Tech debt: Operational Experience review

[heitorlessa]

Why is this needed?

There are a few areas left from v1 to v2 we couldn't optimize, namely for now are:

• Disable auto-merge workflow #2204
• Investigate use of OSSF Scorecard #2205
• Split release build job into quality checks and build #2206
• Remove allow list from untrusted workflows #2207
• Create changelog on a schedule #2208
• Replace changelog workflow trigger to manual dispatch #2209
• Create PRs from workflows (e.g., changelog, docs layer, docs) #2210
• Review Layer build mechanism #2211
• Investigate uploading additional release artifacts (e.g., provenance) #2212
• Review default GH Actions permissions scope vs workflow global vs workflow job scope #2213
• Add documentation at the top of workflows as complexity is growing
• Convert reusable workflows to composite actions
• Use format built-in function to use constants for hashing folders
• Create visual representation of release process as per @leandrodamascena ask

Which area does this relate to?

Other

Suggestion

No response

Acknowledgment

• This request meets Lambda Powertools Tenets
• Should this be considered in other Lambda Powertools languages? i.e. Java, TypeScript, and .NET

[heitorlessa]

Using variables with hashFiles() doesn't work as expected, hashes don't match due to string interpolation.

We've got two options here: 1/ Keep as-is, 2/ Create a hash script ourselves -- WDYT @leandrodamascena ?

[github-actions]

This is now released under 2.18.0 version!

[heitorlessa]

Still investigating how to satisfy three security alerts in a way that the scanner understands - it doesn't recognize the use of hashed dependencies and locks (e.g., package-lock.json).

ossf/scorecard#2518

[heitorlessa]

Another bug in scorecard that we're getting penalized at job level permission despite using least privileges: ossf/scorecard#3045

there's a PR in place: ossf/scorecard#3162

[heitorlessa]

No luck with continuous fuzzing - most examples are in C, not much in Python. Opened an issue for clarifications: google/clusterfuzzlite#128

The brightside is that it appears to integrate with Hypothesis for mutation testing, which we plan to move to anyway, making it easier to define targets for our large APIs.

[github-actions]

This is now released under 2.20.0 version!

[github-actions]

This is now released under 2.21.0 version!

[github-actions]

This is now released under 2.23.0 version!