Merge branch 'develop' into fix-8148

Author: roger-zhangg

.github/dependabot.yml

@@ -13,7 +13,7 @@ updates:
     open-pull-requests-limit: 10
 
   - package-ecosystem: "pip"
-    directory: "/requirements"
+    directory: "/"
     schedule:
       interval: "daily"
     target-branch: "develop"
@@ -26,14 +26,13 @@ updates:
     groups:
       boto:
         patterns:
-        - "boto3"
+        - "boto3[crt]"
         - "boto3-stubs*"
-        - "botocore"
+        - "botocore[crt]"
         - "botocore-stubs"
         - "mypy-boto3-*"
-      types:
-        patterns:
-        - "types-*"
+        - "types-awscrt"
+        - "types-s3transfer"
       pytest:
         patterns:
         - "pytest-*"
@@ -42,13 +41,78 @@ updates:
         # as of writing this
         - "pytest-metadata"
         - "pytest-json-report"
+      cookiecutter:
+        patterns:
+        - "cookiecutter"
+        - "arrow"
+        - "binaryornot"
+        - "chardet"
+        - "python-slugify"
+        - "text-unidecode"
+      flask:
+        patterns:
+        - "flask"
+        - "blinker"
+        - "werkzeug"
+        - "itsdangerous"
+      cfn-lint:
+        patterns:
+        - "cfn-lint"
+        - "networkx"
+        - "sympy"
+        - "mpmath"
+        - "jsonpatch"
+        - "jsonpointer"
+      cryptography:
+        patterns:
+        - "cryptography"
+        - "pyopenssl"
+        - "cffi"
+        - "pycparser"
+      requests:
+        patterns:
+        - "requests"
+        - "certifi"
+        - "charset-normalizer"
+        - "idna"
+        - "urllib3"
+      rich:
+        patterns:
+        - "rich"
+        - "markdown-it-py"
+        - "mdurl"
+        - "pygments"
+      jsonschema:
+        patterns:
+        - "jsonschema"
+        - "jsonschema-specifications"
+        - "referencing"
+        - "attrs"
+        - "rpds-py"
+      pydantic:
+        patterns:
+        - "pydantic"
+        - "pydantic-core"
+        - "annotated-types"
+        - "typing-inspection"
+      jinja2:
+        patterns:
+        - "jinja2"
+        - "markupsafe"
+      pyyaml:
+        patterns:
+        - "pyyaml"
+        - "ruamel-yaml"
     ignore:
       # Ignored intentionally since we have a GHA that updates to more
       # completely
       - dependency-name: "aws-sam-translator"
       # Ignored intentionally since we have a GHA that updates to more
       # completely
       - dependency-name: "aws_lambda_builders"
+      # Ignored intentionally since watchdog v5+ breaks sync watch
+      # file change detection; pinned to 4.0.2
+      - dependency-name: "watchdog"
       # The dependencies are intentionally pinned to certain
       # version ranges for specific Python versions
       - dependency-name: "flake8"

.github/workflows/ai-code-review.yml

@@ -0,0 +1,29 @@
+name: AI Code Review
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  review:
+    runs-on: ubuntu-latest
+    steps:
+      # Checkout base branch (trusted) — workspace files are never from the fork
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      # Fetch PR head commit so git diff works, but don't checkout fork files
+      - name: Fetch PR head
+        run: git fetch origin "$PR_HEAD_SHA"
+        env:
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+
+      - uses: roger-zhangg/sam-pr-reviewer@793976165e969a6ccb6ace13d35811c02471f471 # v1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          kiro_api_key: ${{ secrets.KIRO_API_KEY }}

.github/workflows/automated-updates-to-sam-cli.yml

@@ -97,7 +97,7 @@ jobs:
           python-version: "3.11"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
 
       - name: Update aws-sam-translator & commit
         run: |
@@ -108,12 +108,12 @@ jobs:
           echo "SAM-T cur version is $SAM_T_CUR_VERSION"
           cd ../aws-sam-cli
           git checkout -b update_sam_transform_version
-          SAM_T_PRE_VERSION=$(grep "aws-sam-translator=" requirements/base.txt)
+          SAM_T_PRE_VERSION=$(grep -oP 'aws-sam-translator==\K[0-9.]+' pyproject.toml)
           echo "SAM-T pre version is $SAM_T_PRE_VERSION"
           git reset --hard develop
-          sed -i "s/$SAM_T_PRE_VERSION/aws-sam-translator==$SAM_T_CUR_VERSION/g" requirements/base.txt
+          sed -i "s/aws-sam-translator==$SAM_T_PRE_VERSION/aws-sam-translator==$SAM_T_CUR_VERSION/g" pyproject.toml
           cp -r ../serverless-application-model/tests/translator/input ./tests/functional/commands/validate/lib/models
-          make update-reproducible-reqs-uv
+          make update-reproducible-reqs
           git status
           git diff --quiet && exit 0 # exit if there is no change
           echo "is_new_sam_t=1" >> $GITHUB_ENV # set env variable for next step run decision
@@ -166,7 +166,7 @@ jobs:
           python-version: "3.11"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
 
       - name: Upgrade aws_lambda_builders & commit
         run: |
@@ -177,11 +177,11 @@ jobs:
           echo "Lambda Builders cur version is $BUILDERS_CUR_VERSION"
           cd ../aws-sam-cli
           git checkout -b update_lambda_builders_version
-          BUILDERS_PRE_VERSION=$(grep "aws_lambda_builders=" requirements/base.txt)
+          BUILDERS_PRE_VERSION=$(grep -oP 'aws_lambda_builders==\K[0-9.]+' pyproject.toml)
           echo "Lambda Builders pre version is $BUILDERS_PRE_VERSION"
           git reset --hard develop
-          sed -i "s/$BUILDERS_PRE_VERSION/aws_lambda_builders==$BUILDERS_CUR_VERSION/g" requirements/base.txt
-          make update-reproducible-reqs-uv
+          sed -i "s/aws_lambda_builders==$BUILDERS_PRE_VERSION/aws_lambda_builders==$BUILDERS_CUR_VERSION/g" pyproject.toml
+          make update-reproducible-reqs
           git status
           git diff --quiet && exit 0 # exit if there is no change
           echo "is_new_lambda_builders=1" >> $GITHUB_ENV # set env variable for next step run decision

.github/workflows/build.yml

@@ -55,7 +55,7 @@ jobs:
           - ubuntu-latest
           - windows-latest
         python:
-          - "3.9"
+          - "3.10"
           - "3.11"
     steps:
     # This allows temp file creation on drive D, which won't trigger windows defender scan and leads to faster IO
@@ -65,26 +65,30 @@ jobs:
         echo "TEMP=D:\\Temp" >> $env:GITHUB_ENV  
       if: ${{ matrix.os == 'windows-latest' }}
     - uses: actions/checkout@v6
-    - uses: actions/setup-python@v6
+    - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
       with:
         python-version: ${{ matrix.python }}
-    - uses: astral-sh/setup-uv@v7
+        cache-python: false
+    - name: Install and activate Python
+      run: bash tests/setup-python-uv.sh ${{ matrix.python }}
+      shell: bash
     - run: test -f "./.github/ISSUE_TEMPLATE/Bug_report.md"  # prevent Bug_report.md from being renamed or deleted
     - run: make pr
 
   validate-schema:
     name: Validate JSON schema
     if: github.repository_owner == 'aws'
     permissions:
-      pull-requests: write
-      contents: write
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
-        name: Install Python 3.11
+      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
         with:
-          python-version: 3.11
+          python-version: "3.11"
+          cache-python: false
+      - name: Install and activate Python
+        run: bash tests/setup-python-uv.sh 3.11
       - run: make init
       - run: |
           diff <( cat schema/samcli.json ) <( python -m schema.make_schema && cat schema/samcli.json ) && \
@@ -116,22 +120,24 @@ jobs:
           - ubuntu-latest
           - windows-latest
         python:
-          - "3.9"
+          - "3.10"
           - "3.11"
         # folders that is commented below requires credentials, no need to spare time to run them
         tests_config:
           - name: "integ-buildcmd-arm64"
-            params: "-n 2 --reruns 3 tests/integration/buildcmd/test_build_cmd_arm64.py"
+            params: "-n 2 --reruns 3 -m 'not pr_skip' tests/integration/buildcmd/test_build_cmd_arm64.py"
+          - name: "integ-buildcmd-python"
+            params: "-n 2 --reruns 3 -m 'not pr_skip' tests/integration/buildcmd/test_build_cmd_python.py"
           - name: "integ-buildcmd-main"
-            params: "-n 2 --reruns 3 tests/integration/buildcmd/test_build_cmd_dotnet.py tests/integration/buildcmd/test_build_cmd_provided.py tests/integration/buildcmd/test_build_cmd_rust.py tests/integration/buildcmd/test_build_cmd_python.py tests/integration/buildcmd/test_build_cmd_node.py"
+            params: "-n 2 --reruns 3 -m 'not pr_skip' tests/integration/buildcmd/test_build_cmd_dotnet.py tests/integration/buildcmd/test_build_cmd_provided.py tests/integration/buildcmd/test_build_cmd_rust.py tests/integration/buildcmd/test_build_cmd_node.py"
           - name: "integ-buildcmd-java"
-            params: "-n 2 --reruns 5 tests/integration/buildcmd/test_build_cmd_java.py"
+            params: "-n 3 --reruns 5 tests/integration/buildcmd/test_build_cmd_java.py"
           - name: "integ-buildcmd-other"
             params: "-n 2 --reruns 3 tests/integration/buildcmd --ignore=tests/integration/buildcmd/test_build_cmd_arm64.py --ignore=tests/integration/buildcmd/test_build_cmd_dotnet.py --ignore=tests/integration/buildcmd/test_build_cmd_provided.py --ignore=tests/integration/buildcmd/test_build_cmd_rust.py --ignore=tests/integration/buildcmd/test_build_cmd_python.py --ignore=tests/integration/buildcmd/test_build_cmd_node.py --ignore=tests/integration/buildcmd/test_build_cmd_java.py"
           #- "delete"
           #- "deploy"
           - name: "integ-all-other"
-            params: "-n 2 --reruns 3 tests/integration/init tests/integration/local tests/integration/pipeline tests/integration/root tests/integration/scripts tests/integration/telemetry tests/integration/docs --ignore=tests/integration/local/invoke/test_invoke_durable.py --ignore=tests/integration/local/start_api/test_start_api_durable.py --ignore=tests/integration/local/start_lambda/test_start_lambda_durable.py"
+            params: "-n 2 --reruns 3 -m 'not pr_skip' tests/integration/init tests/integration/local tests/integration/pipeline tests/integration/root tests/integration/scripts tests/integration/telemetry tests/integration/docs --ignore=tests/integration/local/invoke/test_invoke_durable.py --ignore=tests/integration/local/start_api/test_start_api_durable.py --ignore=tests/integration/local/start_lambda/test_start_lambda_durable.py"
           - name: "durable-functions"
             params: "--reruns 3 tests/integration/local/invoke/test_invoke_durable.py tests/integration/local/start_api/test_start_api_durable.py tests/integration/local/start_lambda/test_start_lambda_durable.py"
           #- "list"
@@ -152,22 +158,16 @@ jobs:
           mkdir "D:\\Temp"
           echo "TEMP=D:\\Temp" >> $env:GITHUB_ENV  
         if: ${{ matrix.os == 'windows-latest' }}
-      - uses: actions/setup-python@v6
+      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
         with:
-          # set last version as the one in matrix to make it default
-          python-version: |
-            3.9
-            3.10
-            3.11
-            3.12
-            3.13
-            3.14
-            ${{ matrix.python }}
-          cache: 'pip'
+          python-version: ${{ matrix.python }}
+          cache-python: false
+      - name: Install Python versions
+        run: bash tests/setup-python-uv.sh 3.9 3.10 3.11 3.12 3.13 3.14 ${{ matrix.python }}
       - uses: actions/setup-go@v6
         with:
           go-version: '1.19'
-      - uses: ruby/setup-ruby@v1
+      - uses: ruby/setup-ruby@4dc28cf14d77b0afa6832d9765ac422dbf0dfedd # v1
         with:
           ruby-version: "3.3"
       - uses: actions/setup-node@v6
@@ -188,11 +188,11 @@ jobs:
        # Install and configure Rust & Cargo Lambda
       - name: Install Rust toolchain and cargo-lambda
         if: ${{ matrix.os == 'ubuntu-latest' }}
-        run: bash tests/install-rust.sh
+        run: bash tests/install-rust.sh --uv
       - name: Init samdev
         run: make init
       - name: uv install setuptools in Python3.12
-        run: uv pip install --system --python python3.12 --upgrade pip setuptools
+        run: uv pip install --break-system-packages --python "$(uv python find 3.12)" --upgrade pip setuptools
       - name: Run integration tests for ${{ matrix.tests_config.name }}
         run: pytest -vv ${{ matrix.tests_config.params }}
         env:
@@ -213,36 +213,46 @@ jobs:
       fail-fast: false
       matrix:
         python:
-          - "3.9"
+          - "3.10"
           - "3.11"
         tests_config:
-          - name: "Smoke & Functional Tests - All"
+          - name: "Smoke Tests - First Half"
+            os: ubuntu-latest
+            params: "-n 4 tests/smoke"
+            env_vars: "first-half"
+          - name: "Smoke Tests - Second Half & Functional Tests"
             os: ubuntu-latest
             params: "-n 4 tests/smoke tests/functional"
-            env_vars: "all"
-          - name: "Smoke Tests - First Third"
+            env_vars: "second-half"
+          - name: "Smoke Tests - First Quarter"
             os: windows-latest
             params: "-n 4 tests/smoke"
-            env_vars: "first-third"
-          - name: "Smoke Tests - Second Third"
+            env_vars: "first-quarter"
+          - name: "Smoke Tests - Second Quarter"
             os: windows-latest
             params: "-n 4 tests/smoke"
-            env_vars: "second-third"
-          - name: "Smoke Tests - Third Third & Functional Tests"
+            env_vars: "second-quarter"
+          - name: "Smoke Tests - Third Quarter"
+            os: windows-latest
+            params: "-n 4 tests/smoke"
+            env_vars: "third-quarter"
+          - name: "Smoke Tests - Fourth Quarter & Functional Tests"
             os: windows-latest
             params: "-n 4 tests/smoke tests/functional"
-            env_vars: "third-third"
+            env_vars: "fourth-quarter"
     steps:
       - uses: actions/checkout@v6
       - name: Set TEMP to D:/Temp
         run: |
           mkdir "D:\\Temp"
           echo "TEMP=D:\\Temp" >> $env:GITHUB_ENV  
         if: ${{ matrix.os == 'windows-latest' }}
-      - uses: actions/setup-python@v6
+      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
         with:
           python-version: ${{ matrix.python }}
-          cache: 'pip'
+          cache-python: false
+      - name: Install and activate Python
+        run: bash tests/setup-python-uv.sh ${{ matrix.python }}
       - name: Init samdev
         run: make init
       - name: Run ${{ matrix.tests_config.name }}
@@ -269,16 +279,13 @@ jobs:
           mkdir "D:\\Temp"
           echo "TEMP=D:\\Temp" >> $env:GITHUB_ENV  
         if: ${{ matrix.os == 'windows-latest' }}
-      - uses: actions/setup-python@v6
+      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
         with:
-          # These are the versions of Python that correspond to the supported Lambda runtimes
-          python-version: |
-            3.14
-            3.9
-            3.10
-            3.11
-            3.12
-            3.13
+          python-version: "3.10"
+          cache-python: false
+      - name: Install Python versions
+        shell: bash
+        run: bash tests/setup-python-uv.sh 3.9 3.10 3.11 3.12 3.13 3.14
       - name: Stop Docker Linux
         if: ${{ matrix.os == 'ubuntu-latest' }}
         run: |
@@ -292,7 +299,7 @@ jobs:
       - name: Init samdev
         run: make init
       - name: uv install setuptools in Python3.12
-        run: uv pip install --system --python python3.12 --upgrade pip setuptools
+        run: uv pip install --break-system-packages --python "$(uv python find 3.12)" --upgrade pip setuptools
       - name: Check Docker not Running
         run: docker info
         id: run-docker-info