Merge branch 'develop' into tmp-disallow-relative-imports

Author: reedham-aws

.github/workflows/ai-code-review.yml

@@ -0,0 +1,29 @@
+name: AI Code Review
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  review:
+    runs-on: ubuntu-latest
+    steps:
+      # Checkout base branch (trusted) — workspace files are never from the fork
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      # Fetch PR head commit so git diff works, but don't checkout fork files
+      - name: Fetch PR head
+        run: git fetch origin "$PR_HEAD_SHA"
+        env:
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+
+      - uses: roger-zhangg/sam-pr-reviewer@742fd2b1a8574050bcdeb41ffe0b762a11ba24d5 # v1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          kiro_api_key: ${{ secrets.KIRO_API_KEY }}

.github/workflows/close-stale-issues.yml

@@ -14,7 +14,7 @@ jobs:
     permissions:
       issues: write
     steps:
-    - uses: aws-actions/stale-issue-cleanup@v6
+    - uses: aws-actions/stale-issue-cleanup@7de35968489e4142233d2a6812519a82e68b5c38 # v6
       with:
         issue-types: issues
 

.github/workflows/closed-issue-message.yml

@@ -9,7 +9,7 @@ jobs:
     permissions:
       issues: write
     steps:
-      - uses: aws-actions/closed-issue-message@v2
+      - uses: aws-actions/closed-issue-message@10aaf6366131b673a7c8b7742f8b3849f1d44f18 # v2
         with:
           # These inputs are both required
           repo-token: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/integration-tests.yml

@@ -243,7 +243,7 @@ jobs:
           echo "SAM_CLI_DEV=" >> $GITHUB_ENV
 
       - name: Configure AWS credentials via OIDC
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6
         with:
           role-to-assume: ${{ secrets.OIDC_ROLE_ARN }}
           aws-region: us-east-1
@@ -451,14 +451,14 @@ jobs:
 
       - name: Re-authenticate with OIDC for cleanup
         if: always() && env.SCRIPT_PY != ''
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6
         with:
           role-to-assume: ${{ secrets.OIDC_ROLE_ARN }}
           aws-region: us-east-1
 
       - name: Assume test reporting role
         if: always() && env.SCRIPT_PY != ''
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6
         with:
           role-to-assume: ${{ secrets.TESTREPORTING_ARN }}
           aws-region: us-east-1

samcli/lib/init/templates/cookiecutter-aws-sam-hello-golang/requirements-dev.txt

@@ -1,4 +1,4 @@
 cookiecutter==2.1.1
 flake8==3.5.0
-pytest==3.3.2
+pytest==9.0.3
 pytest-cookies==0.3.0