTURE=$(ARCHITECTURE_ALIAS) \
+	 --build-arg BASE_REGISTRY=$(or $(BASE_REGISTRY),public.ecr.aws) \
 	 -f test/integration/codebuild-local/Dockerfile.agent \
 	 test/integration/codebuild-local
 

aws-lambda-java-runtime-interface-client/test/integration/codebuild-local/Dockerfile.agent

@@ -1,5 +1,8 @@
-# syntax=docker/dockerfile:1.4
-FROM public.ecr.aws/amazoncorretto/amazoncorretto:8
+# No "# syntax=" directive: it would pull the frontend from Docker Hub, and the
+# built-in one already supports the heredoc below.
+# Set to the ECR pull-through cache by .github/actions/ecr-pull-through-login.
+ARG BASE_REGISTRY=public.ecr.aws
+FROM ${BASE_REGISTRY}/amazoncorretto/amazoncorretto:8
 
 # Install docker and buildx extension.
 # gnupg2 provides gpg/gpgv/gpg-agent so build-jni-lib.sh can GPG-verify the prebuilt assets.

aws-lambda-java-runtime-interface-client/test/integration/codebuild-local/test_one.sh

@@ -18,12 +18,15 @@ function usage {
     >&2 echo "  env                    Additional environment variables file."
 }
 
-# codebuild/local-builds images are not multi-architectural
+# codebuild/local-builds images are not multi-architectural.
+# BASE_REGISTRY points at the ECR pull-through cache when
+# .github/actions/ecr-pull-through-login has logged this runner in.
 function get_local_agent_image() {
+    local registry="${BASE_REGISTRY:-public.ecr.aws}"
     if [[ "$(arch)" == "aarch64" ]]; then
-        echo "public.ecr.aws/codebuild/local-builds:aarch64"
+        echo "$registry/codebuild/local-builds:aarch64"
     else
-        echo "public.ecr.aws/codebuild/local-builds:latest"
+        echo "$registry/codebuild/local-builds:latest"
     fi
 }
 
@@ -58,6 +61,16 @@ main() {
         echo "PLATFORM=$PLATFORM"
     }  >> "$ENVFILE"
 
+    # Set by .github/actions/ecr-pull-through-login. The build container has its
+    # own docker config, so it logs in to the pull-through cache with this token
+    # (see the install phase of the buildspecs).
+    if [ -n "${BASE_REGISTRY:-}" ] && [ -f "${ECR_PASSWORD_FILE:-}" ]; then
+        {
+            echo "BASE_REGISTRY=$BASE_REGISTRY"
+            echo "ECR_PASSWORD=$(cat "$ECR_PASSWORD_FILE")"
+        } >> "$ENVFILE"
+    fi
+
     ARTIFACTS_DIR="$CODEBUILD_TEMP_DIR/artifacts"
     mkdir -p "$ARTIFACTS_DIR"
 

aws-lambda-java-runtime-interface-client/test/integration/codebuild/buildspec.os.alpine.yml

@@ -25,14 +25,8 @@ batch:
 phases:
   install:
     commands:
-      - >
-        if [[ -z "${DOCKERHUB_USERNAME}" && -z "${DOCKERHUB_PASSWORD}" ]];
-        then
-            echo "DockerHub credentials not set as CodeBuild environment variables. Continuing without docker login."
-        else
-            echo "Performing DockerHub login . . ."
-            docker login -u $DOCKERHUB_USERNAME -p $DOCKERHUB_PASSWORD
-        fi
+      # Sourced, not run: it unsets BASE_REGISTRY here when the ECR login fails.
+      - . aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/docker_login.sh
       - aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/configure_multi_arch_env.sh
   pre_build:
     commands:
@@ -75,7 +69,8 @@ phases:
           -t "${IMAGE_TAG}" \
           --platform="${PLATFORM}" \
           --build-arg RUNTIME_VERSION="${RUNTIME_VERSION}" \
-          --build-arg DISTRO_VERSION="${DISTRO_VERSION}"
+          --build-arg DISTRO_VERSION="${DISTRO_VERSION}" \
+          --build-arg BASE_REGISTRY="${BASE_REGISTRY:-public.ecr.aws}"
   build:
     commands:
       - aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/run_invocation_test.sh

aws-lambda-java-runtime-interface-client/test/integration/codebuild/buildspec.os.amazoncorretto.yml

@@ -26,14 +26,8 @@ batch:
 phases:
   install:
     commands:
-      - >
-        if [[ -z "${DOCKERHUB_USERNAME}" && -z "${DOCKERHUB_PASSWORD}" ]];
-        then
-            echo "DockerHub credentials not set as CodeBuild environment variables. Continuing without docker login."
-        else
-            echo "Performing DockerHub login . . ."
-            docker login -u $DOCKERHUB_USERNAME -p $DOCKERHUB_PASSWORD
-        fi
+      # Sourced, not run: it unsets BASE_REGISTRY here when the ECR login fails.
+      - . aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/docker_login.sh
       - aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/configure_multi_arch_env.sh
   pre_build:
     commands:
@@ -73,7 +67,8 @@ phases:
           -t "${IMAGE_TAG}" \
           --platform="${PLATFORM}" \
           --build-arg RUNTIME_VERSION="${RUNTIME_VERSION}" \
-          --build-arg DISTRO_VERSION="${DISTRO_VERSION}"
+          --build-arg DISTRO_VERSION="${DISTRO_VERSION}" \
+          --build-arg BASE_REGISTRY="${BASE_REGISTRY:-public.ecr.aws}"
   build:
     commands:
       - aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/run_invocation_test.sh

aws-lambda-java-runtime-interface-client/test/integration/codebuild/buildspec.os.amazonlinux.1.yml

@@ -22,14 +22,8 @@ batch:
 phases:
   install:
     commands:
-      - >
-        if [[ -z "${DOCKERHUB_USERNAME}" && -z "${DOCKERHUB_PASSWORD}" ]];
-        then
-            echo "DockerHub credentials not set as CodeBuild environment variables. Continuing without docker login."
-        else
-            echo "Performing DockerHub login . . ."
-            docker login -u $DOCKERHUB_USERNAME -p $DOCKERHUB_PASSWORD
-        fi
+      # Sourced, not run: it unsets BASE_REGISTRY here when the ECR login fails.
+      - . aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/docker_login.sh
   pre_build:
     commands:
       # Log some environment variables for troubleshooting
@@ -59,7 +53,8 @@ phases:
           -f "${SCRATCH_DIR}/Dockerfile.function.${OS_DISTRIBUTION}.tmp" \
           -t "${IMAGE_TAG}" \
           --build-arg RUNTIME_VERSION="${RUNTIME_VERSION}" \
-          --build-arg DISTRO_VERSION="${DISTRO_VERSION}"
+          --build-arg DISTRO_VERSION="${DISTRO_VERSION}" \
+          --build-arg BASE_REGISTRY="${BASE_REGISTRY:-public.ecr.aws}"
   build:
     commands:
       - aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/run_invocation_test.sh

aws-lambda-java-runtime-interface-client/test/integration/codebuild/buildspec.os.amazonlinux.2.yml

@@ -25,14 +25,8 @@ batch:
 phases:
   install:
     commands:
-      - >
-        if [[ -z "${DOCKERHUB_USERNAME}" && -z "${DOCKERHUB_PASSWORD}" ]];
-        then
-            echo "DockerHub credentials not set as CodeBuild environment variables. Continuing without docker login."
-        else
-            echo "Performing DockerHub login . . ."
-            docker login -u $DOCKERHUB_USERNAME -p $DOCKERHUB_PASSWORD
-        fi
+      # Sourced, not run: it unsets BASE_REGISTRY here when the ECR login fails.
+      - . aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/docker_login.sh
       - aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/configure_multi_arch_env.sh
   pre_build:
     commands:
@@ -72,7 +66,8 @@ phases:
           -t "${IMAGE_TAG}" \
           --platform="${PLATFORM}" \
           --build-arg RUNTIME_VERSION="${RUNTIME_VERSION}" \
-          --build-arg DISTRO_VERSION="${DISTRO_VERSION}"
+          --build-arg DISTRO_VERSION="${DISTRO_VERSION}" \
+          --build-arg BASE_REGISTRY="${BASE_REGISTRY:-public.ecr.aws}"
   build:
     commands:
       - aws-lambda-java-runtime-interface-client/test/integration/codebuild/scripts/run_invocation_test.sh