Support AWS AgentCore Compute Provider

[justinschoeff]

Related issues

n/a

What changed?

This adds support for new AWS compute provider: AWS AgentCore. AgentCore
configuration is almost identitical to AWS Lambda, replacing function
ARN with Runtime Endpoint ARN.

Checklist

Stability

• Breaking changes are marked with 💥 in the PR title and release notes
• Changes to JSON output (-o json / -o jsonl) are treated as breaking changes

Design

• [✅] This feature does not depend on Cloud-only APIs or behavior (it works against an OSS server)
• [✅] New commands follow temporal <noun> <verb> structure (e.g. temporal workflow start)
• [✅] New flags are named after the API concept, not the implementation mechanism (good: --search-attribute, bad: --index-field)
• [ ❌] New flags don't duplicate an existing flag that serves the same purpose

  • Both lambda and agentcore utilize similar assume-role-external-id, assume-role-arn and the corresponding skip flag. However, we are scoping them to the compute provider in an effort to support multiple compute providers in the future, as WCI currently supports that, but we haven't exposed it yet.

• [✅] New flags do not have short aliases without strong justification
• [✅] Experimental features are marked with (Experimental) in commands.yaml

Help text (see style guide at the top of commands.yaml)

• [✅] All flags shown in help text and examples are implemented and functional
• [ ✅] Summaries use sentence case and have no trailing period
• [ ✅] Long descriptions end with a period and include at least one example invocation
• [ ✅] Examples use long flags (--namespace, not -n), one flag per line
• [ ✅] Placeholder values use YourXxx form (YourWorkflowId, YourNamespace)

Behavior

• [ ✅] Results go to stdout; errors and warnings go to stderr
• [ ✅] Error messages are lowercase with no trailing punctuation

Tests

• [✅] Added functional test(s) (SharedServerSuite)
• [✅] Added unit test(s) (func TestXxx) where applicable

Manual tests

setup

<jschoeff> eval `assume-sso team-compute-sandbox/AWSAdministratorAccess`
[i] If the browser does not open automatically, please open this link: https://temporal.awsapps.com/start/#/device?user_code=LLXQ-NPJW
[i] Awaiting AWS authentication in the browser
[i] You will be prompted to authenticate with AWS in the browser, then you will be prompted to 'Allow'
[i] Code: LLXQ-NPJW
[✔] Successfully logged into Start URL: https://temporal.awsapps.com/start


<jschoeff>   go build -o temporal ./cmd/temporal  
  ./temporal server start-dev \
    --dynamic-config-value workercontroller.enabled=true
Temporal CLI 0.0.0-DEV (Server 1.32.0-162.0, UI 2.53.1)

Happy Path

<jschoeff> ./temporal worker deployment create --name temporal-worker-agentcore
Successfully created worker deployment

<jschoeff> ./temporal worker deployment create-version  \
      --aws-agentcore-endpoint-arn arn:aws:bedrock-agentcore:us-east-1:093235337669:runtime/justinschoeff_temporal_worker_agentcore-DvGerTB5L8/runtime-endpoint/V5 \
      --aws-agentcore-assume-role-external-id schoeffExternalId \
      --aws-agentcore-role arn:aws:iam::093235337669:role/justinschoeff-temporal-worker-invoke \
      --build-id v5 \
      --deployment-name temporal-worker-agentcore
Successfully created worker deployment version

<jschoeff> ./temporal worker deployment set-current-version --deployment-name temporal-worker-agentcore --build-id v5
Worker Deployment Before Update:
  Name                          temporal-worker-agentcore
  CreateTime                    12 minutes ago
  CurrentVersionDeploymentName  temporal-worker-agentcore
  CurrentVersionBuildID         v5
  CurrentVersionChangedTime     11 minutes ago

Version Summaries:
       DeploymentName        BuildID  DrainageStatus    CreateTime
  temporal-worker-agentcore  v5       unspecified     12 minutes ago
Continue with set Current? y/N y
Successfully set the current worker deployment version


<jschoeff> ./temporal workflow start \               
--type sampleWorkflow \
--task-queue server-scaled-workers \
--input '"What can you do?"'
Running execution:
  WorkflowId  7f7e99b7-d645-42a3-8ca2-d713d1caafb1
  RunId       01a035d6-4cb9-73e0-b242-397ba3259475
  Type        sampleWorkflow
  Namespace   default
  TaskQueue   server-scaled-workers

<jschoeff> ./temporal workflow describe --workflow-id 7f7e99b7-d645-42a3-8ca2-d713d1caafb1                   
Execution Info:
  WorkflowId            7f7e99b7-d645-42a3-8ca2-d713d1caafb1
  RunId                 01a035d6-4cb9-73e0-b242-397ba3259475
  Type                  sampleWorkflow
  Namespace             default
  TaskQueue             server-scaled-workers
...
Versioning Info:

  Behavior        Pinned
  DeploymentName  temporal-worker-agentcore
  BuildId         v5

Results:
  RunTime         4.27s
  Status          COMPLETED
  Result          "go: Hello What can you do?"
  ResultEncoding  json/plain

Error case

<jschoeff> ./temporal worker deployment create-version  \  
      --aws-agentcore-endpoint-arn arn:aws:bedrock-agentcore:us-east-1:093235337669:runtime/justinschoeff_temporal_worker_agentcore-DvGerTB5L8/runtime-endpoint/V5 \
      --aws-agentcore-assume-role-external-id schoeffExternalId \

Error: required flag(s) "build-id", "deployment-name" not set
Usage:
...
Error: required flag(s) "build-id", "deployment-name" not set

<jschoeff> ./temporal worker deployment create-version  \     
      --aws-agentcore-assume-role-external-id schoeffExternalId \
      --aws-agentcore-assume-role-arn arn:aws:iam::093235337669:role/justinschoeff-temporal-worker-invoke \
      --build-id v5 \
      --deployment-name temporal-worker-agentcore
Error: missing configuration for compute provider

<jschoeff> ./temporal worker deployment create-version  \         
      --aws-agentcore-endpoint-arn arn:aws:iam::093235337669:role/justinschoeff-temporal-worker-invoke \
      --aws-agentcore-assume-role-arn arn:aws:iam::093235337669:role/justinschoeff-temporal-worker-invoke \
      --build-id v5 \
      --deployment-name temporal-worker-agentcore
Error: missing required AWS Agentcore provider detail: role_external_id

<jschoeff> ./temporal worker deployment create-version  \                                                                                                           ~/workplace/local-dev/cli
      --aws-agentcore-endpoint-arn arn:aws:iam::093235337669:role/justinschoeff-temporal-worker-invoke \
      --aws-agentcore-assume-role-external-id arn:aws:iam::093235337669:role/justinschoeff-temporal-worker-invoke \
      --build-id v5 \
      --deployment-name temporal-worker-agentcore
Error: missing required AWS Agentcore provider detail: role

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7b7c3c37f6

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Include the AgentCore skip flag in provider detection

When --aws-agentcore-skip-role-and-external-id is supplied without an AgentCore endpoint, this helper reports that no AgentCore arguments were provided. Consequently, combinations such as --remove --aws-agentcore-skip-role-and-external-id perform the removal instead of triggering the documented incompatibility check, while combining the flag with Lambda or Cloud Run silently ignores it rather than rejecting mixed providers. Include the boolean flag in this presence check so every explicitly supplied AgentCore option participates in validation.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c46046bf36

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Use AgentCore flags in the AgentCore update test

When this test is enabled after AgentCore fixtures become available, the update step uses Lambda flags and therefore switches the version from AgentCore to Lambda instead of exercising the new AgentCore update path. The test could pass while --aws-agentcore-* updates are broken; use the AgentCore endpoint and role flags here.

Useful? React with 👍 / 👎.