aimodelshare 0.3.62__tar.gz

aimodelshare-0.3.62/.github/workflows/ai_lead_engineer_app_test.yml

@@ -0,0 +1,98 @@
+name: AI Lead Engineer App Test
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ai-lead-engineer-app-${{ github.ref_name }}
+  cancel-in-progress: true
+
+jobs:
+  ai-lead-engineer-app-test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      TF_CPP_MIN_LOG_LEVEL: "2"
+      AIMODELSHARE_SUPPRESS_OPTIONAL_WARNINGS: "1"
+      CUDA_VISIBLE_DEVICES: "-1"                # Force CPU-only for TensorFlow
+      # Safely expose secrets as env (empty if unavailable, e.g., fork PRs)
+      AIMODELSHARE_USERNAME: ${{ secrets.AIMODELSHARE_USERNAME }}
+      AIMODELSHARE_PASSWORD: ${{ secrets.AIMODELSHARE_PASSWORD }}
+      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      AWS_REGION: ${{ secrets.AWS_REGION }}
+
+    strategy:
+      matrix:
+        python-version: ["3.11"]
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: "pip"
+
+      - name: Upgrade pip
+        run: |
+          python -m pip install --upgrade pip
+
+      - name: Install dependencies
+        run: |
+          # Core dependencies
+          pip install boto3 onnx onnxmltools onnxruntime Pympler scikeras shortuuid skl2onnx tf2onnx wget
+          # Package in editable mode
+          pip install -e .
+          # Test and ML dependencies
+          pip install pytest scikit-learn pandas numpy opencv-python-headless pydot regex psutil IPython matplotlib seaborn importlib_resources onnxscript
+          # TensorFlow (CPU-only)
+          pip install tensorflow-cpu
+          # PyTorch (CPU-only)
+          pip install --index-url https://download.pytorch.org/whl/cpu torch torchvision
+          # Gradio UI
+          pip install gradio
+
+      - name: Verify CPU-only TensorFlow
+        run: |
+          python -c "import tensorflow as tf, os; os.environ['CUDA_VISIBLE_DEVICES']='-1'; print('TensorFlow GPUs:', len(tf.config.list_physical_devices('GPU'))); print('CPU-only mode verified');"
+
+      - name: Set up test environment (if credentials available)
+        if: ${{ env.AIMODELSHARE_USERNAME != '' && env.AIMODELSHARE_PASSWORD != '' }}
+        run: |
+          echo "username=${AIMODELSHARE_USERNAME}" >> "$GITHUB_ENV"
+          echo "password=${AIMODELSHARE_PASSWORD}" >> "$GITHUB_ENV"
+          echo "AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}" >> "$GITHUB_ENV"
+          echo "AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}" >> "$GITHUB_ENV"
+          echo "AWS_REGION=${AWS_REGION}" >> "$GITHUB_ENV"
+
+      - name: Run AI Lead Engineer app tests
+        run: |
+          pytest tests/test_playground_ai_lead_engineer_app.py -v -s --tb=short
+
+      - name: Test app import from moral_compass module
+        run: |
+          python - <<'PY'
+          from aimodelshare.moral_compass import create_ai_lead_engineer_app, launch_ai_lead_engineer_app
+          print('✓ Import from moral_compass module successful')
+
+          from aimodelshare.moral_compass.apps import create_ai_lead_engineer_app as create2, launch_ai_lead_engineer_app as launch2
+          print('✓ Import from apps module successful')
+
+          app = create_ai_lead_engineer_app()
+          assert app is not None
+          print('✓ App instantiation successful')
+          PY
+
+      - name: Summary
+        if: always()
+        run: |
+          echo "AI Lead Engineer App Test Summary"
+          echo "=================================="
+          echo "Python version: ${{ matrix.python-version }}"
+          echo "Status: Test completed"

aimodelshare-0.3.62/.github/workflows/aimodelshare-tests.yml

@@ -0,0 +1,84 @@
+name: Test latest master branch aimodelshare
+
+on:
+  workflow_dispatch: # Manual trigger only
+
+permissions:
+  contents: read
+
+concurrency:
+  group: master-aimodelshare-tests
+  cancel-in-progress: true
+
+jobs:
+  run-tests:
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+
+    env:
+      USERNAME: ${{ secrets.AIMODELSHARE_USERNAME }}
+      PASSWORD: ${{ secrets.AIMODELSHARE_PASSWORD }}
+      AWS_ACCESS_KEY_ID: ${{ secrets.DATA_AWS_ACCESS_KEY_ID }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.DATA_AWS_SECRET_ACCESS_KEY }}
+      AWS_REGION: us-east-1
+
+    steps:
+      - name: Checkout repository (master)
+        uses: actions/checkout@v4
+        with:
+          # Uncomment the next line if you want to ALWAYS test master even when dispatching from another ref
+          # ref: master
+          fetch-depth: 0
+
+      - name: Show commit being tested
+        run: |
+          echo "Testing commit:"
+          git --no-pager log -1 --oneline
+          echo "Current branch (if detached this may be a commit SHA):"
+          git branch --show-current || true
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.10"
+          cache: "pip"
+
+      - name: Upgrade pip
+        run: |
+          python -m pip install --upgrade pip
+
+      - name: Install local aimodelshare (editable) + test dependencies
+        run: |
+          pip install boto3 onnx onnxmltools onnxruntime Pympler scikeras shortuuid skl2onnx tf2onnx wget
+          pip install -e .
+          pip install pytest scikit-learn pandas numpy opencv-python-headless tensorflow pydot regex psutil IPython "PyJWT<2.0" matplotlib seaborn importlib_resources onnxscript
+          pip install --index-url https://download.pytorch.org/whl/cpu torch torchvision
+          python -c "import aimodelshare, os; print('aimodelshare imported from:', aimodelshare.__file__)"
+
+      - name: Verify import now points to repository source (not PyPI)
+        run: |
+          python - <<'PYCODE'
+          import aimodelshare, os
+          path = aimodelshare.__file__
+          print("Resolved aimodelshare.__file__:", path)
+          repo_root = os.getcwd()
+          assert repo_root in os.path.abspath(path), f"aimodelshare does not appear to come from the checked-out repository root: {repo_root}"
+          assert "site-packages" not in path, "aimodelshare should NOT be the PyPI site-packages build."
+          print("Verification passed: using local master branch source.")
+          PYCODE
+
+      - name: Run targeted tests against local master branch
+        run: |
+          echo "Starting pytest for tests/test_playgrounds_nodataimport.py"
+          pytest -vv tests/test_aimsonnx.py
+          pytest -vv tests/test_playgrounds_nodataimport.py
+
+      - name: Post-run diagnostics (always runs)
+        if: always()
+        run: |
+          echo "Job conclusion: ${{ job.status }}"
+          python - <<'PYCODE'
+          import aimodelshare
+          print("aimodelshare version attribute (may reflect local dev state):", getattr(aimodelshare, "__version__", "unknown"))
+          print("Module file path:", aimodelshare.__file__)
+          PYCODE

aimodelshare-0.3.62/.github/workflows/bootstrap-terraform.yml

@@ -0,0 +1,149 @@
+name: Bootstrap Terraform State Resources
+
+on:
+  workflow_dispatch:
+  workflow_call:
+    outputs:
+      s3_bucket_name:
+        description: "Name of the created S3 bucket"
+        value: ${{ jobs.bootstrap.outputs.s3_bucket_name }}
+      dynamodb_table_name:
+        description: "Name of the created DynamoDB table"
+        value: ${{ jobs.bootstrap.outputs.dynamodb_table_name }}
+      github_actions_role_arn:
+        description: "ARN of the created GitHub Actions IAM role"
+        value: ${{ jobs.bootstrap.outputs.github_actions_role_arn }}
+
+jobs:
+  bootstrap:
+    runs-on: ubuntu-latest
+    
+    outputs:
+      s3_bucket_name: ${{ steps.terraform_output.outputs.s3_bucket_name }}
+      dynamodb_table_name: ${{ steps.terraform_output.outputs.dynamodb_table_name }}
+      github_actions_role_arn: ${{ steps.terraform_output.outputs.github_actions_role_arn }}
+    
+    permissions:
+      contents: read
+
+    env:
+      AWS_REGION: ${{ vars.AWS_REGION || 'us-east-1' }}
+      TF_IN_AUTOMATION: "true"
+      
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: 1.9.5
+          terraform_wrapper: false
+
+      # Configure AWS credentials using access keys per company policy
+      # Note: Requires AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY repository secrets
+      # Security: Ensure access keys follow principle of least privilege and key rotation policies
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.DATA_AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.DATA_AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Check if resources already exist
+        id: check_resources
+        working-directory: infra/bootstrap
+        run: |
+          # Check if S3 bucket exists
+          if aws s3api head-bucket --bucket "aimodelshare-tfstate-prod-copilot-2024" 2>/dev/null; then
+            echo "s3_exists=true" >> $GITHUB_OUTPUT
+          else
+            echo "s3_exists=false" >> $GITHUB_OUTPUT
+          fi
+          
+          # Check if DynamoDB table exists
+          if aws dynamodb describe-table --table-name "aimodelshare-tf-locks" 2>/dev/null; then
+            echo "dynamodb_exists=true" >> $GITHUB_OUTPUT
+          else
+            echo "dynamodb_exists=false" >> $GITHUB_OUTPUT
+          fi
+
+          # Check if GitHub OIDC provider exists
+          ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
+          if aws iam get-open-id-connect-provider --open-id-connect-provider-arn "arn:aws:iam::${ACCOUNT_ID}:oidc-provider/token.actions.githubusercontent.com" 2>/dev/null; then
+            echo "oidc_provider_exists=true" >> $GITHUB_OUTPUT
+          else
+            echo "oidc_provider_exists=false" >> $GITHUB_OUTPUT
+          fi
+
+          # Check if GitHub Actions IAM role exists
+          if aws iam get-role --role-name "aimodelshare-github-oidc-deployer" 2>/dev/null; then
+            echo "github_role_exists=true" >> $GITHUB_OUTPUT
+          else
+            echo "github_role_exists=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Terraform Init
+        working-directory: infra/bootstrap
+        run: terraform init -input=false
+
+      - name: Terraform Validate
+        working-directory: infra/bootstrap
+        run: terraform validate
+
+      - name: Import existing resources (if they exist)
+        working-directory: infra/bootstrap
+        if: steps.check_resources.outputs.s3_exists == 'true' || steps.check_resources.outputs.dynamodb_exists == 'true' || steps.check_resources.outputs.oidc_provider_exists == 'true' || steps.check_resources.outputs.github_role_exists == 'true'
+        run: |
+          ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
+          
+          if [ "${{ steps.check_resources.outputs.s3_exists }}" = "true" ]; then
+            echo "Importing existing S3 bucket..."
+            terraform import aws_s3_bucket.terraform_state aimodelshare-tfstate-prod-copilot-2024 || true
+            terraform import aws_s3_bucket_versioning.terraform_state aimodelshare-tfstate-prod-copilot-2024 || true
+            terraform import aws_s3_bucket_server_side_encryption_configuration.terraform_state aimodelshare-tfstate-prod-copilot-2024 || true
+            terraform import aws_s3_bucket_public_access_block.terraform_state aimodelshare-tfstate-prod-copilot-2024 || true
+          fi
+          
+          if [ "${{ steps.check_resources.outputs.dynamodb_exists }}" = "true" ]; then
+            echo "Importing existing DynamoDB table..."
+            terraform import aws_dynamodb_table.terraform_locks aimodelshare-tf-locks || true
+          fi
+
+          if [ "${{ steps.check_resources.outputs.oidc_provider_exists }}" = "true" ]; then
+            echo "Importing existing GitHub OIDC provider..."
+            terraform import aws_iam_openid_connect_provider.github "arn:aws:iam::${ACCOUNT_ID}:oidc-provider/token.actions.githubusercontent.com" || true
+          fi
+
+          if [ "${{ steps.check_resources.outputs.github_role_exists }}" = "true" ]; then
+            echo "Importing existing GitHub Actions IAM role..."
+            terraform import aws_iam_role.github_actions aimodelshare-github-oidc-deployer || true
+            # Also try to import the policy and attachment if they exist
+            terraform import aws_iam_policy.github_actions_deployment "arn:aws:iam::${ACCOUNT_ID}:policy/aimodelshare-github-actions-deployment" || true
+            terraform import aws_iam_role_policy_attachment.github_actions_deployment aimodelshare-github-oidc-deployer/arn:aws:iam::${ACCOUNT_ID}:policy/aimodelshare-github-actions-deployment || true
+          fi
+
+      - name: Terraform Plan
+        id: plan
+        working-directory: infra/bootstrap
+        run: |
+          terraform plan -input=false -out=tfplan
+          
+      - name: Terraform Apply
+        working-directory: infra/bootstrap
+        run: terraform apply -input=false -auto-approve tfplan
+
+      - name: Get Terraform Outputs
+        id: terraform_output
+        working-directory: infra/bootstrap
+        run: |
+          S3_BUCKET=$(terraform output -raw s3_bucket_name)
+          DYNAMODB_TABLE=$(terraform output -raw dynamodb_table_name)
+          GITHUB_ROLE_ARN=$(terraform output -raw github_actions_role_arn)
+          echo "s3_bucket_name=$S3_BUCKET" >> $GITHUB_OUTPUT
+          echo "dynamodb_table_name=$DYNAMODB_TABLE" >> $GITHUB_OUTPUT
+          echo "github_actions_role_arn=$GITHUB_ROLE_ARN" >> $GITHUB_OUTPUT
+          echo "✅ Bootstrap completed successfully!"
+          echo "  S3 Bucket: $S3_BUCKET"
+          echo "  DynamoDB Table: $DYNAMODB_TABLE"
+          echo "  GitHub Actions Role ARN: $GITHUB_ROLE_ARN"

aimodelshare-0.3.62/.github/workflows/cleanup-test-resources.yml

@@ -0,0 +1,104 @@
+name: Cleanup Test Resources
+
+on:
+  workflow_dispatch:
+    inputs:
+      mode:
+        description: 'Mode of operation'
+        required: true
+        default: 'dry-run'
+        type: choice
+        options:
+          - dry-run     # list only
+          - plan        # list with optional filters
+          - delete      # delete specified resources
+      region:
+        description: 'AWS region'
+        required: false
+        default: 'us-east-1'
+      user_filter:
+        description: 'Substring filter for IAM usernames (plan/dry-run modes)'
+        required: false
+      playground_ids:
+        description: 'Comma-separated API Gateway REST API IDs to delete (delete mode)'
+        required: false
+      iam_usernames:
+        description: 'Comma-separated IAM usernames to delete (delete mode)'
+        required: false
+      confirm:
+        description: "Type DELETE to allow deletions (required for delete mode)"
+        required: false
+
+permissions:
+  contents: read
+  # If you later move to OIDC role assumption, uncomment:
+  # id-token: write
+
+jobs:
+  cleanup:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    
+    env:
+      AWS_REGION: ${{ github.event.inputs.region || 'us-east-1' }}
+    
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.10"
+      
+      # Configure AWS credentials (currently using static secrets; consider switching to OIDC)
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.DATA_AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.DATA_AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ env.AWS_REGION }}
+      
+      - name: Install dependencies
+        run: |
+          pip install boto3
+      
+      - name: List resources (dry-run / plan modes)
+        if: ${{ github.event.inputs.mode == 'dry-run' || github.event.inputs.mode == 'plan' }}
+        run: |
+          echo "Listing resources (mode=${{ github.event.inputs.mode }})"
+          python scripts/cleanup_test_resources.py --region ${{ env.AWS_REGION }} --list-only $([ -n "${{ github.event.inputs.user_filter }}" ] && echo "--user-filter '${{ github.event.inputs.user_filter }}'")
+        shell: bash
+      
+      - name: Validate delete inputs
+        if: ${{ github.event.inputs.mode == 'delete' }}
+        run: |
+          echo "Validating delete inputs..."
+          if [ "${{ github.event.inputs.confirm }}" != "DELETE" ]; then
+            echo "Deletion not confirmed. 'confirm' must be DELETE."; exit 1;
+          fi
+          if [ -z "${{ github.event.inputs.playground_ids }}" ] && [ -z "${{ github.event.inputs.iam_usernames }}" ]; then
+            echo "Nothing to delete. Provide playground_ids and/or iam_usernames."; exit 1;
+          fi
+        shell: bash
+      
+      - name: Perform deletion
+        if: ${{ github.event.inputs.mode == 'delete' }}
+        run: |
+          echo "Starting deletion..."
+          python scripts/cleanup_test_resources.py \
+            --region ${{ env.AWS_REGION }} \
+            --playgrounds "${{ github.event.inputs.playground_ids }}" \
+            --users "${{ github.event.inputs.iam_usernames }}" \
+            --confirm-delete DELETE
+        shell: bash
+      
+      - name: Summary
+        if: always()
+        run: |
+          echo "Cleanup workflow completed"
+          echo "Mode: ${{ github.event.inputs.mode }}"
+          echo "Region: ${{ env.AWS_REGION }}"
+          echo "User filter: ${{ github.event.inputs.user_filter }}"
+          echo "Playground IDs: ${{ github.event.inputs.playground_ids }}"
+          echo "IAM Usernames: ${{ github.event.inputs.iam_usernames }}"

aimodelshare-0.3.62/.github/workflows/deploy-infra.yml

@@ -0,0 +1,221 @@
+name: Deploy Infra (Terraform Workspaces)
+
+on:
+  workflow_dispatch:
+
+jobs:
+  bootstrap:
+    uses: ./.github/workflows/bootstrap-terraform.yml
+    secrets: inherit
+
+  deploy:
+    needs: bootstrap
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        env: [dev]
+
+    permissions:
+      contents: read
+
+    env:
+      AWS_REGION: ${{ vars.AWS_REGION || 'us-east-1' }}
+      TF_IN_AUTOMATION: "true"
+      username: ${{ secrets.AIMODELSHARE_USERNAME }}
+      password: ${{ secrets.AIMODELSHARE_PASSWORD }}
+      AWS_ACCESS_KEY_ID: ${{ secrets.DATA_AWS_ACCESS_KEY_ID }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.DATA_AWS_SECRET_ACCESS_KEY }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: 1.9.5
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.DATA_AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.DATA_AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: (Optional) Build Lambda Layer
+        working-directory: infra/layer
+        run: |
+          if [ -f requirements.txt ]; then
+            bash build_layer.sh || true
+          fi
+
+      - name: Terraform Init
+        working-directory: infra
+        run: terraform init -input=false
+
+      - name: Select/Create Workspace
+        working-directory: infra
+        run: |
+          set -euo pipefail
+
+          WS="${{ matrix.env }}"
+            echo "Ensuring Terraform workspace '${WS}' exists..."
+          if terraform workspace list | sed 's/^[* ]*//' | grep -Fxq "$WS"; then
+            echo "Selecting existing workspace: $WS"
+            terraform workspace select "$WS"
+          else
+            echo "Creating new workspace: $WS"
+            terraform workspace new "$WS"
+          fi
+          echo "Current workspace: $(terraform workspace show)"
+
+          if [ ! -d .terraform ]; then
+            echo "Terraform not initialized yet; running 'terraform init'..."
+            terraform init -input=false
+          fi
+
+          STATE_KEY="env:/${WS}/aimodelshare/infra/terraform.tfstate"
+          echo "Checking if remote state object exists: ${STATE_KEY}"
+          if aws s3api head-object --bucket "aimodelshare-tfstate-prod-copilot-2024" --key "${STATE_KEY}" >/dev/null 2>&1; then
+            echo "Remote state object exists for workspace '${WS}'"
+          else
+            echo "Remote state object missing for workspace '${WS}' - creating initial state"
+            terraform apply -auto-approve -target=null_resource.state_seed
+          fi
+
+          echo "Workspace '$WS' ready; proceeding to plan/apply steps."
+
+      - name: Terraform Validate
+        working-directory: infra
+        run: terraform validate
+
+      - name: Terraform Plan
+        id: plan
+        working-directory: infra
+        run: terraform plan -input=false -out=tfplan
+
+      - name: Terraform Apply
+        if: github.ref == 'refs/heads/master'
+        working-directory: infra
+        run: terraform apply -input=false -auto-approve tfplan
+
+      - name: Show Outputs
+        working-directory: infra
+        run: terraform output -json
+
+      - name: Wait for DynamoDB GSI readiness
+        if: github.ref == 'refs/heads/master'
+        working-directory: infra
+        run: |
+          TABLE_NAME=$(terraform output -raw dynamodb_table_name)
+          echo "Waiting for GSI 'byUser' on table $TABLE_NAME to become ACTIVE..."
+          ATTEMPTS=0
+          MAX_ATTEMPTS=30
+          SLEEP_SECONDS=5
+          while true; do
+            STATUS=$(aws dynamodb describe-table --table-name "$TABLE_NAME" \
+              --query "Table.GlobalSecondaryIndexes[?IndexName=='byUser'].IndexStatus" --output text 2>/dev/null || echo "UNKNOWN")
+            if [ "$STATUS" = "ACTIVE" ]; then
+              echo "GSI 'byUser' is ACTIVE."
+              break
+            fi
+            ATTEMPTS=$((ATTEMPTS+1))
+            if [ $ATTEMPTS -ge $MAX_ATTEMPTS ]; then
+              echo "Timeout waiting for GSI 'byUser' to become ACTIVE (last status: $STATUS)"
+              exit 1
+            fi
+            echo "Attempt $ATTEMPTS/$MAX_ATTEMPTS: status=$STATUS; sleeping $SLEEP_SECONDS s..."
+            sleep $SLEEP_SECONDS
+          done
+
+      - name: Cache Terraform Outputs
+        if: github.ref == 'refs/heads/master'
+        working-directory: .
+        run: |
+          bash scripts/cache_terraform_outputs.sh
+
+      - name: Verify API Health Endpoint
+        if: github.ref == 'refs/heads/master'
+        working-directory: .
+        run: |
+          bash scripts/verify_api_reachable.sh
+
+      - name: Install Package in Editable Mode
+        if: github.ref == 'refs/heads/master'
+        working-directory: .
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e .
+
+      - name: Run moral_compass Integration Tests
+        if: github.ref == 'refs/heads/master'
+        working-directory: .
+        run: |
+          python -m pip install pytest
+          pytest -m test_moral_compass_client_auth.py -v
+
+      - name: Run API Integration Tests
+        if: github.ref == 'refs/heads/master'
+        working-directory: .
+        run: |
+          API_BASE_URL=$(cd infra && terraform output -raw api_base_url)
+          echo "API Base URL: $API_BASE_URL"
+
+          if [[ -z "$API_BASE_URL" || "$API_BASE_URL" == "null" ]]; then
+            echo "❌ Failed to get API base URL from Terraform outputs"
+            exit 1
+          fi
+
+          python -m pip install --upgrade pip
+          python -m pip install requests
+
+          echo "⏳ Extra stabilization wait (30s) after GSI readiness..."
+          sleep 30
+
+          echo "🚀 Starting API Integration Tests..."
+          python tests/test_api_integration.py "$API_BASE_URL"
+
+      - name: Run Pagination Tests
+        if: github.ref == 'refs/heads/master'
+        working-directory: .
+        run: |
+          API_BASE_URL=$(cd infra && terraform output -raw api_base_url)
+          echo "API Base URL: $API_BASE_URL"
+          python -m pip install requests
+          python tests/test_api_pagination.py "$API_BASE_URL"
+
+      - name: Install Load Test Dependencies
+        if: github.ref == 'refs/heads/master' && (vars.RUN_LOAD_TESTS != 'false')
+        working-directory: .
+        run: |
+          python -m pip install aiohttp rich
+
+      - name: Run Load Tests - Single Table
+        if: github.ref == 'refs/heads/master' && (vars.RUN_LOAD_TESTS != 'false')
+        working-directory: .
+        run: |
+          API_BASE_URL=$(cd infra && terraform output -raw api_base_url)
+          export API_BASE_URL
+          echo "🚀 Running Single Table Load Test..."
+          python tests/load_single_table.py
+
+      - name: Run Load Tests - Multi Table
+        if: github.ref == 'refs/heads/master' && (vars.RUN_LOAD_TESTS != 'false')
+        working-directory: .
+        run: |
+          API_BASE_URL=$(cd infra && terraform output -raw api_base_url)
+          export API_BASE_URL
+          echo "🚀 Running Multi Table Load Test..."
+          python tests/load_multi_table.py
+
+      - name: Run Load Tests - Mixed Duration
+        if: github.ref == 'refs/heads/master' && (vars.RUN_LOAD_TESTS != 'false')
+        working-directory: .
+        env:
+          LOAD_DURATION_SECONDS: 20
+        run: |
+          API_BASE_URL=$(cd infra && terraform output -raw api_base_url)
+          export API_BASE_URL
+          echo "🚀 Running Mixed Duration Load Test (20s for CI)..."
+          python tests/load_mixed_duration.py