From e34726a31a2cdc39f1a2102672fc1958480aedff Mon Sep 17 00:00:00 2001
From: Kakar13 <116319489+Kakar13@users.noreply.github.com>
Date: Sat, 8 Aug 2026 10:01:49 -0700
Subject: [PATCH] Surface MicroVM image build failures and pin a current gh
 package.

Enable CloudWatch logging on create/update-microvm-image, include list-microvm-image-builds stateReason when a version fails, and install gh-2.97.0-1 from the GitHub CLI yum repo.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 aws/microvm-agent/Dockerfile               |  2 +-
 cli/src/commands/infra.ts                  | 37 ++++++++++++++++++++--
 cli/templates/aws/microvm-agent/Dockerfile |  2 +-
 3 files changed, 36 insertions(+), 5 deletions(-)

diff --git a/aws/microvm-agent/Dockerfile b/aws/microvm-agent/Dockerfile
index 5a354d85..bafeca46 100644
--- a/aws/microvm-agent/Dockerfile
+++ b/aws/microvm-agent/Dockerfile
@@ -14,7 +14,7 @@ RUN dnf install -y \
 
 RUN curl -fsSL https://cli.github.com/packages/rpm/gh-cli.repo \
        -o /etc/yum.repos.d/gh-cli.repo \
-  && dnf install -y gh-2.96.0-1 \
+  && dnf install -y gh-2.97.0-1 \
   && dnf clean all \
   && gh --version
 
diff --git a/cli/src/commands/infra.ts b/cli/src/commands/infra.ts
index 19536271..57f7bca4 100644
--- a/cli/src/commands/infra.ts
+++ b/cli/src/commands/infra.ts
@@ -352,6 +352,35 @@ function getImageVersion(awsBin: string, region: string, imageArn: string, image
   ) as ImageVersionSummary;
 }
 
+function latestMicrovmImageBuildReason(
+  awsBin: string,
+  region: string,
+  imageArn: string,
+  imageVersion: string,
+): string | undefined {
+  try {
+    const parsed = JSON.parse(
+      capture(awsBin, [
+        "lambda-microvms",
+        "list-microvm-image-builds",
+        "--image-identifier",
+        imageArn,
+        "--image-version",
+        imageVersion,
+        "--region",
+        region,
+        "--output",
+        "json",
+        "--no-cli-pager",
+      ]),
+    ) as { items?: Array<{ stateReason?: string; buildState?: string }> };
+    const failed = (parsed.items ?? []).filter((item) => item.buildState === "FAILED" && item.stateReason?.trim());
+    return failed[0]?.stateReason?.trim() || undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 async function waitForImageVersion(
   awsBin: string,
   region: string,
@@ -369,9 +398,9 @@ async function waitForImageVersion(
     }
     if (version.state === "SUCCESSFUL" && version.status === "ACTIVE") return;
     if (version.state === "FAILED") {
-      throw new CliError(
-        `MicroVM image version ${imageVersion} failed${version.stateReason ? `: ${version.stateReason}` : ""}`,
-      );
+      const buildReason = latestMicrovmImageBuildReason(awsBin, region, imageArn, imageVersion);
+      const reason = buildReason || version.stateReason;
+      throw new CliError(`MicroVM image version ${imageVersion} failed${reason ? `: ${reason}` : ""}`);
     }
     if (["DELETING", "DELETED", "DELETE_FAILED"].includes(version.state)) {
       throw new CliError(`MicroVM image version ${imageVersion} entered unexpected state ${version.state}`);
@@ -484,6 +513,8 @@ async function buildAwsMicrovmImageLocked(
             baseImageArn,
             "--build-role-arn",
             buildRoleArn,
+            "--logging",
+            `cloudWatch={logGroup=/aws/lambda/microvms/${imageName}}`,
             "--client-token",
             `${digest}-${randomUUID()}`,
             "--region",
diff --git a/cli/templates/aws/microvm-agent/Dockerfile b/cli/templates/aws/microvm-agent/Dockerfile
index 5a354d85..bafeca46 100644
--- a/cli/templates/aws/microvm-agent/Dockerfile
+++ b/cli/templates/aws/microvm-agent/Dockerfile
@@ -14,7 +14,7 @@ RUN dnf install -y \
 
 RUN curl -fsSL https://cli.github.com/packages/rpm/gh-cli.repo \
        -o /etc/yum.repos.d/gh-cli.repo \
-  && dnf install -y gh-2.96.0-1 \
+  && dnf install -y gh-2.97.0-1 \
   && dnf clean all \
   && gh --version