ci: add gate, preflight and verification to testing image release

.github/scripts/is_newest_testing_version.py

@@ -0,0 +1,48 @@
+#!/usr/bin/env python3
+# SPDX-FileCopyrightText: 2025-present Amazon.com, Inc. or its affiliates.
+#
+# SPDX-License-Identifier: Apache-2.0
+from __future__ import annotations
+
+import argparse
+import sys
+
+from packaging.version import InvalidVersion, Version
+
+
+def is_newest(candidate: str, existing_tags: list[str]) -> bool:
+    """True if candidate is >= every v<semver> tag in existing_tags.
+
+    Non-version tags (latest, malformed) are ignored. With no existing
+    version tags the candidate is newest by default.
+    """
+    candidate_version = Version(candidate)
+    highest = candidate_version
+    for tag in existing_tags:
+        if not tag.startswith("v"):
+            continue
+        try:
+            version = Version(tag[1:])
+        except InvalidVersion:
+            continue
+        if version > highest:
+            highest = version
+    return candidate_version >= highest
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(
+        description="Decide whether a release version is the newest published."
+    )
+    parser.add_argument("--candidate", required=True)
+    parser.add_argument(
+        "tags", nargs="*", help="Existing image tags, e.g. v1.2.1 v2.0.0 latest"
+    )
+    args = parser.parse_args(argv)
+
+    print("true" if is_newest(args.candidate, args.tags) else "false")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

.github/scripts/parse_testing_version.py

@@ -0,0 +1,38 @@
+#!/usr/bin/env python3
+# SPDX-FileCopyrightText: 2025-present Amazon.com, Inc. or its affiliates.
+#
+# SPDX-License-Identifier: Apache-2.0
+from __future__ import annotations
+
+import os
+import re
+
+# A release-tag component naming the testing package: testing-v<x.y.z> with an
+# optional pre-release suffix. Anchored and matched against a single comma-split
+# component so prefixes like "mytesting-v1.2.1" are rejected.
+_COMPONENT = re.compile(r"testing-v([0-9]+\.[0-9]+\.[0-9]+[0-9A-Za-z.-]*)\Z")
+
+
+def parse_testing_version(release_tag: str) -> str:
+    """Return the testing version named by the release tag, or empty if none."""
+    for part in release_tag.split(","):
+        match = _COMPONENT.fullmatch(part.strip())
+        if match:
+            return match.group(1)
+    return ""
+
+
+def main():
+    release_tag = os.environ.get("RELEASE_TAG", "")
+    tag_version = parse_testing_version(release_tag)
+
+    github_output = os.environ.get("GITHUB_OUTPUT")
+    if github_output:
+        with open(github_output, "a", encoding="utf-8") as f:
+            f.write(f"tag_version={tag_version}\n")
+
+    print(tag_version)
+
+
+if __name__ == "__main__":
+    main()

.github/scripts/tests/test_is_newest_testing_version.py

@@ -0,0 +1,42 @@
+#!/usr/bin/env python3
+# SPDX-FileCopyrightText: 2025-present Amazon.com, Inc. or its affiliates.
+#
+# SPDX-License-Identifier: Apache-2.0
+import os
+import sys
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(__file__)))
+
+from is_newest_testing_version import is_newest
+
+
+def test_is_newest():
+    test_cases = [
+        # Newest so far
+        ("2.0.0", ["v1.2.1", "v1.1.3", "latest"], True),
+        # First ever release
+        ("1.0.0", [], True),
+        ("1.0.0", ["latest"], True),
+        # Equal to the highest counts as newest (idempotent re-publish)
+        ("2.0.0", ["v2.0.0", "latest"], True),
+        # Backport below the highest is NOT newest
+        ("1.1.3", ["v1.2.1", "v2.0.0", "latest"], False),
+        ("1.9.9", ["v2.0.0"], False),
+        # Malformed and non-version tags are ignored
+        ("2.0.1", ["v2.0.0", "notaversion", "latest", "v"], True),
+        # Pre-release ordering
+        ("2.0.0", ["v2.0.0rc1"], True),
+        ("2.0.0rc1", ["v2.0.0"], False),
+    ]
+
+    for candidate, tags, expected in test_cases:
+        result = is_newest(candidate, tags)
+        # Assert is expected in test functions
+        assert result == expected, (  # noqa: S101
+            f"Expected {expected} but got {result} for {candidate} against {tags}"
+        )
+
+
+if __name__ == "__main__":
+    test_is_newest()
+    sys.exit(0)

.github/scripts/tests/test_parse_testing_version.py

@@ -0,0 +1,48 @@
+#!/usr/bin/env python3
+
+import os
+import sys
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(__file__)))
+
+from parse_testing_version import parse_testing_version
+
+
+def test_parse_testing_version():
+    test_cases = [
+        # Testing-only tag enables the job
+        ("testing-v2.0.0", "2.0.0"),
+        ("testing-v1.2.1", "1.2.1"),
+        # Combined comma-separated tags resolve to the testing version
+        ("sdk-v2.0.0,testing-v2.0.0", "2.0.0"),
+        ("testing-v2.0.0,sdk-v2.1.0", "2.0.0"),
+        ("otel-v1.0.0,testing-v1.2.1,sdk-v2.0.0", "1.2.1"),
+        # SDK-only or OTel-only tags do not enable the job
+        ("sdk-v2.1.0", ""),
+        ("otel-v1.0.0", ""),
+        ("sdk-v2.0.0,otel-v1.0.0", ""),
+        # Malformed or unrelated prefixes must not match
+        ("not-testing-v1.2.1", ""),
+        ("sdk-v2.0.0,mytesting-v1.2.1", ""),
+        ("testing-v1.2", ""),
+        ("testing-version-1.2.1", ""),
+        # No release tag
+        ("", ""),
+        ("v2.0.0", ""),
+        ("random-text", ""),
+        # Pre-release suffix is kept
+        ("testing-v2.0.0rc1", "2.0.0rc1"),
+        ("testing-v2.0.0-beta,sdk-v1.0.0", "2.0.0-beta"),
+    ]
+
+    for input_text, expected in test_cases:
+        result = parse_testing_version(input_text)
+        # Assert is expected in test functions
+        assert result == expected, (  # noqa: S101
+            f"Expected '{expected}' but got '{result}' for input: {input_text}"
+        )
+
+
+if __name__ == "__main__":
+    test_parse_testing_version()
+    sys.exit(0)