ci(e2e): run E2E job on CodeBuild-hosted runner (POC)#1713
Merged
Conversation
Move the e2e job off ubuntu-latest onto our AWS CodeBuild-hosted GitHub Actions runner (project agentcore-e2e in the CI account, us-east-1). GitHub-hosted runner IPs rotate through shared pools whose reputation trips the service WAF, causing 403s before the request reaches service code; dedicated CodeBuild compute inside AWS avoids that and removes cross-org runner-pickup latency. E2E API calls also no longer cross the public internet. The authorize job stays on ubuntu-latest (cheap, no AWS calls). No change needed to the E2E IAM role: configure-aws-credentials still uses GitHub OIDC, which works unchanged from a CodeBuild runner. POC scope: this workflow only. Roll out to e2e-tests-full.yml and canary.yml after a bake period.
agentcore-devx-automation
Bot
added
the
claude-security-reviewing
github-actions
Bot
added
the
agentcore-harness-reviewing
Contributor
Package TarballHow to installgh release download pr-1713-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.23.0.tgz |
Contributor
|
Claude Security Review: no high-confidence findings. (run) |
agentcore-devx-automation
Bot
removed
the
claude-security-reviewing
agentcore-cli-automation
approved these changes
Jul 8, 2026
agentcore-cli-automation
left a comment
agentcore-cli-automation
left a comment
There was a problem hiding this comment.
LGTM. Small, well-scoped POC that only touches runs-on for the e2e job. The label format codebuild-<project>-${{ github.run_id }}-${{ github.run_attempt }} matches the AWS-documented format, and the matrix strategy is fine — CodeBuild spawns a separate build per queued job sharing the label.
Sanity-checked the steps against a typical CodeBuild-hosted runner image (Amazon Linux, not Ubuntu):
actions/setup-node@v6,astral-sh/setup-uv@v7,aws-actions/configure-aws-credentials@v6, andaws-actions/aws-secretsmanager-get-secrets@v3all work on Amazon Linux.git clone,npm ci,npm pack,npm install -g— all fine on the standard CodeBuild image.- The two tests run in the
runstep (strands-bedrock langgraph-bedrock) don't require local Docker. - OIDC via
configure-aws-credentialsworks from CodeBuild, so no IAM changes needed (confirmed in the PR description).
Known risks are already acknowledged in the description and appropriately scoped as follow-ups:
- PAT-based webhook auth pending migration to the AWS Connector GitHub App.
- Rollout limited to this one workflow so
e2e-tests-full.yml/canary.ymlstay on ubuntu-latest until this bakes.
Rollback is trivial (single-line revert). No blocking issues from me.
github-actions
Bot
removed
the
agentcore-harness-reviewing
aidandaly24
approved these changes
Jul 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves the e2e job off ubuntu-latest onto our AWS CodeBuild-hosted runner (project
agentcore-e2e, CI account, us-east-1) to fix WAF 403s from GitHub-hosted runner IPs and cut runner-pickup latency (E2E infra doc, Section 1).authorize job stays on ubuntu-latest. No E2E IAM changes — configure-aws-credentials still uses GitHub OIDC, which works from CodeBuild. POC scope: this workflow only; roll out to e2e-tests-full.yml + canary.yml after a bake.