.github/.github/workflows/ci-python-sam.yaml

name: CI — Python / SAM

on:
  workflow_call:
    inputs:
      python-version:
        description: "Python version to use"
        type: string
        default: "3.12"
      source-dirs:
        description: "Space-separated directories for ruff (default: repo root)"
        type: string
        default: "."
      run-tests:
        description: "Run pytest"
        type: boolean
        default: false
      run-sam-validate:
        description: "Run sam validate --lint"
        type: boolean
        default: true
      sam-template:
        description: "Path to SAM template file"
        type: string
        default: "template.yaml"
      run-cdk-synth:
        description: "Run cdk synth (for Python CDK repos)"
        type: boolean
        default: false
      cdk-dir:
        description: "Directory containing cdk.json"
        type: string
        default: "cdk"
      node-version:
        description: "Node.js version for CDK CLI"
        type: string
        default: "24"
      enable-qemu:
        description: "Enable QEMU so cdk synth can bundle arm64 Lambda assets on x86 runners"
        type: boolean
        default: false
      run-conventions-check:
        description: "Run lightweight conventions audit"
        type: boolean
        default: true

permissions:
  contents: read

jobs:
  ci:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    concurrency:
      group: ci-python-sam-${{ github.workflow }}-${{ github.ref }}-${{ inputs.source-dirs }}
      cancel-in-progress: true
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ inputs.python-version }}

      - name: Install ruff
        run: pip install 'ruff==0.15.22'

      - name: Ruff check
        run: ruff check ${{ inputs.source-dirs }}

      - name: Ruff format check
        run: ruff format --check ${{ inputs.source-dirs }}

      - name: Install Python dependencies
        if: ${{ inputs.run-tests || inputs.run-cdk-synth }}
        # NUL-delimited read loop rather than `for req in $(find ...)`: the
        # command-substitution form word-splits and globs every path it finds.
        shell: bash
        run: |
          if [ "${{ inputs.run-tests }}" = "true" ]; then
            pip install pytest
          fi
          while IFS= read -r -d '' req; do
            pip install -r "$req"
          done < <(find . -name requirements.txt -not -path './.aws-sam/*' -print0)

      - name: Run tests
        if: ${{ inputs.run-tests }}
        run: pytest

      - name: Setup Node.js
        if: ${{ inputs.run-cdk-synth }}
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: ${{ inputs.node-version }}

      - name: Set up QEMU
        if: ${{ inputs.run-cdk-synth && inputs.enable-qemu }}
        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0

      - name: CDK synth
        if: ${{ inputs.run-cdk-synth }}
        working-directory: ${{ inputs.cdk-dir }}
        run: npx -y cdk synth --quiet

      - name: Conventions check
        if: ${{ inputs.run-conventions-check }}
        run: |
          errors=0
          warn() { echo "::warning::$1"; }
          fail() { echo "::error::$1"; errors=$((errors + 1)); }

          # README must exist
          if [[ ! -f README.md ]]; then
            fail "Missing README.md"
          fi

          # .gitignore must cover .env
          if [[ -f .gitignore ]]; then
            if ! grep -qE '^\.env$|^\.env\b' .gitignore; then
              fail ".gitignore does not include .env"
            fi
          else
            fail "Missing .gitignore"
          fi

          # SAM: check template for non-arm64 and missing log retention
          TEMPLATE="${{ inputs.sam-template }}"
          if [[ -f "$TEMPLATE" ]]; then
            if grep -qi 'x86_64' "$TEMPLATE" 2>/dev/null; then
              fail "SAM template: Lambda using x86_64 instead of arm64"
            fi
            if grep -qi 'AWS::Serverless::Function' "$TEMPLATE" 2>/dev/null; then
              if ! grep -qi 'RetentionInDays\|AWS::Logs::LogGroup' "$TEMPLATE" 2>/dev/null; then
                warn "SAM template: Lambda found but no explicit log retention"
              fi
            fi
            # Flag HARDCODED secret values in the template. Secrets Manager
            # references (e.g. SLACK_BOT_TOKEN_SECRET: my-app/slack-token) and
            # intrinsic functions (!Ref/!Sub/{{resolve:...}}) are the correct
            # pattern, so match on the value's shape — not the key name, which
            # legitimately contains words like TOKEN/SECRET when pointing at a
            # Secrets Manager id.
            if grep -qiE '(xox[abprs]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|gh[posu]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|sk-[A-Za-z0-9]{20,}|-----BEGIN[[:space:]][A-Z ]*PRIVATE KEY-----)' "$TEMPLATE" 2>/dev/null; then
              fail "SAM template: hardcoded secret in template — use Secrets Manager"
            fi
          fi

          if [[ $errors -gt 0 ]]; then
            echo "Conventions check failed with $errors error(s)."
            exit 1
          fi
          echo "Conventions check passed."

      - name: Setup SAM CLI
        if: ${{ inputs.run-sam-validate }}
        uses: aws-actions/setup-sam@89ddb14d60e682855e3fea4be85b3c56485de310 # v3.0.0

      - name: SAM validate
        if: ${{ inputs.run-sam-validate }}
        run: sam validate --lint --template ${{ inputs.sam-template }}