feat: load AWS conformance models from api-models-aws (#1121)

scripts/README.md

@@ -41,6 +41,7 @@ Both ship to `/usr/local/share/spinifex/` on every node, so they are available o
 | `test-ddil-phase1.sh` | systemd-level smoke test for daemon-local-autonomy tier 1. Destructive on the local node: stops and starts `spinifex-nats` and restarts `spinifex-daemon`, restoring both via a cleanup trap. |
 | `check-coverage.sh` | Fails the build if total Go coverage falls below the minimum threshold, excluding packages exempt from the requirement. |
 | `diff-coverage.sh` | Coverage check scoped to changed lines only, against an auto-detected base ref (`HEAD~1` on main, `origin/main` on dev, otherwise `origin/dev`). |
+| `sync-aws-models.sh` | Replaces the embedded AWS Smithy models under `internal/awsmodel/models/` with the ten service files from `aws/api-models-aws` at the given commit, and records that commit in `internal/awsmodel/model_source.go`. Takes a full 40-character SHA. |
 | `run-bench.sh` | Launches a benchmark against running Ubuntu instances, auto-detecting the AMI for the host architecture. Tracks nbdkit and perf alongside the run. |
 | `disk-performance.sh` | Runs a `fio` random 70/30 read-write benchmark swept across 4k/16k/128k/1M. Writes JSON results to `/tmp/spinifex-disk-bench`; override with `BENCH_DIR`, `OUT_DIR`, `SIZE`, `JOBS`, `BLOCK_SIZES`. |
 | `network-performance.sh` | iperf throughput from several clients to one server, driven over SSH, writing a `summary.txt` of Gbit/s per client. `--server-ip` sets the address clients dial, so pointing it at instance private addresses measures the VPC overlay rather than the external pool. |

scripts/sync-aws-models.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Download the AWS Smithy service models used by internal/awsmodel from
+# github.com/aws/api-models-aws at one pinned commit, gzip them into
+# internal/awsmodel/models/ and record the commit in model_source.go.
+# Usage: scripts/sync-aws-models.sh <commit-sha>
+
+COMMIT="${1:?Usage: sync-aws-models.sh <commit-sha>}"
+if [[ ! "$COMMIT" =~ ^[0-9a-f]{40}$ ]]; then
+    echo "ERROR: commit must be a full 40-character SHA, got '$COMMIT'" >&2
+    exit 1
+fi
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+PKG="$ROOT/internal/awsmodel"
+OUT="$PKG/models"
+REPO="https://github.com/aws/api-models-aws.git"
+
+# <api-models-aws sdk-id>/<api version>
+MODELS=(
+    acm/2015-12-08
+    ec2/2016-11-15
+    ecr/2015-09-21
+    ecs/2014-11-13
+    eks/2017-11-01
+    elastic-load-balancing-v2/2015-12-01
+    iam/2010-05-08
+    rds/2014-10-31
+    s3/2006-03-01
+    sts/2011-06-15
+)
+
+TMP="$(mktemp -d)"
+trap 'rm -rf "$TMP"' EXIT
+
+# A blobless shallow fetch pulls only the ten files read below.
+git -C "$TMP" init --quiet repo
+git -C "$TMP/repo" fetch --quiet --depth=1 --filter=blob:none "$REPO" "$COMMIT"
+COMMITTED="$(git -C "$TMP/repo" log -1 --format=%cs "$COMMIT")"
+
+for entry in "${MODELS[@]}"; do
+    sdk_id="${entry%%/*}"
+    version="${entry##*/}"
+    file="$sdk_id-$version.json"
+    echo "fetching $sdk_id $version"
+    git -C "$TMP/repo" show "$COMMIT:models/$sdk_id/service/$version/$file" > "$TMP/$file"
+    # -n omits the name and timestamp so re-running at one commit is a no-op.
+    gzip -n -9 --stdout "$TMP/$file" > "$TMP/$file.gz"
+done
+
+mkdir -p "$OUT"
+rm -f "$OUT"/*.json.gz
+mv "$TMP"/*.json.gz "$OUT"/
+
+cat > "$PKG/model_source.go" <<EOF
+// Code generated by scripts/sync-aws-models.sh. DO NOT EDIT.
+
+package awsmodel
+
+// ModelCommit is the github.com/aws/api-models-aws commit the embedded
+// models were taken from, and ModelCommitDate the day it was committed.
+const (
+	ModelCommit     = "$COMMIT"
+	ModelCommitDate = "$COMMITTED"
+)
+EOF
+
+echo "wrote ${#MODELS[@]} models at $COMMIT ($COMMITTED) to $OUT"