Update from upstream - 2026-07-31 (aws#182)

Co-authored-by: lambda-tooling+rie <lambda-tooling+rie@amazon.com>

Author: aws-sam-tooling-bot[bot]

.github/workflows/check-binaries.yml

@@ -15,19 +15,19 @@ jobs:
       report_contents: ${{ steps.save-output.outputs.report_contents }}
     steps:
       - name: Setup python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.11'
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: main
       - name: Download latest release
-        uses: robinraju/release-downloader@v1.10
-        with:
-          latest: true
-          fileName: 'aws-lambda-rie*'
-          out-file-path: "bin"
+        run: |
+          mkdir -p bin
+          gh release download --pattern 'aws-lambda-rie*' --dir bin
+        env:
+          GH_TOKEN: ${{ github.token }}
       - name: Run check for vulnerabilities
         id: check-binaries
         run: |
@@ -61,25 +61,29 @@ jobs:
         name: Save outputs for the check with the latest build
         id: save-new-version
         run: |
-          if [ "${{ steps.check-new-version.outcome }}" == "failure" ]; then
+          if [ "${CHECK_OUTCOME}" == "failure" ]; then
             fixed="No"
           else
             fixed="Yes"
           fi
           echo "fixed=$fixed" >> "$GITHUB_OUTPUT"
+        env:
+          CHECK_OUTCOME: ${{ steps.check-new-version.outcome }}
       - if: always() && steps.save-output.outputs.report_contents
         name: Create GitHub Issue indicating vulnerabilities
         id: create-issue
-        uses: dacbd/create-issue-action@main
-        with:
-          token: ${{ github.token }}
-          title: |
-            CVEs found in latest RIE release
-          body: |
-            ###  CVEs found in latest RIE release
-            ```
-            ${{ steps.save-output.outputs.report_contents }}
-            ```
-            
-            #### Are these resolved by building with the latest patch version of Go (${{ steps.check-new-version.outputs.latest_version }})?:
-            > **${{ steps.save-new-version.outputs.fixed }}**
+        run: |
+          gh issue create \
+            --title "CVEs found in latest RIE release" \
+            --body "###  CVEs found in latest RIE release
+          \`\`\`
+          ${REPORT_CONTENTS}
+          \`\`\`
+
+          #### Are these resolved by building with the latest patch version of Go (${LATEST_VERSION})?:
+          > **${FIXED}**"
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPORT_CONTENTS: ${{ steps.save-output.outputs.report_contents }}
+          LATEST_VERSION: ${{ steps.check-new-version.outputs.latest_version }}
+          FIXED: ${{ steps.save-new-version.outputs.fixed }}

.github/workflows/integ-tests.yml

@@ -13,41 +13,33 @@ permissions:
 jobs:
   go-tests:
     runs-on: ubuntu-latest
-    environment:
-      name: integ-tests
     steps:
-        - uses: actions/checkout@v4
+        - uses: actions/checkout@v6
         - name: run go tests
           run: make tests-with-docker
   integ-tests-x86:
     runs-on: ubuntu-latest
-    environment:
-      name: integ-tests
     steps:
-        - uses: actions/checkout@v4
-        - uses: actions/setup-python@v5
+        - uses: actions/checkout@v6
+        - uses: actions/setup-python@v6
           with:
             python-version: '3.11'
         - name: run integration tests
           run: make integ-tests-with-docker-x86-64
   integ-tests-arm64:
     runs-on: ubuntu-latest
-    environment:
-      name: integ-tests
     steps:
-        - uses: actions/checkout@v4
-        - uses: actions/setup-python@v5
+        - uses: actions/checkout@v6
+        - uses: actions/setup-python@v6
           with:
             python-version: '3.11'
         - name: run integration tests
           run: make integ-tests-with-docker-arm64
   integ-tests-old:
     runs-on: ubuntu-latest
-    environment:
-      name: integ-tests
     steps:
-        - uses: actions/checkout@v4
-        - uses: actions/setup-python@v5
+        - uses: actions/checkout@v6
+        - uses: actions/setup-python@v6
           with:
             python-version: '3.11'
         - name: run integration tests

.github/workflows/release.yml

@@ -19,11 +19,11 @@ jobs:
     environment: Release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: main
       - name: Set up python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.11'
       - name: Build
@@ -33,12 +33,14 @@ jobs:
           make tests-with-docker
           make integ-tests
       - name: Release
-        uses: softprops/action-gh-release@v2
-        with:
-          name: Release ${{ github.event.inputs.releaseVersion }}
-          tag_name: v${{ github.event.inputs.releaseVersion }}
-          body: ${{ github.event.inputs.releaseBody }}
-          files: |
-            bin/aws-lambda-rie
-            bin/aws-lambda-rie-arm64
+        run: |
+          gh release create "v${RELEASE_VERSION}" \
+            --title "Release ${RELEASE_VERSION}" \
+            --notes "${RELEASE_BODY}" \
+            bin/aws-lambda-rie \
+            bin/aws-lambda-rie-arm64 \
             bin/aws-lambda-rie-x86_64
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_VERSION: ${{ github.event.inputs.releaseVersion }}
+          RELEASE_BODY: ${{ github.event.inputs.releaseBody }}

.gitignore

@@ -7,3 +7,4 @@ tags
 .idea
 .DS_Store
 .venv
+build.log

internal/lambda-managed-instances/aws-lambda-rie/internal/invoke/rie_invoke_request.go

@@ -40,6 +40,7 @@ type rieInvokeRequest struct {
 	cognitoIdentityPoolId      string
 	clientContext              string
 	responseMode               string
+	internalInvocationID       string
 
 	functionVersionID string
 }
@@ -98,6 +99,7 @@ func NewRieInvokeRequest(request *http.Request, writer http.ResponseWriter) (*ri
 		cognitoIdentityPoolId:      cognitoIdentityPoolId,
 		clientContext:              clientContext,
 		responseMode:               request.Header.Get(invoke.ResponseModeHeader),
+		internalInvocationID:       uuid.New().String(),
 	}
 
 	return req, nil
@@ -184,3 +186,7 @@ func (r *rieInvokeRequest) UpdateFromInitData(initData interop.InitStaticDataPro
 func (r *rieInvokeRequest) FunctionVersionID() string {
 	return r.functionVersionID
 }
+
+func (r *rieInvokeRequest) InternalInvocationID() string {
+	return r.internalInvocationID
+}

internal/lambda-managed-instances/aws-lambda-rie/internal/invoke/rie_invoke_request_test.go

@@ -143,6 +143,7 @@ func TestNewRieInvokeRequest(t *testing.T) {
 			if tt.want.invokeID == "" {
 				tt.want.invokeID = got.invokeID
 			}
+			tt.want.internalInvocationID = got.internalInvocationID
 
 			assert.Equal(t, tt.want, got)
 		})

internal/lambda-managed-instances/interop/mock_invoke_request.go

@@ -143,6 +143,23 @@ func (_m *MockInvokeRequest) FunctionVersionID() string {
 	return r0
 }
 
+func (_m *MockInvokeRequest) InternalInvocationID() string {
+	ret := _m.Called()
+
+	if len(ret) == 0 {
+		panic("no return value specified for InternalInvocationID")
+	}
+
+	var r0 string
+	if rf, ok := ret.Get(0).(func() string); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Get(0).(string)
+	}
+
+	return r0
+}
+
 func (_m *MockInvokeRequest) InvokeID() string {
 	ret := _m.Called()
 

internal/lambda-managed-instances/interop/sandbox_model.go

@@ -302,6 +302,8 @@ type InvokeRequest interface {
 
 	UpdateFromInitData(InitStaticDataProvider) model.AppError
 	FunctionVersionID() string
+
+	InternalInvocationID() string
 }
 
 type InitStaticDataProvider interface {

internal/lambda-managed-instances/invoke/consts.go

@@ -9,6 +9,8 @@ const (
 	FunctionErrorBodyTrailer = "lambda-runtime-function-error-body"
 	ResponseModeHeader       = "invoke-response-mode"
 	TraceIdHeader            = "x-amzn-trace-id"
+
+	RuntimeInvocationIdHeader = "lambda-runtime-invocation-id"
 )
 
 type InvokeBodyResponseStatus string

internal/lambda-managed-instances/invoke/invoke_router.go

@@ -35,6 +35,8 @@ type RuntimeResponseRequest interface {
 	BodyReader() io.Reader
 
 	TrailerError() ErrorForInvoker
+
+	InvocationID() string
 }
 
 type RuntimeErrorRequest interface {
@@ -47,6 +49,8 @@ type RuntimeErrorRequest interface {
 	ReturnCode() int
 	ErrorDetails() string
 	GetXrayErrorCause() json.RawMessage
+
+	InvocationID() string
 }
 
 type runningInvoke interface {