bedrock-agentcore-starter-toolkit 0.1.4__tar.gz → 0.2.2__tar.gz

{bedrock_agentcore_starter_toolkit-0.1.4 → bedrock_agentcore_starter_toolkit-0.2.2}/.github/workflows/deploy-docs.yml

@@ -18,12 +18,12 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0  # Fetch all history for proper versioning
 
       - name: Checkout SDK repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           repository: aws/bedrock-agentcore-sdk-python
           path: bedrock-agentcore-sdk-python
@@ -35,14 +35,14 @@ jobs:
           python-version: '3.10'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v3
+        uses: astral-sh/setup-uv@v6
 
       - name: Create virtual environment and install dependencies
         run: |
           uv venv
           source .venv/bin/activate
           uv pip install mkdocs-material mkdocstrings-python pymdown-extensions
-          uv pip install mike mkdocs-macros-plugin
+          uv pip install mike mkdocs-macros-plugin mkdocs-llmstxt mkdocs-include-markdown-plugin
 
           # Install the SDK package from PyPI
           uv pip install bedrock-agentcore

bedrock_agentcore_starter_toolkit-0.2.2/.github/workflows/integration_testing.yml

@@ -0,0 +1,168 @@
+name: Secure Integration test
+
+on:
+  push:
+    branches: [ main ]
+    tags:
+      - 'v*'
+  pull_request_target:  # Changed from pull_request
+    branches: [ main ]
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+
+jobs:
+  authorization-check:
+    permissions: read-all
+    runs-on: ubuntu-latest
+    outputs:
+      approval-env: ${{ steps.collab-check.outputs.result }}
+      should-run: ${{ steps.safety-check.outputs.result }}
+    steps:
+      - name: Checkout base branch for safety check
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
+
+      - name: Safety Check - Prevent Workflow Modification Attacks
+        id: safety-check
+        uses: actions/github-script@v7
+        with:
+          result-encoding: string
+          script: |
+            if (!context.payload.pull_request) {
+              console.log('Not a pull request, proceeding');
+              return 'true';
+            }
+
+            // Get list of changed files
+            const { data: files } = await github.rest.pulls.listFiles({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.payload.pull_request.number,
+            });
+
+            // Check if any workflow files or sensitive files are modified
+            const dangerousPatterns = [
+              /^\.github\/workflows\//,
+              /^\.github\/actions\//,
+              /conftest\.py$/,
+              /pytest\.ini$/,
+              /^tests\/conftest_mock\.py$/,
+            ];
+
+            const dangerousFiles = files.filter(file =>
+              dangerousPatterns.some(pattern => pattern.test(file.filename))
+            );
+
+            if (dangerousFiles.length > 0) {
+              console.log('⚠️ SECURITY: PR modifies sensitive files:');
+              dangerousFiles.forEach(f => console.log(`  - ${f.filename}`));
+              console.log('Manual review required before running integration tests');
+              return 'false';
+            }
+
+            console.log('✓ Safety check passed - no sensitive files modified');
+            return 'true';
+
+      - name: Collaborator Check
+        uses: actions/github-script@v7
+        id: collab-check
+        with:
+          result-encoding: string
+          script: |
+            try {
+              let username;
+              if (context.payload.pull_request) {
+                username = context.payload.pull_request.user.login;
+              } else {
+                username = context.actor;
+                console.log(`No pull request context found, checking permissions for actor: ${username}`);
+              }
+
+              const permissionResponse = await github.rest.repos.getCollaboratorPermissionLevel({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                username: username,
+              });
+              const permission = permissionResponse.data.permission;
+              const hasWriteAccess = ['write', 'admin'].includes(permission);
+              if (!hasWriteAccess) {
+                console.log(`User ${username} does not have write access to the repository (permission: ${permission})`);
+                return "manual-approval"
+              } else {
+                console.log(`Verified ${username} has write access. Auto Approving PR Checks.`)
+                return "auto-approve"
+              }
+            } catch (error) {
+              console.log(`${username} does not have write access. Requiring Manual Approval to run PR Checks.`)
+              return "manual-approval"
+            }
+
+  check-access-and-checkout:
+    runs-on: ubuntu-latest
+    needs: authorization-check
+    if: needs.authorization-check.outputs.should-run == 'true'
+    environment: ${{ needs.authorization-check.outputs.approval-env }}
+    permissions:
+      id-token: write
+      pull-requests: read
+      contents: read
+    steps:
+      - name: Configure Credentials
+        uses: aws-actions/configure-aws-credentials@v5
+        with:
+         role-to-assume: ${{ secrets.AGENTCORE_INTEG_TEST_ROLE }}
+         aws-region: us-west-2
+         mask-aws-account-id: true
+
+      - name: Checkout PR head commit
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.10'
+
+      - name: Install dependencies
+        run: |
+          pip install -e .
+          pip install --no-cache-dir pytest click
+
+      - name: Run integration tests
+        env:
+          AWS_REGION: us-west-2
+          AGENTCORE_TEST_ROLE: AgentExecutionRole
+        id: tests
+        timeout-minutes: 10
+        run: |
+          pytest tests_integ/cli -s --log-cli-level=INFO
+
+  safety-gate:
+    runs-on: ubuntu-latest
+    needs: authorization-check
+    if: needs.authorization-check.outputs.should-run == 'false'
+    permissions: {}
+    steps:
+      - name: Security Block
+        run: |
+          echo "🚨 SECURITY BLOCK: This PR modifies sensitive files"
+          echo ""
+          echo "The following types of files trigger manual review:"
+          echo "  - Workflow files (.github/workflows/)"
+          echo "  - Action files (.github/actions/)"
+          echo "  - Test setup files (conftest.py, pytest.ini)"
+          echo ""
+          echo "⚠️  Integration tests will NOT run automatically"
+          echo "👀 A maintainer must review the changes and manually trigger tests"
+          echo ""
+          echo "This is a security measure to prevent:"
+          echo "  - Workflow modification attacks"
+          echo "  - Secret exfiltration"
+          echo "  - Test manipulation"
+          exit 1

{bedrock_agentcore_starter_toolkit-0.1.4 → bedrock_agentcore_starter_toolkit-0.2.2}/.github/workflows/pr-automerge.yml

@@ -33,7 +33,7 @@ jobs:
 
             // Include ALL required checks
             const requiredChecks = [
-              'Lint',
+              'Lint and Format',
               'Test Python 3.10',
               'Test Python 3.11',
               'Test Python 3.12',

{bedrock_agentcore_starter_toolkit-0.1.4 → bedrock_agentcore_starter_toolkit-0.2.2}/.github/workflows/release.yml

@@ -41,7 +41,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -181,8 +181,6 @@ jobs:
           1. Approve and merge this PR
           2. The release workflow will automatically:
              - Build and test the package
-             - Publish to Test PyPI
-             - Wait for approval
              - Publish to PyPI
              - Create a GitHub release
              - Tag the release
@@ -206,7 +204,7 @@ jobs:
         python-version: ['3.10', '3.11', '3.12', '3.13']
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           ref: release/v${{ needs.prepare-release.outputs.version }}
 
@@ -241,7 +239,7 @@ jobs:
     if: needs.prepare-release.result == 'success'
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           ref: release/v${{ needs.prepare-release.outputs.version }}
 
@@ -294,88 +292,21 @@ jobs:
           name: dist
           path: dist/
 
-  publish-testpypi:
-    name: Publish to TestPyPI
-    needs: build
-    runs-on: ubuntu-latest
-
-    environment:
-      name: test-pypi
-      url: https://test.pypi.org/project/bedrock-agentcore-starter-toolkit/
-
-    steps:
-      - name: Download artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: dist
-          path: dist/
-
-      - name: Publish to TestPyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          repository-url: https://test.pypi.org/legacy/
-          skip-existing: true
-          password: ${{ secrets.TEST_PYPI_API_TOKEN }}
-
-      - name: Test installation from TestPyPI
-        run: |
-          sleep 60  # Wait for package to be available
-
-          # Get version from wheel filename
-          VERSION=$(ls dist/*.whl | sed -n 's/.*-\([0-9.]*\)-.*/\1/p')
-
-          # Create test environment
-          python -m venv test-install
-          source test-install/bin/activate
-
-          # Install from Test PyPI
-          pip install --index-url https://test.pypi.org/simple/ \
-            --extra-index-url https://pypi.org/simple/ \
-            bedrock-agentcore-starter-toolkit==$VERSION
-
-          # Test CLI
-          agentcore --help
-
-  release-approval:
-    name: Release Approval
-    needs: publish-testpypi
-    runs-on: ubuntu-latest
-    environment:
-      name: pypi-approval
-
-    steps:
-      - name: Approval checkpoint
-        run: |
-          echo "✓ TestPyPI deployment successful"
-          echo "✓ Package available at: https://test.pypi.org/project/bedrock-agentcore-starter-toolkit/"
-          echo ""
-          echo "⚠️  MANUAL APPROVAL REQUIRED"
-          echo ""
-          echo "Before approving production release:"
-          echo "1. Test the package from TestPyPI:"
-          echo "   pip install --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple/ bedrock-agentcore-starter-toolkit"
-          echo ""
-          echo "2. Verify the CLI works: agentcore --help"
-          echo "3. Check version number is correct"
-          echo "4. Test basic functionality"
-          echo ""
-          echo "Only approve if everything looks good!"
-
   publish-pypi:
     name: Publish to PyPI
-    needs: release-approval
+    needs: [test, build]
     runs-on: ubuntu-latest
     environment:
       name: pypi
       url: https://pypi.org/project/bedrock-agentcore-starter-toolkit/
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
       - name: Download artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           name: dist
           path: dist/
@@ -391,6 +322,20 @@ jobs:
         with:
           password: ${{ secrets.PYPI_API_TOKEN }}
 
+      - name: Wait for PyPI availability
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+
+          echo "Waiting for package to be available on PyPI..."
+          for i in {1..10}; do
+            if pip index versions bedrock-agentcore-starter-toolkit | grep -q "$VERSION"; then
+              echo "✓ Package version $VERSION is now available on PyPI"
+              break
+            fi
+            echo "Attempt $i/10: Package not yet available, waiting 30s..."
+            sleep 30
+          done
+
       - name: Create and push tag
         run: |
           git config --global user.name "github-actions[bot]"
@@ -419,7 +364,7 @@ jobs:
 
   summary:
     name: Release Summary
-    needs: publish-testpypi
+    needs: publish-pypi
     runs-on: ubuntu-latest
     if: always()
 
@@ -428,14 +373,14 @@ jobs:
         run: |
           echo "## Release Summary" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
-          if [ "${{ needs.publish-testpypi.result }}" == "success" ]; then
-            echo "✅ **Test PyPI Release Successful**" >> $GITHUB_STEP_SUMMARY
+          if [ "${{ needs.publish-pypi.result }}" == "success" ]; then
+            echo "✅ **PyPI Release Successful**" >> $GITHUB_STEP_SUMMARY
             echo "" >> $GITHUB_STEP_SUMMARY
-            echo "Package published to: https://test.pypi.org/project/bedrock-agentcore-starter-toolkit/" >> $GITHUB_STEP_SUMMARY
+            echo "Package published to: https://pypi.org/project/bedrock-agentcore-starter-toolkit/" >> $GITHUB_STEP_SUMMARY
             echo "" >> $GITHUB_STEP_SUMMARY
-            echo "To install from Test PyPI:" >> $GITHUB_STEP_SUMMARY
+            echo "To install:" >> $GITHUB_STEP_SUMMARY
             echo '```bash' >> $GITHUB_STEP_SUMMARY
-            echo "pip install --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple/ bedrock-agentcore-starter-toolkit" >> $GITHUB_STEP_SUMMARY
+            echo "pip install bedrock-agentcore-starter-toolkit" >> $GITHUB_STEP_SUMMARY
             echo '```' >> $GITHUB_STEP_SUMMARY
           else
             echo "❌ **Release Failed**" >> $GITHUB_STEP_SUMMARY

{bedrock_agentcore_starter_toolkit-0.1.4 → bedrock_agentcore_starter_toolkit-0.2.2}/.github/workflows/security-scanning.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     - name: Set up Python
       uses: actions/setup-python@v5
@@ -53,7 +53,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     - name: Set up Python
       uses: actions/setup-python@v5
@@ -93,12 +93,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
       - name: TruffleHog OSS
-        uses: trufflesecurity/trufflehog@v3.90.0
+        uses: trufflesecurity/trufflehog@v3.90.6
         with:
           path: ./
           base: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}

{bedrock_agentcore_starter_toolkit-0.1.4 → bedrock_agentcore_starter_toolkit-0.2.2}/.github/workflows/security.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     - name: Set up Python
       uses: actions/setup-python@v5
@@ -46,7 +46,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     - name: Set up Python
       uses: actions/setup-python@v5
@@ -95,12 +95,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
       - name: TruffleHog OSS
-        uses: trufflesecurity/trufflehog@v3.82.3
+        uses: trufflesecurity/trufflehog@v3.90.6
         with:
           path: ./
           base: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}

{bedrock_agentcore_starter_toolkit-0.1.4 → bedrock_agentcore_starter_toolkit-0.2.2}/.github/workflows/test-pypi-release.yml

@@ -22,7 +22,7 @@ jobs:
       url: https://test.pypi.org/p/bedrock-agentcore-starter-toolkit
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Set up Python
       uses: actions/setup-python@v5

bedrock_agentcore_starter_toolkit-0.2.2/.github/workflows/test.yml

@@ -0,0 +1,108 @@
+name: Test
+
+on:
+  pull_request:
+    branches: [ main ]
+  push:
+    branches: [ main ]
+
+permissions:
+  contents: read
+  checks: write
+  pull-requests: write
+
+jobs:
+  lint:
+    name: Lint and Format
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.10'
+
+      - name: Install uv
+        run: |
+          curl -LsSf https://astral.sh/uv/install.sh | sh
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
+
+      - name: Create virtual environment
+        run: uv venv
+
+      - name: Install dependencies
+        run: uv sync --dev
+
+      - name: Run pre-commit
+        run: uv run pre-commit run --all-files
+
+  test:
+    name: Test Python ${{ matrix.python-version }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false  # Important: don't stop on first failure
+      matrix:
+        python-version: ['3.10', '3.11', '3.12', '3.13']
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install uv
+        run: |
+          curl -LsSf https://astral.sh/uv/install.sh | sh
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
+
+      - name: Create virtual environment
+        run: uv venv
+
+      - name: Install dependencies
+        run: uv sync --dev
+
+      - name: Run tests with coverage
+        run: |
+          uv run pytest tests/ --cov=src --cov-report=xml --cov-report=term --cov-fail-under=80 \
+            -k "not test_launch_help_text_updated"
+
+      - name: Upload coverage to Codecov
+        if: matrix.python-version == '3.10'
+        uses: codecov/codecov-action@v5
+        with:
+          file: ./coverage.xml
+          flags: unittests
+          name: codecov-umbrella
+          fail_ci_if_error: false
+
+  build:
+    name: Build Package
+    runs-on: ubuntu-latest
+    needs: [lint, test]
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.10'
+
+      - name: Install uv
+        run: |
+          curl -LsSf https://astral.sh/uv/install.sh | sh
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
+
+      - name: Build package
+        run: uv build
+
+      - name: Check package
+        run: uv tool run twine check dist/*
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/

{bedrock_agentcore_starter_toolkit-0.1.4 → bedrock_agentcore_starter_toolkit-0.2.2}/.gitignore

@@ -11,7 +11,7 @@ __pycache__*
 dist
 .dockerignore
 .bedrock_agentcore.yaml
-.bedrock_agentcore/*
+.bedrock_agentcore/
 .ipynb_checkpoints
 Dockerfile
 *.iml
@@ -21,3 +21,14 @@ documentation/site
 documentation/.cache
 .agentcore.yaml
 output*/
+.serena/
+specs/
+.claude/
+.specify/
+coverage.json
+CLAUDE.md
+mise.toml
+.idea/
+!tests/create/fixtures/scenarios/
+!tests/create/fixtures/scenarios/**
+.kiro/

{bedrock_agentcore_starter_toolkit-0.1.4 → bedrock_agentcore_starter_toolkit-0.2.2}/.pre-commit-config.yaml

@@ -1,45 +1,66 @@
 repos:
-  # uv hooks
+  # ========================================
+  # PRE-COMMIT STAGE (Fast, Auto-fixing)
+  # Runs on every commit
+  # ========================================
+
+  # uv lock file management
   - repo: https://github.com/astral-sh/uv-pre-commit
-    # uv version
     rev: 0.7.13
     hooks:
-      # Keep uv.lock in sync with pyproject.toml
       - id: uv-lock
+        stages: [pre-commit]
 
-  # Code formatting and linting
+  # Code formatting and linting (FAST + AUTO-FIX)
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    # Ruff version
     rev: v0.12.0
     hooks:
-      # Run the linter
       - id: ruff
-        args: [--fix]
-      # Run the formatter
+        args: [--fix, --exit-non-zero-on-fix]
+        stages: [pre-commit]
       - id: ruff-format
+        stages: [pre-commit]
 
-  # Basic file hygiene
+  # Basic file hygiene (FAST + AUTO-FIX)
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v5.0.0
     hooks:
       - id: trailing-whitespace
+        exclude: ^tests/create/__snapshots__/.*\.ambr$
+        stages: [pre-commit]
       - id: end-of-file-fixer
+        stages: [pre-commit]
       - id: check-toml
+        stages: [pre-commit]
       - id: check-json
+        stages: [pre-commit]
+      - id: check-yaml
+        exclude: ^documentation/mkdocs\.yaml$
+        stages: [pre-commit]
       - id: check-merge-conflict
+        stages: [pre-commit]
       - id: check-added-large-files
+        args: ['--maxkb=1000']
+        stages: [pre-commit]
       - id: debug-statements
+        stages: [pre-commit]
+
+  # ========================================
+  # PRE-PUSH STAGE (Heavier checks)
+  # Runs before push
+  # ========================================
 
-  # Security checks
+  # Security scanning
   - repo: https://github.com/PyCQA/bandit
     rev: '1.7.9'
     hooks:
       - id: bandit
-        args: ['-r', 'src/']
+        args: ['-r', 'src/', '-ll']
         pass_filenames: false
         types: [python]
+        stages: [pre-push]
 
-  # Unit tests with coverage
+  # Full test suite with coverage (same as you had before)
   - repo: local
     hooks:
       - id: pytest-cov
@@ -49,6 +70,7 @@ repos:
         types: [python]
         pass_filenames: false
         always_run: true
+        stages: [pre-push]  # Moved from pre-commit to pre-push
         args: [
           --cov=src,
           --cov-report=term-missing,
@@ -58,6 +80,10 @@ repos:
           tests/
         ]
 
+# ========================================
+# Configuration
+# ========================================
+
 default_language_version:
   python: python3.10
 
@@ -74,4 +100,4 @@ ci:
   submodules: false
 
 default_install_hook_types: [pre-commit, pre-push]
-default_stages: [pre-commit, pre-push]
+default_stages: [pre-commit]