Merge branch 'main' into msk-iam

.devcontainer/Dockerfile

@@ -2,6 +2,15 @@ FROM jsii/superchain:1-bookworm-slim-node20
 
 USER root
 
+# Setup oh-my-zsh
+RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
+    && apt-get -y install --no-install-recommends zsh vim \
+    && rm -rf /var/lib/apt/lists/* \
+    && chsh -s $(which zsh) superchain
+
+# Required, otherwise shell is extermly slow due the size of the aws-cdk
+RUN sh -c 'echo "[oh-my-zsh]\n        hide-dirty = 1" > /etc/gitconfig'
+
 # Change uid/guid of superchain so it can work with the docker-in-docker feature
 RUN groupmod --gid 1000 superchain \
     && usermod --uid 1000 --gid 1000 superchain \
@@ -10,10 +19,4 @@ RUN groupmod --gid 1000 superchain \
 USER superchain
 
 # Setup oh-my-zsh
-RUN sudo apt-get update && export DEBIAN_FRONTEND=noninteractive \
-    && sudo apt-get -y install --no-install-recommends zsh vim \
-    && sudo rm -rf /var/lib/apt/lists/* \
-    && sudo chsh -s $(which zsh) $(whoami)
-RUN sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)" "" --unattended \
-    # Required, otherwise shell is extermly slow due the size of the aws-cdk
-    && sudo sh -c 'echo "[oh-my-zsh]\n        hide-dirty = 1" > /etc/gitconfig'
+RUN sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)" "" --unattended

.devcontainer/devcontainer.json

@@ -3,17 +3,17 @@
   "build": {
     "dockerfile": "Dockerfile"
   },
-
   "customizations": {
     "vscode": {
-      "extensions": ["dbaeumer.vscode-eslint"]
+      "extensions": [
+        "dbaeumer.vscode-eslint"
+      ]
     }
   },
-
   "postCreateCommand": "yarn install",
   "remoteUser": "superchain",
   "features": {
-    "docker-in-docker": {
+    "ghcr.io/devcontainers/features/docker-in-docker:2": {
       "version": "latest",
       "moby": true
     }

.github/CODEOWNERS

@@ -0,0 +1,4 @@
+/packages/aws-cdk/ @aws/aws-cdk-core-team
+/packages/@aws-cdk-testing/cli-integ/ @aws/aws-cdk-core-team
+/packages/aws-cdk-lib/core/ @aws/aws-cdk-core-team
+/packages/@aws-cdk/cli-lib-alpha/ @aws/aws-cdk-core-team

.github/PULL_REQUEST_TEMPLATE.md

@@ -8,7 +8,16 @@ Closes #<issue number here>.
 
 ### Description of changes
 
-<!--What code changes did you make? Have you made any important design decisions?-->
+<!--
+What code changes did you make? 
+Have you made any important design decisions?
+What AWS use cases does this change enable? To enable the use cases, which AWS service features are utilized?
+-->
+
+### Describe any new or updated permissions being added
+
+<!— What new or updated IAM permissions are needed to support the changes being introduced ? -->
+
 
 ### Description of how you validated changes
 

.github/workflows/codecov.yml

@@ -0,0 +1,36 @@
+name: Codecov
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+
+jobs:
+  collect:
+    name: collect
+    if: github.repository == 'aws/aws-cdk'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+
+      - name: Install dependencies
+        run: yarn install
+
+      - name: Build CLI
+        run: npx lerna run build --scope=aws-cdk
+
+      - name: Run tests
+        run: cd packages/aws-cdk && yarn test
+
+      - name: Upload results to Codecov
+        uses: codecov/codecov-action@v4
+        with:
+          directory: packages/aws-cdk/coverage
+          fail_ci_if_error: true
+          flags: suite.unit
+          token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/github-merit-badger.yml

@@ -17,4 +17,4 @@ jobs:
           badges: '[beginning-contributor,repeat-contributor,valued-contributor,admired-contributor,star-contributor,distinguished-contributor]'
           thresholds: '[0,3,6,13,25,50]'
           badge-type: 'achievement'
-          ignore-usernames: '[rix0rrr,iliapolo,otaviomacedo,kaizencc,comcalvi,TheRealAmazonKendra,mrgrain,pahud,kellertk,ashishdhingra,HBobertz,sumupitchayan,colifran,khushail,moelasmar,paulhcsun,GavinZZ,aaythapa,xazhao,gracelu0,jfuss,shikha372,kirtishrinkhala,godwingrs22,bergjaak,IanKonlog,Leo10Gama,samson-keung,scorbiere,michelle-wangg,jiayiwang7,1kaileychen,aws-cdk-automation,dependabot[bot],mergify[bot]]'
+          ignore-usernames: '[rix0rrr,iliapolo,otaviomacedo,kaizencc,comcalvi,TheRealAmazonKendra,mrgrain,pahud,kellertk,ashishdhingra,HBobertz,sumupitchayan,colifran,khushail,moelasmar,paulhcsun,GavinZZ,aaythapa,xazhao,gracelu0,jfuss,shikha372,kirtishrinkhala,godwingrs22,bergjaak,IanKonlog,Leo10Gama,samson-keung,scorbiere,michelle-wangg,jiayiwang7,1kaileychen,saiyush,5d,aws-cdk-automation,dependabot[bot],mergify[bot]]'

.github/workflows/lambda-runtime-tests.yml

@@ -0,0 +1,47 @@
+name: Lambda Runtime Tests Update
+on:
+  pull_request:
+    paths:
+      - 'packages/aws-cdk-lib/aws-lambda/lib/runtime.ts'
+
+jobs:
+  update-lambda-tests:
+    if: github.repository == 'aws/aws-cdk'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.ref }}
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "*"
+        env:
+          NODE_OPTIONS: "--max-old-space-size=8196 --experimental-worker ${NODE_OPTIONS:-}"
+
+      - name: Install dependencies
+        run: yarn install --frozen-lockfile && cd tools/@aws-cdk/lambda-integration-test-updater && yarn build+test
+
+      - name: Update Lambda Runtime Tests
+        run: |
+          cd tools/@aws-cdk/lambda-integration-test-updater
+          ./bin/update-lambda-runtimestes-integ-testing
+
+      - name: Check for changes
+        id: git-check
+        run: |
+          if [[ -n "$(git status --porcelain)" ]]; then
+            echo "changes=true" >> $GITHUB_OUTPUT
+          else
+            echo "changes=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Commit & Push changes
+        if: steps.git-check.outputs.changes == 'true'
+        run: |
+          git config --global user.name 'aws-cdk-automation'
+          git config --global user.email '[email protected]'
+          git add .
+          git commit -m "chore: update lambda runtime integration tests"
+          git push origin ${{ github.event.pull_request.head.ref }}

.github/workflows/request-cli-integ-test.yml

@@ -19,7 +19,7 @@ jobs:
           persist-credentials: false
       - name: Find changed cli files
         id: changed-cli-files
-        uses: tj-actions/changed-files@c3a1bb2c992d77180ae65be6ae6c166cf40f857c
+        uses: tj-actions/changed-files@bab30c2299617f6615ec02a68b9a40d10bd21366
         with:
           base_sha: ${{ github.event.pull_request.base.sha }}
           files_yaml: |
@@ -54,7 +54,7 @@ jobs:
           git config --global user.email '[email protected]'
           git push --force --atomic https://github.com/${{ github.repository }}.git FETCH_HEAD:test-main-pipeline
       - name: Explain next steps
-        uses: thollander/actions-comment-pull-request@e2c37e53a7d2227b61585343765f73a9ca57eda9
+        uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b
         with:
           message: |
             :arrow_right: **PR build request submitted to `test-main-pipeline`** :arrow_left:

.mergify.yml

@@ -4,7 +4,17 @@ queue_rules:
     update_method: merge
     merge_method: merge
     conditions:
+      - -title~=(WIP|wip)
+      - -label~=(blocked|do-not-merge)
+      # Only if no-squash is set
+      - label~=no-squash
+      - -merged
+      - -closed
+      - "#approved-reviews-by>=1"
+      - -approved-reviews-by~=author
+      - "#changes-requested-reviews-by=0"
       - status-success~=AWS CodeBuild us-east-1
+      - status-success=validate-pr
     commit_message_template: |-
       {{ title }} (#{{ number }})
       {{ body }}
@@ -13,7 +23,16 @@ queue_rules:
     update_method: merge
     merge_method: squash
     conditions:
+      - base!=release
+      - -title~=(WIP|wip)
+      - -label~=(blocked|do-not-merge|no-squash)
+      - -merged
+      - -closed
+      - "#approved-reviews-by>=1"
+      - -approved-reviews-by~=author
+      - "#changes-requested-reviews-by=0"
       - status-success~=AWS CodeBuild us-east-1
+      - status-success=validate-pr
     commit_message_template: |-
       {{ title }} (#{{ number }})
       {{ body }}
@@ -24,7 +43,7 @@ pull_request_rules:
       label:
         add: [ contribution/core ]
     conditions:
-      - author~=^(rix0rrr|iliapolo|otaviomacedo|kaizencc|comcalvi|TheRealAmazonKendra|mrgrain|pahud|ashishdhingra|kellertk|HBobertz|sumupitchayan|colifran|moelasmar|paulhcsun|GavinZZ|aaythapa|xazhao|gracelu0|jfuss|shikha372|kirtishrinkhala|godwingrs22|bergjaak|samson-keung|IanKonlog|Leo10Gama|scorbiere|michelle-wangg|jiayiwang7|1kaileychen)$
+      - author~=^(rix0rrr|iliapolo|otaviomacedo|kaizencc|comcalvi|TheRealAmazonKendra|mrgrain|pahud|ashishdhingra|kellertk|HBobertz|sumupitchayan|colifran|moelasmar|paulhcsun|GavinZZ|aaythapa|xazhao|gracelu0|jfuss|shikha372|kirtishrinkhala|godwingrs22|bergjaak|samson-keung|IanKonlog|Leo10Gama|scorbiere|michelle-wangg|jiayiwang7|1kaileychen|saiyush|5d)$
       - -label~="contribution/core"
   - name: automatic merge
     actions: