Integrate upstream changes from develop (#135)

Brings the fork up to aws/aws-lambda-runtime-interface-emulator@3ccddd7
(Update from upstream - 2026-09-17), covering four upstream syncs:

  3ccddd7 Update from upstream - 2026-09-17 (aws#189)
  c622c06 Update from upstream - 2026-08-25 (aws#187)
  ddf2bc4 Update from upstream - 2026-07-31 (aws#182)
  a0f264a chore: sync from internal (rie-private-to-public) (aws#181)

The fork had been on develop@391c3f1 since April, and a0f264a is why this
matters now: it makes raptor.Server.Shutdown drain in-flight responses via
httpServer.Shutdown instead of calling httpServer.Close(), which severed
connections whose handler was still writing. That race is what failed the
weekly release twice -- as `Post ...: EOF` in TestRie_InvokeFatalError, and as
a 10m package timeout in TestRie_InvokeWaitingForInitError, where the invoke
goroutine's require.NoError skipped its un-deferred wg.Done() and deadlocked
the package. Both tests are green on this merge: 0 failures in 40 runs of the
package under -race, against 10/10 hangs before it.

Conflicts, all in files we customize:

  go.mod                Kept our go 1.27.1 directive over upstream's 1.26.6.
  Makefile              Kept our GO_VERSION derived from go.mod, and the
                        nojsonv2 GOEXPERIMENT export.
  check-binaries.yml    Took upstream's switch from robinraju/release-downloader
  release.yml           to `gh release download`, and from softprops/action-gh-release
                        to `gh release create`; kept our Renovate action bumps
                        (checkout/setup-python v7). release.yml's trailing
                        context had already moved to upstream's shape, so
                        keeping ours there would not have parsed.
  integ-tests.yml       Version bumps only; kept ours.

Note for the next integration: the previous one (#92) landed as a single
squashed commit, so its upstream parent was lost and git computed the merge
base as the Go 1.24 bump from 2025 -- 48 conflicts, 36 of them spurious
add/add on files that were already identical. This was resolved against the
true base (391c3f1) using a local `git replace --graft`, giving the 5 real
conflicts above. Merging this one with --ff, per README-LOCALSTACK step 7,
records the upstream parent and stops the next integration needing that.

Author: carole-lavillonniere

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,33 @@
+<!--
+Thank you for taking the time to send this.
+
+Please read this first: this repository is generated from an internal AWS source of truth, so we
+cannot merge pull requests into it directly. We still want your proposal. Yours will be read and
+treated as a reference for the change you are describing, and if we adopt your solution we make the
+corresponding change internally and credit you in the release notes for the version that ships it.
+
+If what you want is a behaviour change rather than a specific patch, an issue describing your use
+case is more effective than a pull request. See CONTRIBUTING.md.
+-->
+
+#### What does this change do?
+
+
+#### Why is it needed? What is the use case?
+
+
+#### How did you test it?
+
+<!-- Local tests pass through `make integ-tests-and-compile`. -->
+
+
+#### Checklist
+
+- [ ] I have read [CONTRIBUTING.md](../CONTRIBUTING.md) and understand this pull request will be used
+      as a reference rather than merged directly
+- [ ] I opened an issue first if this is a significant change
+- [ ] This change is limited to the behaviour described above, with no unrelated reformatting
+- [ ] Local tests pass through `make integ-tests-and-compile`
+
+By submitting this pull request, I confirm that my contribution is made under the terms of the
+[Apache 2.0 license](https://www.apache.org/licenses/LICENSE-2.0).

.github/workflows/check-binaries.yml

@@ -23,11 +23,11 @@ jobs:
         with:
           ref: main
       - name: Download latest release
-        uses: robinraju/release-downloader@v1.13
-        with:
-          latest: true
-          fileName: 'aws-lambda-rie*'
-          out-file-path: "bin"
+        run: |
+          mkdir -p bin
+          gh release download --pattern 'aws-lambda-rie*' --dir bin
+        env:
+          GH_TOKEN: ${{ github.token }}
       - name: Run check for vulnerabilities
         id: check-binaries
         run: |
@@ -61,25 +61,29 @@ jobs:
         name: Save outputs for the check with the latest build
         id: save-new-version
         run: |
-          if [ "${{ steps.check-new-version.outcome }}" == "failure" ]; then
+          if [ "${CHECK_OUTCOME}" == "failure" ]; then
             fixed="No"
           else
             fixed="Yes"
           fi
           echo "fixed=$fixed" >> "$GITHUB_OUTPUT"
+        env:
+          CHECK_OUTCOME: ${{ steps.check-new-version.outcome }}
       - if: always() && steps.save-output.outputs.report_contents
         name: Create GitHub Issue indicating vulnerabilities
         id: create-issue
-        uses: dacbd/create-issue-action@main
-        with:
-          token: ${{ github.token }}
-          title: |
-            CVEs found in latest RIE release
-          body: |
-            ###  CVEs found in latest RIE release
-            ```
-            ${{ steps.save-output.outputs.report_contents }}
-            ```
-            
-            #### Are these resolved by building with the latest patch version of Go (${{ steps.check-new-version.outputs.latest_version }})?:
-            > **${{ steps.save-new-version.outputs.fixed }}**
+        run: |
+          gh issue create \
+            --title "CVEs found in latest RIE release" \
+            --body "###  CVEs found in latest RIE release
+          \`\`\`
+          ${REPORT_CONTENTS}
+          \`\`\`
+
+          #### Are these resolved by building with the latest patch version of Go (${LATEST_VERSION})?:
+          > **${FIXED}**"
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPORT_CONTENTS: ${{ steps.save-output.outputs.report_contents }}
+          LATEST_VERSION: ${{ steps.check-new-version.outputs.latest_version }}
+          FIXED: ${{ steps.save-new-version.outputs.fixed }}

.github/workflows/integ-tests.yml

@@ -8,16 +8,12 @@ name: Run Integration Tests
 jobs:
   go-tests:
     runs-on: ubuntu-latest
-    environment:
-      name: integ-tests
     steps:
         - uses: actions/checkout@v7
         - name: run go tests
           run: make tests-with-docker
   integ-tests-x86:
     runs-on: ubuntu-latest
-    environment:
-      name: integ-tests
     steps:
         - uses: actions/checkout@v7
         - uses: actions/setup-python@v7
@@ -27,8 +23,6 @@ jobs:
           run: make integ-tests-with-docker-x86-64
   integ-tests-arm64:
     runs-on: ubuntu-latest
-    environment:
-      name: integ-tests
     steps:
         - uses: actions/checkout@v7
         - uses: actions/setup-python@v7
@@ -38,8 +32,6 @@ jobs:
           run: make integ-tests-with-docker-arm64
   integ-tests-old:
     runs-on: ubuntu-latest
-    environment:
-      name: integ-tests
     steps:
         - uses: actions/checkout@v7
         - uses: actions/setup-python@v7

.github/workflows/release.yml

@@ -33,12 +33,14 @@ jobs:
           make tests-with-docker
           make integ-tests
       - name: Release
-        uses: softprops/action-gh-release@v3
-        with:
-          name: Release ${{ github.event.inputs.releaseVersion }}
-          tag_name: v${{ github.event.inputs.releaseVersion }}
-          body: ${{ github.event.inputs.releaseBody }}
-          files: |
-            bin/aws-lambda-rie
-            bin/aws-lambda-rie-arm64
+        run: |
+          gh release create "v${RELEASE_VERSION}" \
+            --title "Release ${RELEASE_VERSION}" \
+            --notes "${RELEASE_BODY}" \
+            bin/aws-lambda-rie \
+            bin/aws-lambda-rie-arm64 \
             bin/aws-lambda-rie-x86_64
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_VERSION: ${{ github.event.inputs.releaseVersion }}
+          RELEASE_BODY: ${{ github.event.inputs.releaseBody }}

.github/workflows/validate-branch-into-main.yaml

@@ -10,8 +10,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check source branch
+        env:
+          SOURCE_BRANCH: ${{ github.head_ref }}
         run: |
-          SOURCE_BRANCH="${{ github.head_ref }}"
           if [[ "$SOURCE_BRANCH" != "develop" ]]; then
             echo "Error: Only pull requests from develop branch are allowed into main"
             echo "Current source branch ($SOURCE_BRANCH)."

.gitignore

@@ -9,3 +9,4 @@ tags
 .idea
 .DS_Store
 .venv
+build.log

CONTRIBUTING.md

@@ -6,10 +6,17 @@ documentation, we greatly value feedback and contributions from our community.
 Please read through this document before submitting any issues or pull requests to ensure we have all the necessary
 information to effectively respond to your bug report or contribution.
 
+**Please note:** this repository is generated from an internal AWS source of truth, which means we are unable to merge
+pull requests into it directly. We very much still want your input -- see
+[How we handle contributions](#how-we-handle-contributions) for what happens to an issue or pull request you open, and
+how you get credit for a change we adopt.
+
 
 ## Reporting Bugs/Feature Requests
 
-We welcome you to use the GitHub issue tracker to report bugs or suggest features.
+We welcome you to use the GitHub issue tracker to report bugs or suggest features. Issues are the most effective way to
+reach us: a feature request that describes your use case can be picked up and implemented, whereas a pull request cannot
+be merged as-is.
 
 When filing an issue, please check existing open, or recently closed, issues to make sure somebody else hasn't already
 reported the issue. Please try to include as much information as you can. Details like these are incredibly useful:
@@ -20,25 +27,34 @@ reported the issue. Please try to include as much information as you can. Detail
 * Anything unusual about your environment or deployment
 
 
-## Contributing via Pull Requests
-This repository contains the source code and examples for the Runtime Interface Emulator. We will accept pull requests on documentation, examples, bug fixes and the Dockerfiles. We will also accept pull requests, issues and feedback on improvements to the Runtime Interface Emulator. However, our priority will be to maintain fidelity with AWS Lambda’s Runtime Interface on the cloud. 
+## How we handle contributions
+
+This repository contains the source code and examples for the Runtime Interface Emulator. The code here is generated from
+an internal AWS repository, which is the source of truth, and changes flow outward from there. Because of that we cannot
+merge a pull request into this repository, even one we agree with.
 
-Contributions via pull requests are much appreciated. Before sending us a pull request, please ensure that:
+That does not mean we don't want it. Here is what each kind of contribution gets you:
 
-1. You are working against the latest source on the *main* branch.
-2. You check existing open, and recently merged, pull requests to make sure someone else hasn't addressed the problem already.
-3. You open an issue to discuss any significant work - we would hate for your time to be wasted.
+* **Feature requests and bug reports are welcome, and are the most useful thing you can send us.** Open an issue
+  describing the behaviour you want and the use case behind it. Our priority is maintaining fidelity with AWS Lambda's
+  Runtime Interface in the cloud, so a clear use case is what lets us weigh a change against that.
+* **Pull requests are welcome as a reference.** We read them, and a working patch is often the clearest way to explain a
+  proposal. It will not be merged directly. If we adopt your solution, we make the corresponding change in the internal
+  repository, and it reaches this repository through the next sync.
+* **If we adopt your change, we credit you in the release notes** for the version that ships it.
 
-To send us a pull request, please:
+So that we can act on a pull request, please:
 
-1. Fork the repository.
-2. Modify the source; please focus on the specific change you are contributing. If you also reformat all the code, it will be hard for us to focus on your change.
-3. Ensure local tests pass through `make integ-tests-and-compile`
-4. Commit to your fork using clear commit messages.
-5. Send us a pull request, answering any default questions in the pull request interface.
+1. Open an issue first to discuss any significant work -- we would hate for your time to be wasted on something we
+   cannot take.
+2. Work against the latest source on the *main* branch.
+3. Check existing open, and recently closed, pull requests and issues to make sure someone else hasn't raised it already.
+4. Focus on the specific change you are proposing. If you also reformat all the code, it will be hard for us to see what
+   you are actually suggesting.
+5. Ensure local tests pass through `make integ-tests-and-compile`.
 6. Pay attention to any automated CI failures reported in the pull request, and stay involved in the conversation.
 
-GitHub provides additional document on [forking a repository](https://help.github.com/articles/fork-a-repo/) and
+GitHub provides additional documentation on [forking a repository](https://help.github.com/articles/fork-a-repo/) and
 [creating a pull request](https://help.github.com/articles/creating-a-pull-request/).
 
 
@@ -58,4 +74,5 @@ If you discover a potential security issue in this project we ask that you notif
 
 ## Licensing
 
-See the [LICENSE](LICENSE) file for our project's licensing. We will ask you to confirm the licensing of your contribution.
+See the [LICENSE](LICENSE) file for our project's licensing. We will ask you to confirm the licensing of your
+contribution, including for a pull request we adopt rather than merge.

README.md

@@ -25,6 +25,7 @@ Lambda’s orchestrator, or security and authentication configurations. You can
     * [To test an image without adding RIE to the image](#to-test-an-image-without-adding-rie-to-the-image)
 * [How to configure](#how-to-configure)
 * [Level of support](#level-of-support)
+* [Contributing](#contributing)
 * [Security](#security)
 * [License](#license)
 
@@ -187,6 +188,18 @@ configurations that will not be emulated by this component.
 * The component does _not_ support X-ray and other Lambda integrations locally.
 * The component supports only Linux, for x86-64 and arm64 architectures.
 
+## Contributing
+
+We welcome feature requests and bug reports through the GitHub issue tracker, and they are the most effective way to
+reach us.
+
+This repository is generated from an internal AWS source of truth, so we are unable to merge pull requests into it
+directly. You are still welcome to open one: we read them, and a working patch is often the clearest way to explain a
+proposal. It is treated as a reference rather than something we merge, and if we adopt your solution we make the change
+in the internal repository and credit you in the release notes for the version that ships it.
+
+See [CONTRIBUTING](CONTRIBUTING.md) for details.
+
 ## Security
 
 See [CONTRIBUTING](CONTRIBUTING.md#security-issue-notifications) for more information.

internal/lambda-managed-instances/aws-lambda-rie/internal/app_test.go

@@ -79,7 +79,7 @@ func TestApp_ServeHTTP(t *testing.T) {
 			defer mockApp.AssertExpectations(t)
 			mockApp.On("Init", mock.Anything, mock.Anything, mock.Anything).Return(tt.initResponse)
 			if tt.initResponse == nil {
-				mockApp.On("Invoke", mock.Anything, mock.Anything, mock.Anything).Return(tt.invokeErr, tt.responseSent)
+				mockApp.On("Invoke", mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return(tt.invokeErr, tt.responseSent, false)
 			}
 
 			initMsg := intmodel.InitRequestMessage{

internal/lambda-managed-instances/aws-lambda-rie/internal/invoke/rie_invoke_request.go

@@ -40,6 +40,7 @@ type rieInvokeRequest struct {
 	cognitoIdentityPoolId      string
 	clientContext              string
 	responseMode               string
+	internalInvocationID       string
 
 	functionVersionID string
 }
@@ -98,6 +99,7 @@ func NewRieInvokeRequest(request *http.Request, writer http.ResponseWriter) (*ri
 		cognitoIdentityPoolId:      cognitoIdentityPoolId,
 		clientContext:              clientContext,
 		responseMode:               request.Header.Get(invoke.ResponseModeHeader),
+		internalInvocationID:       uuid.New().String(),
 	}
 
 	return req, nil
@@ -184,3 +186,7 @@ func (r *rieInvokeRequest) UpdateFromInitData(initData interop.InitStaticDataPro
 func (r *rieInvokeRequest) FunctionVersionID() string {
 	return r.functionVersionID
 }
+
+func (r *rieInvokeRequest) InternalInvocationID() string {
+	return r.internalInvocationID
+}