ddapm-test-agent 1.32.0__tar.gz → 1.33.0__tar.gz

{ddapm_test_agent-1.32.0 → ddapm_test_agent-1.33.0}/.github/workflows/docker.yml

@@ -11,14 +11,14 @@ jobs:
       packages: write
     if: github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/')
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
     - name: Set up QEMU
-      uses: docker/setup-qemu-action@v2
+      uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 # v2.2.0
 
     - name: Set up Docker Buildx
       id: buildx
-      uses: docker/setup-buildx-action@v2
+      uses: docker/setup-buildx-action@885d1462b80bc1c1c7f0b00334ad271f09369c55 # v2.10.0
 
     - name: Available platforms
       run: echo ${{ steps.buildx.outputs.platforms }}
@@ -41,7 +41,7 @@ jobs:
       run: docker login -u publisher -p ${{ secrets.GITHUB_TOKEN }} ghcr.io
 
     - name: Docker Build
-      uses: docker/build-push-action@v3
+      uses: docker/build-push-action@1104d471370f9806843c095c1db02b5a90c5f8b6 # v3.3.1
       with:
         push: true
         tags: ${{ steps.set_names.outputs.image_name }}
@@ -54,7 +54,7 @@ jobs:
       packages: write
     if: github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/')
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
     - name: Set Docker Image Tag
       id: set_names

{ddapm_test_agent-1.32.0 → ddapm_test_agent-1.33.0}/.github/workflows/main.yml

@@ -8,10 +8,10 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
         with:
           python-version: '3.13'
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 0
       - run: pip install .[testing]
@@ -25,8 +25,8 @@ jobs:
         python-version: ["3.8", "3.13"]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
         with:
           python-version: ${{ matrix.python-version }}
       - name: install deps
@@ -36,7 +36,7 @@ jobs:
   cassettes-size:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
       - name: Check VCR cassettes size
         run: |
           CASSETTES_SIZE=$(du -sb vcr-cassettes/ 2>/dev/null | cut -f1 || echo "0")

{ddapm_test_agent-1.32.0 → ddapm_test_agent-1.33.0}/.github/workflows/nix-auto.yml

@@ -13,8 +13,8 @@ jobs:
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: cachix/install-nix-action@v27
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27.0.0
       - id: set-matrix
         name: Generate Nix Matrix
         run: |
@@ -28,6 +28,6 @@ jobs:
     strategy:
       matrix: ${{fromJSON(needs.nix-matrix.outputs.matrix)}}
     steps:
-      - uses: actions/checkout@v4
-      - uses: cachix/install-nix-action@v27
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27.0.0
       - run: nix build -L '.#githubActions.checks.${{ matrix.attr }}'

{ddapm_test_agent-1.32.0 → ddapm_test_agent-1.33.0}/.github/workflows/publish_pypi.yml

@@ -12,12 +12,12 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         # Include all history and tags
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         name: Install Python
         with:
           python-version: '3.12'
@@ -27,7 +27,7 @@ jobs:
           pip install wheel
           pip wheel --no-deps -w dist .
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: wheel
           path: dist/*.whl
@@ -36,12 +36,12 @@ jobs:
     name: Build source distribution
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         # Include all history and tags
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         name: Install Python
         with:
           python-version: '3.12'
@@ -51,7 +51,7 @@ jobs:
           python -m pip install --upgrade setuptools
           python setup.py sdist
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: sdist
           path: dist/*.tar.gz
@@ -61,17 +61,17 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'release' && github.event.action == 'published'
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: sdist
           path: dist
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: wheel
           path: dist
 
-      - uses: pypa/gh-action-pypi-publish@release/v1
+      - uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4
         with:
           user: __token__
           password: ${{ secrets.PYPI_TOKEN }}

{ddapm_test_agent-1.32.0 → ddapm_test_agent-1.33.0}/.github/workflows/releasenote.yml

@@ -12,7 +12,7 @@ jobs:
     name: Validate release notes
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         # Include all history and tags
         with:
           fetch-depth: 0
@@ -25,7 +25,7 @@ jobs:
         if: github.event_name == 'pull_request'
         run: releasenotes/check-releasenotes
 
-      - uses: actions/setup-python@v2
+      - uses: actions/setup-python@e9aba2c848f5ebd159c070c61ea2c4e2b122355e # v2.3.4
         name: Install Python
         with:
           python-version: '3.12'

{ddapm_test_agent-1.32.0 → ddapm_test_agent-1.33.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ddapm-test-agent
-Version: 1.32.0
+Version: 1.33.0
 Summary: Test agent for Datadog APM client libraries
 Home-page: https://github.com/Datadog/dd-apm-test-agent
 Author: Kyle Verhoog
@@ -24,6 +24,7 @@ Requires-Dist: requests
 Requires-Dist: typing_extensions
 Requires-Dist: yarl
 Requires-Dist: vcrpy
+Requires-Dist: requests-aws4auth
 Requires-Dist: opentelemetry-proto<1.37.0,>1.33.0
 Requires-Dist: protobuf>=3.19.0
 Requires-Dist: grpcio<2.0,>=1.66.2
@@ -192,6 +193,13 @@ The cassettes are matched based on the path, method, and body of the request. To
 
 Optionally specifying whatever mounted path is used for the cassettes directory. The test agent comes with a default set of cassettes for OpenAI, Azure OpenAI, and DeepSeek.
 
+#### AWS Services
+AWS service proxying, specifically recording cassettes for the first time, requires a `AWS_SECRET_ACCESS_KEY` environment variable to be set for the container running the test agent. This is used to recalculate the AWS signature for the request, as the one generated client-side likely used `{test-agent-host}:{test-agent-port}/vcr/{aws-service}` as the host, and the signature will mismatch that on the actual AWS service.
+
+Additionally, the `AWS_REGION` environment variable can be set, defaulting to `us-east-1`.
+
+To add a new AWS service to proxy, add an entry in the `PROVIDER_BASE_URLS` for its provider url, and an entry in the `AWS_SERVICES` dictionary for the service name, since they are not always a one-to-one mapping with the implied provider url (e.g, `https://bedrock-runtime.{AWS_REGION}.amazonaws.com` is the provider url, but the service name is `bedrock`, as `bedrock` also has multiple sub services, like `converse`).
+
 #### Usage in clients
 
 To use this feature in your client, you can use the `/vcr/{provider}` endpoint to proxy requests to the provider API.

{ddapm_test_agent-1.32.0 → ddapm_test_agent-1.33.0}/README.md

@@ -146,6 +146,13 @@ The cassettes are matched based on the path, method, and body of the request. To
 
 Optionally specifying whatever mounted path is used for the cassettes directory. The test agent comes with a default set of cassettes for OpenAI, Azure OpenAI, and DeepSeek.
 
+#### AWS Services
+AWS service proxying, specifically recording cassettes for the first time, requires a `AWS_SECRET_ACCESS_KEY` environment variable to be set for the container running the test agent. This is used to recalculate the AWS signature for the request, as the one generated client-side likely used `{test-agent-host}:{test-agent-port}/vcr/{aws-service}` as the host, and the signature will mismatch that on the actual AWS service.
+
+Additionally, the `AWS_REGION` environment variable can be set, defaulting to `us-east-1`.
+
+To add a new AWS service to proxy, add an entry in the `PROVIDER_BASE_URLS` for its provider url, and an entry in the `AWS_SERVICES` dictionary for the service name, since they are not always a one-to-one mapping with the implied provider url (e.g, `https://bedrock-runtime.{AWS_REGION}.amazonaws.com` is the provider url, but the service name is `bedrock`, as `bedrock` also has multiple sub services, like `converse`).
+
 #### Usage in clients
 
 To use this feature in your client, you can use the `/vcr/{provider}` endpoint to proxy requests to the provider API.

{ddapm_test_agent-1.32.0 → ddapm_test_agent-1.33.0}/ddapm_test_agent/vcr_proxy.py

@@ -1,21 +1,38 @@
 import hashlib
 import json
+import logging
 import os
 import re
+from typing import Any
+from typing import Dict
 from typing import Optional
 from urllib.parse import urljoin
 
 from aiohttp.web import Request
 from aiohttp.web import Response
 import requests
+from requests_aws4auth import AWS4Auth
 import vcr
 
 
+logger = logging.getLogger(__name__)
+
+
+#  Used for AWS signature recalculation for aws services initial proxying
+AWS_REGION = os.environ.get("AWS_REGION", "us-east-1")
+AWS_SECRET_ACCESS_KEY = os.environ.get("AWS_SECRET_ACCESS_KEY")
+
+
 def url_path_join(base_url: str, path: str) -> str:
     """Join a base URL with a path, handling slashes automatically."""
     return urljoin(base_url.rstrip("/") + "/", path.lstrip("/"))
 
 
+AWS_SERVICES = {
+    "bedrock-runtime": "bedrock",
+}
+
+
 PROVIDER_BASE_URLS = {
     "openai": "https://api.openai.com/v1",
     "azure-openai": "https://dd.openai.azure.com/",
@@ -23,8 +40,25 @@ PROVIDER_BASE_URLS = {
     "anthropic": "https://api.anthropic.com/",
     "datadog": "https://api.datadoghq.com/",
     "genai": "https://generativelanguage.googleapis.com/",
+    "bedrock-runtime": f"https://bedrock-runtime.{AWS_REGION}.amazonaws.com",
 }
 
+CASSETTE_FILTER_HEADERS = [
+    "authorization",
+    "OpenAI-Organization",
+    "api-key",
+    "x-api-key",
+    "dd-api-key",
+    "dd-application-key",
+    "x-goog-api-key",
+    "x-amz-security-token",
+    "x-amz-content-sha256",
+    "x-amz-date",
+    "x-amz-user-agent",
+    "amz-sdk-invocation-id",
+    "amz-sdk-request",
+]
+
 NORMALIZERS = [
     (
         r"--form-data-boundary-[^\r\n]+",
@@ -65,6 +99,21 @@ def normalize_multipart_body(body: bytes) -> str:
             return f"[binary_data_{hex_digest}]"
 
 
+def parse_authorization_header(auth_header: str) -> Dict[str, str]:
+    """Parse AWS Authorization header to extract components"""
+    if not auth_header.startswith("AWS4-HMAC-SHA256 "):
+        return {}
+
+    auth_parts = auth_header[len("AWS4-HMAC-SHA256 ") :].split(",")
+    parsed = {}
+
+    for part in auth_parts:
+        key, value = part.split("=", 1)
+        parsed[key.strip()] = value.strip()
+
+    return parsed
+
+
 def get_vcr(subdirectory: str, vcr_cassettes_directory: str) -> vcr.VCR:
     cassette_dir = os.path.join(vcr_cassettes_directory, subdirectory)
 
@@ -72,15 +121,7 @@ def get_vcr(subdirectory: str, vcr_cassettes_directory: str) -> vcr.VCR:
         cassette_library_dir=cassette_dir,
         record_mode="once",
         match_on=["path", "method"],
-        filter_headers=[
-            "authorization",
-            "OpenAI-Organization",
-            "api-key",
-            "x-api-key",
-            "dd-api-key",
-            "dd-application-key",
-            "x-goog-api-key",
-        ],
+        filter_headers=CASSETTE_FILTER_HEADERS,
     )
 
 
@@ -125,31 +166,47 @@ async def proxy_request(request: Request, vcr_cassettes_directory: str) -> Respo
     body_bytes = await request.read()
 
     vcr_cassette_prefix = request.pop("vcr_cassette_prefix", None)
-
     cassette_name = generate_cassette_name(path, request.method, body_bytes, vcr_cassette_prefix)
+
+    request_kwargs: Dict[str, Any] = {
+        "method": request.method,
+        "url": target_url,
+        "headers": headers,
+        "data": body_bytes,
+        "cookies": dict(request.cookies),
+        "allow_redirects": False,
+        "stream": True,
+    }
+
+    if provider in AWS_SERVICES and not os.path.exists(os.path.join(vcr_cassettes_directory, provider, cassette_name)):
+        if not AWS_SECRET_ACCESS_KEY:
+            return Response(
+                body="AWS_SECRET_ACCESS_KEY environment variable not set for aws signature recalculation",
+                status=400,
+            )
+
+        auth_header = request.headers.get("Authorization", "")
+        auth_parts = parse_authorization_header(auth_header)
+        aws_access_key = auth_parts.get("Credential", "").split("/")[0]
+
+        auth = AWS4Auth(aws_access_key, AWS_SECRET_ACCESS_KEY, AWS_REGION, AWS_SERVICES[provider])
+        request_kwargs["auth"] = auth
+
     with get_vcr(provider, vcr_cassettes_directory).use_cassette(f"{cassette_name}.yaml"):
-        oai_response = requests.request(
-            method=request.method,
-            url=target_url,
-            headers=headers,
-            data=body_bytes,
-            cookies=dict(request.cookies),
-            allow_redirects=False,
-            stream=True,
-        )
+        provider_response = requests.request(**request_kwargs)
 
     # Extract content type without charset
-    content_type = oai_response.headers.get("content-type", "")
+    content_type = provider_response.headers.get("content-type", "")
     if ";" in content_type:
         content_type = content_type.split(";")[0].strip()
 
     response = Response(
-        body=oai_response.content,
-        status=oai_response.status_code,
+        body=provider_response.content,
+        status=provider_response.status_code,
         content_type=content_type,
     )
 
-    for key, value in oai_response.headers.items():
+    for key, value in provider_response.headers.items():
         if key.lower() not in (
             "content-length",
             "transfer-encoding",

{ddapm_test_agent-1.32.0 → ddapm_test_agent-1.33.0}/ddapm_test_agent.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ddapm-test-agent
-Version: 1.32.0
+Version: 1.33.0
 Summary: Test agent for Datadog APM client libraries
 Home-page: https://github.com/Datadog/dd-apm-test-agent
 Author: Kyle Verhoog
@@ -24,6 +24,7 @@ Requires-Dist: requests
 Requires-Dist: typing_extensions
 Requires-Dist: yarl
 Requires-Dist: vcrpy
+Requires-Dist: requests-aws4auth
 Requires-Dist: opentelemetry-proto<1.37.0,>1.33.0
 Requires-Dist: protobuf>=3.19.0
 Requires-Dist: grpcio<2.0,>=1.66.2
@@ -192,6 +193,13 @@ The cassettes are matched based on the path, method, and body of the request. To
 
 Optionally specifying whatever mounted path is used for the cassettes directory. The test agent comes with a default set of cassettes for OpenAI, Azure OpenAI, and DeepSeek.
 
+#### AWS Services
+AWS service proxying, specifically recording cassettes for the first time, requires a `AWS_SECRET_ACCESS_KEY` environment variable to be set for the container running the test agent. This is used to recalculate the AWS signature for the request, as the one generated client-side likely used `{test-agent-host}:{test-agent-port}/vcr/{aws-service}` as the host, and the signature will mismatch that on the actual AWS service.
+
+Additionally, the `AWS_REGION` environment variable can be set, defaulting to `us-east-1`.
+
+To add a new AWS service to proxy, add an entry in the `PROVIDER_BASE_URLS` for its provider url, and an entry in the `AWS_SERVICES` dictionary for the service name, since they are not always a one-to-one mapping with the implied provider url (e.g, `https://bedrock-runtime.{AWS_REGION}.amazonaws.com` is the provider url, but the service name is `bedrock`, as `bedrock` also has multiple sub services, like `converse`).
+
 #### Usage in clients
 
 To use this feature in your client, you can use the `/vcr/{provider}` endpoint to proxy requests to the provider API.

{ddapm_test_agent-1.32.0 → ddapm_test_agent-1.33.0}/ddapm_test_agent.egg-info/SOURCES.txt

@@ -153,6 +153,7 @@ releasenotes/notes/uds-container-8138f8b1438b1a0a.yaml
 releasenotes/notes/uds-permissions-903266ac6445b873.yaml
 releasenotes/notes/v0.5-traces-cf469b0b71398d97.yaml
 releasenotes/notes/v0.7-traces-7ea3ebbed7502d01.yaml
+releasenotes/notes/vcr-aws-bedrock-proxy-3bf018b1712d5105.yaml
 releasenotes/notes/vcr-cassette-name-middleware-fix-9e47c395892a9fe7.yaml
 releasenotes/notes/vcr-cassettes-for-openai-v5-6e9d78091de1f0c2.yaml
 releasenotes/notes/vcr-cassettes-for-vercel-ai-7a8275f9c2b48bc7.yaml

{ddapm_test_agent-1.32.0 → ddapm_test_agent-1.33.0}/ddapm_test_agent.egg-info/requires.txt

@@ -5,6 +5,7 @@ requests
 typing_extensions
 yarl
 vcrpy
+requests-aws4auth
 opentelemetry-proto<1.37.0,>1.33.0
 protobuf>=3.19.0
 grpcio<2.0,>=1.66.2

{ddapm_test_agent-1.32.0 → ddapm_test_agent-1.33.0}/flake.nix

@@ -58,6 +58,7 @@
               requests
               yarl
               vcrpy
+              requests-aws4auth
               protobuf
               opentelemetry-proto
               grpcio

ddapm_test_agent-1.33.0/releasenotes/notes/vcr-aws-bedrock-proxy-3bf018b1712d5105.yaml

@@ -0,0 +1,4 @@
+---
+features:
+  - |
+    vcr: adds support for proxying aws bedrock runtime. to record cassettes for the first time, the `AWS_SECRET_ACCESS_KEY` environment variable must be set for the container running the test agent, for request signature recalculation. Additionally, `AWS_REGION` can be set, defaulting to `us-east-1`.

{ddapm_test_agent-1.32.0 → ddapm_test_agent-1.33.0}/setup.py

@@ -37,6 +37,7 @@ setup(
         "typing_extensions",
         "yarl",
         "vcrpy",
+        "requests-aws4auth",
         # ddtrace libraries officially support opentelemetry-proto 1.33.1
         # which implements the v1.7.0 spec
         "opentelemetry-proto>1.33.0,<1.37.0",