Merge branch 'aws:develop' into feat/use-durable-functions-emulator-image

Author: SilanHe

.github/dependabot.yml

@@ -13,7 +13,7 @@ updates:
     open-pull-requests-limit: 10
 
   - package-ecosystem: "pip"
-    directory: "/requirements"
+    directory: "/"
     schedule:
       interval: "daily"
     target-branch: "develop"
@@ -26,11 +26,12 @@ updates:
     groups:
       boto:
         patterns:
-        - "boto3"
+        - "boto3[crt]"
         - "boto3-stubs*"
-        - "botocore"
+        - "botocore[crt]"
         - "botocore-stubs"
         - "mypy-boto3-*"
+        - "types-awscrt"
       types:
         patterns:
         - "types-*"

.github/workflows/automated-updates-to-sam-cli.yml

@@ -108,12 +108,12 @@ jobs:
           echo "SAM-T cur version is $SAM_T_CUR_VERSION"
           cd ../aws-sam-cli
           git checkout -b update_sam_transform_version
-          SAM_T_PRE_VERSION=$(grep "aws-sam-translator=" requirements/base.txt)
+          SAM_T_PRE_VERSION=$(grep -oP 'aws-sam-translator==\K[0-9.]+' pyproject.toml)
           echo "SAM-T pre version is $SAM_T_PRE_VERSION"
           git reset --hard develop
-          sed -i "s/$SAM_T_PRE_VERSION/aws-sam-translator==$SAM_T_CUR_VERSION/g" requirements/base.txt
+          sed -i "s/aws-sam-translator==$SAM_T_PRE_VERSION/aws-sam-translator==$SAM_T_CUR_VERSION/g" pyproject.toml
           cp -r ../serverless-application-model/tests/translator/input ./tests/functional/commands/validate/lib/models
-          make update-reproducible-reqs-uv
+          make update-reproducible-reqs
           git status
           git diff --quiet && exit 0 # exit if there is no change
           echo "is_new_sam_t=1" >> $GITHUB_ENV # set env variable for next step run decision
@@ -177,11 +177,11 @@ jobs:
           echo "Lambda Builders cur version is $BUILDERS_CUR_VERSION"
           cd ../aws-sam-cli
           git checkout -b update_lambda_builders_version
-          BUILDERS_PRE_VERSION=$(grep "aws_lambda_builders=" requirements/base.txt)
+          BUILDERS_PRE_VERSION=$(grep -oP 'aws_lambda_builders==\K[0-9.]+' pyproject.toml)
           echo "Lambda Builders pre version is $BUILDERS_PRE_VERSION"
           git reset --hard develop
-          sed -i "s/$BUILDERS_PRE_VERSION/aws_lambda_builders==$BUILDERS_CUR_VERSION/g" requirements/base.txt
-          make update-reproducible-reqs-uv
+          sed -i "s/aws_lambda_builders==$BUILDERS_PRE_VERSION/aws_lambda_builders==$BUILDERS_CUR_VERSION/g" pyproject.toml
+          make update-reproducible-reqs
           git status
           git diff --quiet && exit 0 # exit if there is no change
           echo "is_new_lambda_builders=1" >> $GITHUB_ENV # set env variable for next step run decision

.github/workflows/build.yml

@@ -55,7 +55,7 @@ jobs:
           - ubuntu-latest
           - windows-latest
         python:
-          - "3.9"
+          - "3.10"
           - "3.11"
     steps:
     # This allows temp file creation on drive D, which won't trigger windows defender scan and leads to faster IO
@@ -65,10 +65,13 @@ jobs:
         echo "TEMP=D:\\Temp" >> $env:GITHUB_ENV  
       if: ${{ matrix.os == 'windows-latest' }}
     - uses: actions/checkout@v6
-    - uses: actions/setup-python@v6
+    - uses: astral-sh/setup-uv@v7
       with:
         python-version: ${{ matrix.python }}
-    - uses: astral-sh/setup-uv@v7
+        cache-python: false
+    - name: Install and activate Python
+      run: bash tests/setup-python-uv.sh ${{ matrix.python }}
+      shell: bash
     - run: test -f "./.github/ISSUE_TEMPLATE/Bug_report.md"  # prevent Bug_report.md from being renamed or deleted
     - run: make pr
 
@@ -81,10 +84,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
-        name: Install Python 3.11
+      - uses: astral-sh/setup-uv@v7
         with:
-          python-version: 3.11
+          python-version: "3.11"
+          cache-python: false
+      - name: Install and activate Python
+        run: bash tests/setup-python-uv.sh 3.11
       - run: make init
       - run: |
           diff <( cat schema/samcli.json ) <( python -m schema.make_schema && cat schema/samcli.json ) && \
@@ -116,7 +121,7 @@ jobs:
           - ubuntu-latest
           - windows-latest
         python:
-          - "3.9"
+          - "3.10"
           - "3.11"
         # folders that is commented below requires credentials, no need to spare time to run them
         tests_config:
@@ -152,18 +157,12 @@ jobs:
           mkdir "D:\\Temp"
           echo "TEMP=D:\\Temp" >> $env:GITHUB_ENV  
         if: ${{ matrix.os == 'windows-latest' }}
-      - uses: actions/setup-python@v6
+      - uses: astral-sh/setup-uv@v7
         with:
-          # set last version as the one in matrix to make it default
-          python-version: |
-            3.9
-            3.10
-            3.11
-            3.12
-            3.13
-            3.14
-            ${{ matrix.python }}
-          cache: 'pip'
+          python-version: ${{ matrix.python }}
+          cache-python: false
+      - name: Install Python versions
+        run: bash tests/setup-python-uv.sh 3.9 3.10 3.11 3.12 3.13 3.14 ${{ matrix.python }}
       - uses: actions/setup-go@v6
         with:
           go-version: '1.19'
@@ -188,11 +187,11 @@ jobs:
        # Install and configure Rust & Cargo Lambda
       - name: Install Rust toolchain and cargo-lambda
         if: ${{ matrix.os == 'ubuntu-latest' }}
-        run: bash tests/install-rust.sh
+        run: bash tests/install-rust.sh --uv
       - name: Init samdev
         run: make init
       - name: uv install setuptools in Python3.12
-        run: uv pip install --system --python python3.12 --upgrade pip setuptools
+        run: uv pip install --break-system-packages --python "$(uv python find 3.12)" --upgrade pip setuptools
       - name: Run integration tests for ${{ matrix.tests_config.name }}
         run: pytest -vv ${{ matrix.tests_config.params }}
         env:
@@ -213,7 +212,7 @@ jobs:
       fail-fast: false
       matrix:
         python:
-          - "3.9"
+          - "3.10"
           - "3.11"
         tests_config:
           - name: "Smoke & Functional Tests - All"
@@ -239,10 +238,12 @@ jobs:
           mkdir "D:\\Temp"
           echo "TEMP=D:\\Temp" >> $env:GITHUB_ENV  
         if: ${{ matrix.os == 'windows-latest' }}
-      - uses: actions/setup-python@v6
+      - uses: astral-sh/setup-uv@v7
         with:
           python-version: ${{ matrix.python }}
-          cache: 'pip'
+          cache-python: false
+      - name: Install and activate Python
+        run: bash tests/setup-python-uv.sh ${{ matrix.python }}
       - name: Init samdev
         run: make init
       - name: Run ${{ matrix.tests_config.name }}
@@ -269,16 +270,13 @@ jobs:
           mkdir "D:\\Temp"
           echo "TEMP=D:\\Temp" >> $env:GITHUB_ENV  
         if: ${{ matrix.os == 'windows-latest' }}
-      - uses: actions/setup-python@v6
+      - uses: astral-sh/setup-uv@v7
         with:
-          # These are the versions of Python that correspond to the supported Lambda runtimes
-          python-version: |
-            3.14
-            3.9
-            3.10
-            3.11
-            3.12
-            3.13
+          python-version: "3.10"
+          cache-python: false
+      - name: Install Python versions
+        shell: bash
+        run: bash tests/setup-python-uv.sh 3.9 3.10 3.11 3.12 3.13 3.14
       - name: Stop Docker Linux
         if: ${{ matrix.os == 'ubuntu-latest' }}
         run: |
@@ -292,7 +290,7 @@ jobs:
       - name: Init samdev
         run: make init
       - name: uv install setuptools in Python3.12
-        run: uv pip install --system --python python3.12 --upgrade pip setuptools
+        run: uv pip install --break-system-packages --python "$(uv python find 3.12)" --upgrade pip setuptools
       - name: Check Docker not Running
         run: docker info
         id: run-docker-info

.github/workflows/integration-tests.yml

@@ -6,9 +6,9 @@ on:
     # This translates to Tuesday-Saturday 3am UTC
     - cron: '0 3 * * 2-6'
   release:
-    types: [published, edited]
-    # published → latest-release binary test (full releases only)
-    # edited + prerelease → nightly binary test (nightly pre-release gets edited with new artifacts)
+    types: [published]
+    # prerelease published → nightly binary test
+    # full release published → latest-release binary test
   workflow_dispatch:  # Allow manual triggering
     # NOTE: This workflow can only be manually triggered from develop or main branches
     # The other branch will not pass the OIDC permission check
@@ -79,10 +79,27 @@ jobs:
           - tier1-finch
 
     steps:
+      - name: Determine test type
+        run: |
+          echo "CONTAINER_RUNTIME=${{ matrix.test_suite == 'tier1-finch' && 'finch' || 'docker' }}" >> $GITHUB_ENV
+          if [[ "${{ inputs.install_mode }}" == "nightly-release" ]] || \
+             [[ "${{ github.event.action }}" == "published" && "${{ github.event.release.prerelease }}" == "true" ]]; then
+            echo "TEST_TYPE=nightly-release" >> $GITHUB_ENV
+          elif [[ "${{ inputs.install_mode }}" == "latest-release" ]] || \
+               [[ "${{ github.event.action }}" == "published" && "${{ github.event.release.prerelease }}" != "true" ]]; then
+            echo "TEST_TYPE=latest-release" >> $GITHUB_ENV
+          elif [[ "${{ github.ref }}" == "refs/heads/master" ]]; then
+            echo "TEST_TYPE=master" >> $GITHUB_ENV
+          elif [[ "${{ github.event_name }}" == "schedule" ]] || [[ "${{ github.ref }}" == "refs/heads/develop" ]]; then
+            echo "TEST_TYPE=develop" >> $GITHUB_ENV
+          else
+            echo "TEST_TYPE=other" >> $GITHUB_ENV
+          fi
+
       - name: Checkout code
         uses: actions/checkout@v6
         with:
-          ref: ${{ github.event_name == 'schedule' && 'develop' || github.ref }}
+          ref: ${{ env.TEST_TYPE == 'nightly-release' && 'nightly-builds' || (github.event_name == 'schedule' && 'develop' || github.ref) }}
 
       - name: Free up disk space
         run: bash tests/free_disk_space.sh
@@ -196,23 +213,6 @@ jobs:
         if: "!contains(fromJSON('[\"build-x86-1\", \"build-x86-2\", \"build-x86-container-1\", \"build-x86-container-2\", \"tier1-finch\"]'), matrix.test_suite)"
         run: docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
 
-      - name: Determine test type
-        run: |
-          echo "CONTAINER_RUNTIME=${{ matrix.test_suite == 'tier1-finch' && 'finch' || 'docker' }}" >> $GITHUB_ENV
-          if [[ "${{ inputs.install_mode }}" == "nightly-release" ]] || \
-             [[ "${{ github.event.action }}" == "edited" && "${{ github.event.release.prerelease }}" == "true" ]]; then
-            echo "TEST_TYPE=nightly-release" >> $GITHUB_ENV
-          elif [[ "${{ inputs.install_mode }}" == "latest-release" ]] || \
-               [[ "${{ github.event.action }}" == "published" && "${{ github.event.release.prerelease }}" != "true" ]]; then
-            echo "TEST_TYPE=latest-release" >> $GITHUB_ENV
-          elif [[ "${{ github.ref }}" == "refs/heads/master" ]]; then
-            echo "TEST_TYPE=master" >> $GITHUB_ENV
-          elif [[ "${{ github.event_name }}" == "schedule" ]] || [[ "${{ github.ref }}" == "refs/heads/develop" ]]; then
-            echo "TEST_TYPE=develop" >> $GITHUB_ENV
-          else
-            echo "TEST_TYPE=other" >> $GITHUB_ENV
-          fi
-
       - name: Initialize integration test
         if: env.TEST_TYPE == 'develop' || env.TEST_TYPE == 'master' || env.TEST_TYPE == 'other'
         run: |

.github/workflows/sync-to-mirror-repo.yml

@@ -22,5 +22,7 @@ jobs:
 
       - name: Push to mirror repo
         run: |
-          git remote set-url origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git
+          git config user.name "aws-sam-cli-bot"
+          git config user.email "aws-sam-cli-gh-bot@amazon.com"
+          git remote set-url origin https://x-access-token:${{ secrets.SYNC_REPO_PAT }}@github.com/${{ github.repository }}.git
           git push origin develop:develop --force

.github/workflows/update-reproducibles.yml

@@ -4,22 +4,24 @@ on:
     branches: [develop]
     paths:
       # run this GHA if the following files have changed
-      - requirements/base.txt
+      - pyproject.toml
       - requirements/reproducible-linux.txt
       - requirements/reproducible-mac.txt
       - requirements/reproducible-win.txt
 
 jobs:
+  # For PRs from within the aws/aws-sam-cli repo: auto-update and push
   update-reqs:
     permissions:
       pull-requests: write
       contents: write
-    if: github.repository_owner == 'aws'
+    if: github.repository_owner == 'aws' && github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
         with:
           ref: ${{ github.head_ref }}
+          token: ${{ secrets.GITHUB_TOKEN }}
       - uses: actions/setup-python@v6
         with:
           python-version: "3.11"
@@ -31,7 +33,27 @@ jobs:
         run: |
           git config --global user.email "action@github.com"
           git config --global user.name "GitHub Action"
-          git remote set-url origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}
           git add requirements/reproducible-*.txt
           git commit -m "Update reproducible requirements" || echo "nothing to commit"
-          git push
+          git push
+
+  # For PRs from forks: verify requirements are up to date, fail with instructions if not
+  verify-up-to-date:
+    if: github.repository_owner == 'aws' && github.event.pull_request.head.repo.full_name != github.repository
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+      - name: Check reproducible requirements are up to date
+        run: make update-reproducible-reqs-uv
+      - name: Fail if requirements are out of date
+        run: |
+          if ! git diff --quiet requirements/reproducible-*.txt; then
+            echo "::error::Reproducible requirements are out of date. Please run 'make update-reproducible-reqs' locally and commit the changes before raising a PR."
+            exit 1
+          fi
+          echo "Reproducible requirements are up to date."

DEVELOPMENT_GUIDE.md

@@ -152,7 +152,7 @@ all changes you make to the SAM Transformer locally are immediately picked up fo
 pip install -e .
 ```
 
-Move back to your SAM CLI directory and re-run init, If necessary: open requirements/base.txt and replace the version number of aws-sam-translator with the ``version number`` specified in your local version of `serverless-application-model/samtranslator/__init__.py`
+Move back to your SAM CLI directory and re-run init, If necessary: open `pyproject.toml` and replace the version number of `aws-sam-translator` in the `[project].dependencies` list with the ``version number`` specified in your local version of `serverless-application-model/samtranslator/__init__.py`
 
 ```sh
 # Make sure you are back to your SAM CLI directory
@@ -341,23 +341,20 @@ conventions are best practices that we have learnt over time.
 
 ### Dependency Updates
 
-Please update all the required files if the changes involve a version update on a dependency or to include a new dependency. The requirements files are located inside the `requirements` folder.
+Please update all the required files if the changes involve a version update on a dependency or to include a new dependency.
 
-#### base.txt for SAM CLI code dependencies
-For dependencies used in SAM CLI code, update `base.txt` in `requirements` folder. To update `base.txt` file, simply follow the current convention and input the dependency name plus version, together with any necessary comment. For more information on the operators to be used for restricting compatible versions, read on [python's enhancement proposals](https://peps.python.org/pep-0440/#compatible-release).
+#### pyproject.toml for SAM CLI code dependencies
+All runtime and development dependencies are declared in `pyproject.toml` at the project root. Runtime dependencies go in `[project].dependencies` and test/dev dependencies go in `[project.optional-dependencies].dev`. Simply follow the current convention and input the dependency name plus version, together with any necessary comment. For more information on the operators to be used for restricting compatible versions, read on [python's enhancement proposals](https://peps.python.org/pep-0440/#compatible-release).
 
 #### reproducible-linux.txt for SAM CLI code dependencies
-For dependencies used in SAM CLI code, also remember to update`reproducible-linux.txt` in `requirements` folder and `THIRD-PARTY-LICENSES` in `installer/assets` folder. To update the `reproducible-linux.txt`, run the following script to replace the file:
+For dependencies used in SAM CLI code, also remember to update `reproducible-linux.txt` in `requirements` folder and `THIRD-PARTY-LICENSES` in `installer/assets` folder. To update the reproducible requirements, run the following script to regenerate the files:
 ```
 make update-reproducible-reqs
 ```
-Note that this is a fully auto-generated file, any manual changes to reproducible-linux.txt will not last after the next update running the above script. As for updating the `THIRD-PARTY-LICENSES`, find the corresponding dependency entry in the license file (usually grouped by licensing organization) and update the versions. For adding a new dependency, look up for its licensing organization through PyPi and update the corresponding section. If the license is from GNU or another license type not included in the file, please contact the repository maintainers first. If you are not familiar with working with this file, please contact one of the repository maintainers or cut an issue to help with the update.
-
-#### dev.txt for SAM CLI test dependencies
-For changing dependencies used for `make pr` checks and test related dependencies, update `dev.txt` in `requirements` folder only.
+Note that these are fully auto-generated files, any manual changes to reproducible-*.txt will not last after the next update running the above script. As for updating the `THIRD-PARTY-LICENSES`, find the corresponding dependency entry in the license file (usually grouped by licensing organization) and update the versions. For adding a new dependency, look up for its licensing organization through PyPi and update the corresponding section. If the license is from GNU or another license type not included in the file, please contact the repository maintainers first. If you are not familiar with working with this file, please contact one of the repository maintainers or cut an issue to help with the update.
 
 #### pyinstaller-build.txt for SAM CLI native installer build dependencies
-For changing Python dependencies needed for creating builds through Pyinstaller (to run `build-mac.sh` or `build-linux.sh` in `installer/pyinstaller` folder), modify `pyinstaller-build.txt`.
+For changing Python dependencies needed for creating builds through Pyinstaller (to run `build-mac.sh` or `build-linux.sh` in `installer/pyinstaller` folder), modify `pyinstaller-build.txt` in the `requirements` folder.
 
 
 ### Our Testing Practices

MANIFEST.in

@@ -1,8 +1,5 @@
 include LICENSE
 include THIRD-PARTY-LICENSES
-include requirements/base.txt
-include requirements/pre-dev.txt
-include requirements/dev.txt
 recursive-include samcli *
 prune tests
 prune installer