[roger-zhangg]

Which issue(s) does this change fix?

aws/aws-sam-build-images#208

Why is this change necessary?

Build images for a release are published at the same time the release integration tests start, so container build tests run against the previous release's images. A broken build image (aws/aws-sam-build-images#208) passed the release tests this way.

How does it address the issue?

Adds a wait-for-build-images job that all integration test jobs depend on. For latest-release runs, tests/wait_for_build_images.py polls Public ECR every minute until each build image published for the previous release has a <version>-<arch> tag that latest-<arch> points to. It uses the existing Public ECR login password, which is now get_ecr_public_password() in tests/setup_testing_resources.py.

Test runs:

• install_mode=latest-release (waits): https://github.com/aws/aws-sam-cli/actions/runs/38653352841
• install_mode=nightly-release (wait job skipped): https://github.com/aws/aws-sam-cli/actions/runs/38653399676

What side effects does this change have?

Release integration tests start after the build images are published, or fail after 120 minutes if they aren't. Other triggers skip the wait job.

Mandatory Checklist

PRs will only be reviewed after checklist is complete

• Review the generative AI contribution guidelines
• Add input/output type hints to new functions/methods
• Write design document if needed (Do I need to write a design document?)
• Write/update unit tests
• Write/update integration tests
• Write/update functional tests if needed
• make pr passes
• make update-reproducible-reqs if dependencies were changed
• Write documentation

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.