aws-test-plugin 0.1.2__tar.gz → 0.1.3__tar.gz

{aws_test_plugin-0.1.2 → aws_test_plugin-0.1.3}/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "claude-aws-test-plugin",
       "source": "./",
       "description": "Generates E2E, integration, contract, performance, and load tests by reading actual handler code.",
-      "version": "0.1.2"
+      "version": "0.1.3"
     }
   ]
 }

{aws_test_plugin-0.1.2 → aws_test_plugin-0.1.3}/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "aws-test-plugin",
   "description": "AI-powered test generation skills for AWS Python projects — Lambda, API Gateway, Step Functions, and Batch. Generates E2E, integration, contract, performance, and load tests by reading actual handler code.",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "author": {
     "name": "whitewhiteqq"
   },

aws_test_plugin-0.1.3/.github/dependabot.yml

@@ -0,0 +1,21 @@
+version: 2
+
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns:
+          - "*"
+
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      dev-deps:
+        dependency-type: development
+      prod-deps:
+        dependency-type: production

aws_test_plugin-0.1.3/.github/workflows/ci.yml

@@ -0,0 +1,156 @@
+name: CI
+
+on:
+  pull_request:
+    branches:
+      - main
+      - develop
+  push:
+    branches:
+      - '**'
+
+permissions:
+  contents: read
+
+jobs:
+  lockfile:
+    name: Lockfile Check
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+
+      - name: Verify lockfile is up-to-date
+        run: uv lock --check
+
+  test:
+    name: Test (Python ${{ matrix.python-version }})
+    needs: [lockfile]
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          python-version: ${{ matrix.python-version }}
+          enable-cache: true
+
+      - name: Sync dependencies
+        run: uv sync --frozen
+
+      - name: Run tests
+        run: uv run pytest tests/ -v
+
+  lint:
+    name: Lint
+    needs: [lockfile]
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          python-version: "3.12"
+          enable-cache: true
+
+      - name: Sync dependencies (no sdist builds)
+        run: uv sync --frozen --no-build --no-install-project
+
+      - name: Ruff check
+        run: uv run --no-sync ruff check src tests
+
+      - name: Ruff format check
+        run: uv run --no-sync ruff format --check src tests
+
+  typecheck:
+    name: Type Check
+    needs: [lockfile]
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          python-version: "3.12"
+          enable-cache: true
+
+      - name: Sync dependencies (no sdist builds)
+        run: uv sync --frozen --no-build --no-install-project
+
+      - name: Run mypy
+        run: uv run --no-sync mypy src
+
+  security:
+    name: Security
+    needs: [lockfile]
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          python-version: "3.12"
+          enable-cache: true
+
+      - name: Sync dependencies (no sdist builds)
+        run: uv sync --frozen --no-build --no-install-project
+
+      - name: Run Bandit
+        run: uv run --no-sync bandit -q -c pyproject.toml -r src
+
+      - name: Run pip-audit
+        run: |
+          # CVE-2026-4539: ReDoS in pygments AdlLexer (archetype.py).
+          # Local-access-only; no fix version exists yet; pygments is a
+          # transitive dep of bandit/rich and is not shipped to users.
+          # Remove this ignore once a patched pygments is released.
+          #
+          # CVE-2026-25645: requests 2.32.5 — blocked by exclude-newer
+          # cooldown; fix is in 2.33.0.  requests is an optional e2e dep
+          # (not installed in default CI runs).  Remove once 2.33.0 clears
+          # the 14-day window.
+          uv run --no-sync pip-audit --ignore-vuln CVE-2026-4539 --ignore-vuln CVE-2026-25645
+
+  typecheck-ty:
+    name: Type Check (ty)
+    needs: [lockfile]
+    runs-on: ubuntu-latest
+    continue-on-error: true  # ty is non-blocking while stabilising; promote to blocking when mypy is removed
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          python-version: "3.12"
+          enable-cache: true
+
+      - name: Sync dependencies (no sdist builds)
+        run: uv sync --frozen --no-build --no-install-project
+
+      - name: Run ty
+        run: uv run --no-sync ty check src

aws_test_plugin-0.1.3/.github/workflows/publish.yml

@@ -0,0 +1,54 @@
+name: Publish to PyPI
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+  id-token: write       # Required for trusted publishing
+  attestations: write   # Required for build provenance
+
+jobs:
+  publish:
+    name: Build & Publish to PyPI
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/aws-test-plugin
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Verify tag matches package version
+        run: |
+          VERSION=$(grep '^version = ' pyproject.toml | sed 's/version = "\(.*\)"/\1/')
+          TAG="${GITHUB_REF_NAME}"
+          if [ "v${VERSION}" != "${TAG}" ]; then
+            echo "::error::Tag '${TAG}' does not match package version 'v${VERSION}'"
+            exit 1
+          fi
+          echo "Tag '${TAG}' matches package version '${VERSION}' — proceeding"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          python-version: "3.12"
+
+      - name: Build package
+        run: uv build
+
+      - name: Smoke test
+        run: |
+          WHEEL=$(ls dist/*.whl)
+          uv run --no-project --with "$WHEEL" -- python -c "import aws_test_plugin; print('Smoke test passed')"
+
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
+        with:
+          subject-path: dist/*
+
+      - name: Publish to PyPI
+        run: uv publish --trusted-publishing always
+

aws_test_plugin-0.1.3/CLAUDE.md

@@ -0,0 +1,157 @@
+# CLAUDE.md — Agent Instructions for aws-test-plugin
+
+This file is read by Claude Code before any operation in this repository.
+Follow all rules here in addition to the instructions in `src/aws_test_plugin/AGENTS.md`.
+
+## Commands
+
+```bash
+# Sync dependencies (after cloning or pulling)
+uv sync --locked
+
+# Run all tests
+uv run pytest tests/ -v
+
+# Lint — check mode (CI)
+uv run ruff check src tests
+uv run ruff format --check src tests
+
+# Lint — fix mode (local dev: always fix before format)
+uv run ruff check --fix src tests
+uv run ruff format src tests
+
+# Type checking — ty is the primary checker (fast, replaces mypy)
+uv run ty check src
+
+# Type checking — mypy (secondary; kept for compatibility)
+uv run mypy src
+
+# Security scans
+uv run bandit -q -c pyproject.toml -r src
+# CVE-2026-4539: pygments ReDoS (local-only, no fix yet) — remove ignore once patched
+# CVE-2026-25645: requests 2.32.5 — fix in 2.33.0, blocked by exclude-newer cooldown
+uv run pip-audit --ignore-vuln CVE-2026-4539 --ignore-vuln CVE-2026-25645
+
+# Verify lockfile is up to date (must pass before any commit)
+uv lock --check
+
+# Regenerate lockfile when pyproject.toml changes
+uv lock
+```
+
+## Change Workflow
+
+Every change, regardless of size, follows this sequence:
+
+1. **Branch** — `git checkout -b feat/<name>` or `fix/<name>` from `develop`
+2. **Implement** — make the change
+3. **Docs review** — ask: does this change affect README.md, CONTRIBUTING.md, or CLAUDE.md?
+   - CI/CD changes → update CLAUDE.md (Commands section) if any command changes
+   - Dependency changes → update README.md and CONTRIBUTING.md if setup steps change
+   - Workflow/process changes → update CLAUDE.md (relevant section)
+   - `src/` public API changes → update README.md usage examples
+4. **Version bump** — see Version Policy below
+5. **Local checks** — must all pass before committing:
+   ```bash
+   uv lock --check
+   uv run ruff check src tests
+   uv run ruff format --check src tests
+   uv run ty check src        # or: uv run mypy src
+   uv run pytest tests/ -v
+   uv run bandit -q -c pyproject.toml -r src
+   uv run pip-audit --ignore-vuln CVE-2026-4539 --ignore-vuln CVE-2026-25645
+   ```
+6. **Commit** — conventional commit with full body for non-trivial changes
+7. **PR → develop → main** — follow Branch Strategy below
+
+## Version Policy
+
+Bump the version in `pyproject.toml` (and run `uv lock`) only when the
+**installed package changes**:
+
+| Change type | Bump? |
+|---|---|
+| `src/aws_test_plugin/` code change | **Yes** |
+| Runtime dep added/removed/changed (`[project.dependencies]`) | **Yes** |
+| Dev dep change (`[dependency-groups] dev`) | No |
+| CI/CD workflow change (`.github/`) | No |
+| Docs only (`README.md`, `CONTRIBUTING.md`, `CLAUDE.md`) | No |
+| Tool config (`[tool.ruff]`, `[tool.ty]`, etc.) | No |
+| `skills/`, `agents/` content | No |
+
+Version follows [Semantic Versioning](https://semver.org/):
+- **patch** (0.1.x) — bug fixes, no API change
+- **minor** (0.x.0) — new backward-compatible features
+- **major** (x.0.0) — breaking changes
+
+## Pre-Commit Enforcement
+
+**Always run `uv lock --check` before committing.**
+If it reports that `uv.lock` needs updating, run `uv lock` first, stage
+`uv.lock`, and include it in the same commit as the `pyproject.toml` change.
+
+Never commit a stale lockfile. The CI `lockfile` job runs `uv lock --check`
+on every push and pull request; a stale lockfile will block the entire
+pipeline.
+
+Triggers that require `uv lock`:
+- Any edit to `pyproject.toml` (adding, removing, or changing a dependency)
+- Any uv or Python version bump
+
+## Branch Strategy
+
+Releases follow exactly one path:
+
+```
+feature/fix branch  →  develop  →  main  →  annotated tag  →  GitHub Release  →  PyPI
+```
+
+- **Never push directly to `main` or `develop`.**
+- Branch from `develop` for all changes: `git checkout -b feat/<name> origin/develop`
+- Open a pull request targeting `develop`.
+- Release promotion: maintainer runs `git merge --ff-only develop` from `main`
+  locally, then pushes. No GitHub merge button for main promotion.
+- PyPI publish is triggered only by creating a GitHub Release targeting a
+  version tag on `main`.
+
+## Commit Message Style
+
+Use Conventional Commits. For non-trivial changes include the full body:
+
+```
+type(scope): short imperative summary
+
+INTENTION:
+WHAT CHANGED:
+WHY:
+ALTERNATIVES CONSIDERED:
+REFS:
+VERIFIED:
+```
+
+See `CONTRIBUTING.md` for the full template and examples.
+
+## Project Layout
+
+```
+aws-test-plugin/
+├── CLAUDE.md                         # This file — agent instructions
+├── CONTRIBUTING.md                   # Human + AI contributor guide
+├── pyproject.toml                    # Project metadata and deps
+├── uv.lock                           # Locked dependency graph (never stale)
+├── skills/                           # Skill definitions
+├── agents/                           # Agent definitions
+├── src/aws_test_plugin/
+│   ├── __init__.py
+│   ├── cli.py
+│   ├── AGENTS.md                     # Codex-compatible instructions
+│   └── scripts/
+└── tests/
+```
+
+## Safety
+
+- Never run E2E or load tests against production without confirmation.
+- Never hardcode secrets. Use `.env` (gitignored) or AWS Secrets Manager/SSM.
+- All test data uses prefixes: `TEST-`, `E2E-TEST-`, `LOAD-TEST-`.
+- Integration tests use moto — no real AWS calls.

{aws_test_plugin-0.1.2 → aws_test_plugin-0.1.3}/CONTRIBUTING.md

@@ -12,7 +12,7 @@ cd aws-test-plugin
 # macOS/Linux: curl -LsSf https://astral.sh/uv/install.sh | sh
 
 # Install with dev dependencies
-uv sync
+uv sync --locked
 
 # Run tests
 uv run pytest tests/ -v
@@ -21,18 +21,46 @@ uv run pytest tests/ -v
 uv run ruff check src tests
 uv run ruff format --check src tests
 
-# Type checking
+# Type checking — ty is the primary checker (fast, replaces mypy)
+uv run ty check src
+
+# Type checking — mypy (secondary; kept for compatibility)
 uv run mypy src
 
 # Security scans
 uv run bandit -q -c pyproject.toml -r src
-uv run pip-audit
+# CVE-2026-4539: pygments ReDoS (local-only, no fix yet) — remove ignore once patched
+uv run pip-audit --ignore-vuln CVE-2026-4539
+
+# Verify lockfile is up to date (must pass before any commit)
+uv lock --check
+
+# Regenerate lockfile when pyproject.toml changes
+uv lock
 ```
 
+## Lockfile Discipline
+
+`uv.lock` must never be stale in the repository. The CI `lockfile` job runs
+`uv lock --check` on every push and pull request; a stale lockfile fails the
+entire pipeline before any test or lint job runs.
+
+**Rule: run `uv lock --check` before every commit. If it reports the lockfile
+needs updating, run `uv lock`, stage `uv.lock`, and include it in the same
+commit as the `pyproject.toml` change.**
+
+Triggers that require `uv lock`:
+- Any edit to `pyproject.toml` (adding, removing, or bumping a dependency)
+- Any change to the `requires-python` field or Python version target
+- Pulling changes from `origin` that modify `pyproject.toml`
+
 ## Project Structure
 
 ```
 aws-test-plugin/
+├── CLAUDE.md                       # Agent instructions (Claude Code / Copilot)
+├── pyproject.toml                  # Project metadata and deps
+├── uv.lock                         # Locked dependency graph (never stale)
 ├── skills/                         # Skill definitions (auto-discovered by npx skills add)
 │   ├── aws-test-orchestrator/SKILL.md
 │   ├── aws-e2e-testing/            # SKILL.md + references/
@@ -263,7 +291,7 @@ must also land in the commit messages that enter `develop`.
 2. Create a feature branch from `develop`: `git checkout -b feat/new-pattern origin/develop`
 3. Make your changes
 4. Rebase your branch on the latest `origin/develop` before opening or updating the pull request
-5. Run local quality checks: `uv run pytest tests/ -v`, `uv run ruff check src tests`, `uv run ruff format --check src tests`, `uv run mypy src`, `uv run bandit -q -c pyproject.toml -r src`, and `uv run pip-audit`
+5. Run local quality checks: `uv lock --check` (regenerate with `uv lock` if stale), `uv run pytest tests/ -v`, `uv run ruff check src tests`, `uv run ruff format --check src tests`, `uv run mypy src`, `uv run bandit -q -c pyproject.toml -r src`, and `uv run pip-audit`
 6. Submit a pull request to `develop` using `.github/pull_request_template.md`
 7. Merge pull requests with `Rebase and merge` (preferred — preserves individual commit reasoning) or `Squash and merge` (only when intermediate commits are noise); do not use merge commits
 8. Release `develop` to `main` with a maintainer-run fast-forward update after CI passes on `develop`; use `git merge --ff-only develop` from a local checkout of `main` so `main` advances without rewriting or duplicating commit history

{aws_test_plugin-0.1.2 → aws_test_plugin-0.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: aws-test-plugin
-Version: 0.1.2
+Version: 0.1.3
 Summary: AI-powered test generation skills for AWS Python projects — works with Claude Code, GitHub Copilot, and Codex
 Project-URL: Homepage, https://github.com/whitewhiteqq/aws-test-plugin
 Project-URL: Repository, https://github.com/whitewhiteqq/aws-test-plugin
@@ -265,7 +265,9 @@ This plugin doesn't fill in templates — it reads your **actual code** and gene
 aws-test-plugin/
 ├── .claude-plugin/
 │   └── plugin.json               # Claude Code plugin manifest
+├── CLAUDE.md                     # Agent instructions (Claude Code / Copilot)
 ├── pyproject.toml                # uv/pip package config
+├── uv.lock                       # Locked dependency graph (never stale)
 ├── LICENSE                       # Apache 2.0
 ├── README.md
 ├── CONTRIBUTING.md
@@ -306,21 +308,30 @@ git clone https://github.com/whitewhiteqq/aws-test-plugin.git
 cd aws-test-plugin
 
 # Install with uv (creates .venv automatically)
-uv sync
+uv sync --locked
 
 # Run tests
 uv run pytest tests/ -v
 
 # Lint
-uv run ruff check src/
-uv run ruff format --check src/
+uv run ruff check src tests
+uv run ruff format --check src tests
 
-# Type checking
-uv run mypy src/
+# Type checking — ty is the primary checker (fast, replaces mypy)
+uv run ty check src
+
+# Type checking — mypy (secondary; kept for compatibility)
+uv run mypy src
 
 # Security scans
-uv run bandit -q -c pyproject.toml -r src/
+uv run bandit -q -c pyproject.toml -r src
 uv run pip-audit
+
+# Verify lockfile is up to date (must pass before any commit)
+uv lock --check
+
+# Regenerate lockfile when pyproject.toml changes
+uv lock
 ```
 
 See [CONTRIBUTING.md](CONTRIBUTING.md) for details.

{aws_test_plugin-0.1.2 → aws_test_plugin-0.1.3}/README.md

@@ -203,7 +203,9 @@ This plugin doesn't fill in templates — it reads your **actual code** and gene
 aws-test-plugin/
 ├── .claude-plugin/
 │   └── plugin.json               # Claude Code plugin manifest
+├── CLAUDE.md                     # Agent instructions (Claude Code / Copilot)
 ├── pyproject.toml                # uv/pip package config
+├── uv.lock                       # Locked dependency graph (never stale)
 ├── LICENSE                       # Apache 2.0
 ├── README.md
 ├── CONTRIBUTING.md
@@ -244,21 +246,30 @@ git clone https://github.com/whitewhiteqq/aws-test-plugin.git
 cd aws-test-plugin
 
 # Install with uv (creates .venv automatically)
-uv sync
+uv sync --locked
 
 # Run tests
 uv run pytest tests/ -v
 
 # Lint
-uv run ruff check src/
-uv run ruff format --check src/
+uv run ruff check src tests
+uv run ruff format --check src tests
 
-# Type checking
-uv run mypy src/
+# Type checking — ty is the primary checker (fast, replaces mypy)
+uv run ty check src
+
+# Type checking — mypy (secondary; kept for compatibility)
+uv run mypy src
 
 # Security scans
-uv run bandit -q -c pyproject.toml -r src/
+uv run bandit -q -c pyproject.toml -r src
 uv run pip-audit
+
+# Verify lockfile is up to date (must pass before any commit)
+uv lock --check
+
+# Regenerate lockfile when pyproject.toml changes
+uv lock
 ```
 
 See [CONTRIBUTING.md](CONTRIBUTING.md) for details.

{aws_test_plugin-0.1.2 → aws_test_plugin-0.1.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "aws-test-plugin"
-version = "0.1.2"
+version = "0.1.3"
 description = "AI-powered test generation skills for AWS Python projects — works with Claude Code, GitHub Copilot, and Codex"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -84,6 +84,9 @@ Issues = "https://github.com/whitewhiteqq/aws-test-plugin/issues"
 requires = ["hatchling"]
 build-backend = "hatchling.build"
 
+[tool.uv]
+exclude-newer = "14 days"
+
 [tool.hatch.build.targets.wheel]
 packages = ["src/aws_test_plugin"]
 
@@ -110,6 +113,16 @@ warn_unused_configs = true
 show_error_codes = true
 pretty = true
 
+[tool.ty.environment]
+python-version = "3.12"
+
+[tool.ty.src]
+include = ["src/**/*.py"]
+
+[tool.ty.rules]
+# Promoted to error once ty reaches feature parity with mypy
+possibly-unresolved-reference = "warn"
+
 [tool.pytest.ini_options]
 testpaths = ["tests"]
 pythonpath = ["src"]
@@ -128,6 +141,7 @@ dev = [
     "pytest-cov>=5.0",
     "ruff>=0.4.0",
     "mypy>=1.0",
+    "ty>=0.0.0a1",
     "types-defusedxml",
     "bandit[toml]>=1.7.9",
     "pip-audit>=2.8.0",

{aws_test_plugin-0.1.2 → aws_test_plugin-0.1.3}/skills/aws-contract-testing/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: aws-contract-testing
+license: Apache-2.0
 description: >
   Generate contract tests that validate API schemas, request/response shapes,
   required fields, security definitions, and step function input/output

{aws_test_plugin-0.1.2 → aws_test_plugin-0.1.3}/skills/aws-e2e-testing/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: aws-e2e-testing
+license: Apache-2.0
 description: >
   Generate comprehensive end-to-end tests for AWS Python services by reading
   the actual handler code logic. Covers API Gateway Lambda proxies,

{aws_test_plugin-0.1.2 → aws_test_plugin-0.1.3}/skills/aws-integration-testing/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: aws-integration-testing
+license: Apache-2.0
 description: >
   Generate comprehensive integration tests for AWS Python Lambda functions,
   Batch jobs, and services that interact with S3, DynamoDB, RDS/PostgreSQL,

{aws_test_plugin-0.1.2 → aws_test_plugin-0.1.3}/skills/aws-perf-load-testing/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: aws-perf-load-testing
+license: Apache-2.0
 description: >
   Generate performance benchmarks and load tests for AWS Python services.
   Performance tests measure Lambda latency, memory usage, cold start time,

{aws_test_plugin-0.1.2 → aws_test_plugin-0.1.3}/skills/aws-test-orchestrator/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: aws-test-orchestrator
+license: Apache-2.0
 description: >
   Master skill for testing AWS Python projects. Discovers project components
   (Lambda, API Gateway, Step Functions, Batch), reads handler code logic,

{aws_test_plugin-0.1.2 → aws_test_plugin-0.1.3}/skills/aws-unit-testing/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: aws-unit-testing
+license: Apache-2.0
 description: >
   Generate thorough unit tests for AWS Python business logic with full branch
   coverage, boundary value analysis, and edge case testing. Isolates pure