iam-policy-validator 1.10.1__tar.gz → 1.10.2__tar.gz

iam_policy_validator-1.10.2/.python-version

@@ -0,0 +1 @@
+3.13

{iam_policy_validator-1.10.1 → iam_policy_validator-1.10.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iam-policy-validator
-Version: 1.10.1
+Version: 1.10.2
 Summary: Validate AWS IAM policies for correctness and security using AWS Service Reference API
 Project-URL: Homepage, https://github.com/boogy/iam-policy-validator
 Project-URL: Documentation, https://github.com/boogy/iam-policy-validator/tree/main/docs

{iam_policy_validator-1.10.1 → iam_policy_validator-1.10.2}/action.yaml

@@ -140,7 +140,7 @@ runs:
     - name: Set up Python
       uses: actions/setup-python@cfd55ca82492758d853442341ad4d8010466803a # v6.0.0
       with:
-        python-version: "3.12"
+        python-version-file: "${{ github.action_path }}/.python-version"
 
     - name: Install uv
       uses: astral-sh/setup-uv@5a7eac68fb9809dea845d802897dc5c723910fa3 # v7.0.0
@@ -179,12 +179,31 @@ runs:
         restore-keys: |
           aws-services-${{ runner.os }}-
 
-    - name: Check cache status
+    # Github actions cache is immutable - once saved with a key, it cannot be updated
+    # Attempting to save with an existing key will silently do nothing
+    # This is why we need to update the file modification times to prevent unnecessary re-downloads for long running PRs
+    # https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#about-the-cache
+    - name: Check cache status and update timestamps
       run: |
         if [ -d ~/.cache/iam-validator/aws_services ]; then
           echo "✅ Cache directory exists"
-          echo "📁 Cache files: $(ls -1 ~/.cache/iam-validator/aws_services | wc -l)"
-          ls -lh ~/.cache/iam-validator/aws_services | head -5
+          FILE_COUNT=$(ls -1 ~/.cache/iam-validator/aws_services 2>/dev/null | wc -l)
+          echo "📁 Cache files: $FILE_COUNT"
+
+          if [ "$FILE_COUNT" -gt 0 ]; then
+            echo "📋 Sample of cached files:"
+            ls -lh ~/.cache/iam-validator/aws_services | head -5
+
+            # Update file modification times to prevent re-download due to TTL expiration
+            # GitHub Actions cache preserves original timestamps, which can cause files
+            # to appear expired even though they were just restored from cache
+            if [ "${{ steps.cache-aws-services.outputs.cache-hit }}" == "true" ]; then
+              echo ""
+              echo "🔄 Updating file modification times to prevent unnecessary re-downloads"
+              find ~/.cache/iam-validator/aws_services -type f -name "*.json" -exec touch {} +
+              echo "✅ Updated timestamps for cache hit"
+            fi
+          fi
         else
           echo "❌ Cache directory does not exist - will fetch from API"
         fi
@@ -450,7 +469,10 @@ runs:
       shell: bash
 
     - name: Save AWS service definitions cache
-      if: always()
+      # Only save cache if it was not restored (cache miss)
+      # GitHub Actions cache is immutable - once saved with a key, it cannot be updated
+      # Attempting to save with an existing key will silently do nothing
+      if: steps.cache-aws-services.outputs.cache-hit != 'true'
       uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: ~/.cache/iam-validator/aws_services

{iam_policy_validator-1.10.1 → iam_policy_validator-1.10.2}/iam_validator/__version__.py

@@ -3,7 +3,7 @@
 This file is the single source of truth for the package version.
 """
 
-__version__ = "1.10.1"
+__version__ = "1.10.2"
 # Parse version, handling pre-release suffixes like -rc, -alpha, -beta
-_version_base = __version__.split("-")[0]  # Remove pre-release suffix if present
+_version_base = __version__.split("-", maxsplit=1)[0]  # Remove pre-release suffix if present
 __version_info__ = tuple(int(part) for part in _version_base.split("."))

{iam_policy_validator-1.10.1 → iam_policy_validator-1.10.2}/iam_validator/core/aws_service/fetcher.py

@@ -233,8 +233,16 @@ class AWSServiceFetcher:
             await self._cache.set(services_cache_key, loaded_services)
             return loaded_services
 
-        # Not in parsed cache, fetch the raw data from API
-        data = await self._client.fetch(self.BASE_URL)
+        # Not in parsed cache, check disk cache then fetch from API
+        data = await self._cache.get(
+            f"raw:{self.BASE_URL}", url=self.BASE_URL, base_url=self.BASE_URL
+        )
+        if data is None:
+            data = await self._client.fetch(self.BASE_URL)
+            # Cache the raw data
+            await self._cache.set(
+                f"raw:{self.BASE_URL}", data, url=self.BASE_URL, base_url=self.BASE_URL
+            )
 
         if not isinstance(data, list):
             raise ValueError("Expected list of services from root endpoint")
@@ -247,7 +255,7 @@ class AWSServiceFetcher:
                 if service and url:
                     services.append(ServiceInfo(service=str(service), url=str(url)))
 
-        # Cache the parsed services list (memory only - raw JSON already cached by client)
+        # Cache the parsed services list (memory only)
         await self._cache.set(services_cache_key, services)
 
         # Log only on first fetch (when parsed cache was empty)
@@ -312,13 +320,22 @@ class AWSServiceFetcher:
 
         for service in services:
             if service.service.lower() == service_name_lower:
-                # Fetch service detail from API
-                data = await self._client.fetch(service.url)
+                # Check disk cache first, then fetch from API
+                data = await self._cache.get(
+                    f"raw:{service.url}", url=service.url, base_url=self.BASE_URL
+                )
+                if data is None:
+                    # Fetch service detail from API
+                    data = await self._client.fetch(service.url)
+                    # Cache the raw data
+                    await self._cache.set(
+                        f"raw:{service.url}", data, url=service.url, base_url=self.BASE_URL
+                    )
 
                 # Validate and parse
                 service_detail = ServiceDetail.model_validate(data)
 
-                # Cache with service name as key (memory only - raw JSON already cached by client)
+                # Cache with service name as key (memory only)
                 await self._cache.set(cache_key, service_detail)
 
                 return service_detail
@@ -550,7 +567,7 @@ class AWSServiceFetcher:
         if action_pattern in ("*", "*:*"):
             return ["*"]
 
-        service_prefix, action_name = self._parser.parse_action(action_pattern)
+        service_prefix, _ = self._parser.parse_action(action_pattern)
         service_detail = await self.fetch_service_by_name(service_prefix)
         available = list(service_detail.actions.keys())
         return self._parser.expand_wildcard_to_actions(action_pattern, available, service_prefix)

{iam_policy_validator-1.10.1 → iam_policy_validator-1.10.2}/iam_validator/core/aws_service/validators.py

@@ -94,9 +94,7 @@ class ServiceValidator:
                 if not allow_wildcards:
                     return False, "Wildcard actions are not allowed", True
 
-                has_matches, matched_actions = self._parser.match_wildcard_action(
-                    action_name, available_actions
-                )
+                has_matches, _ = self._parser.match_wildcard_action(action_name, available_actions)
 
                 if has_matches:
                     # Wildcard is valid and matches at least one action
@@ -161,7 +159,7 @@ class ServiceValidator:
                 get_global_conditions,
             )
 
-            service_prefix, action_name = self._parser.parse_action(action)
+            _, action_name = self._parser.parse_action(action)
 
             # Check if it's a global condition key
             is_global_key = False
@@ -323,7 +321,7 @@ class ServiceValidator:
             >>> resources = validator.get_resources_for_action("s3:GetObject", service)
         """
         try:
-            _, action_name = self._parser.parse_action(action)
+            _, action_name = self._parser.parse_action(action)  # pylint: disable=unused-variable
 
             # Find the action (case-insensitive)
             action_detail = service_detail.actions.get(action_name)

{iam_policy_validator-1.10.1 → iam_policy_validator-1.10.2}/iam_validator/sdk/policy_utils.py

@@ -199,7 +199,7 @@ def extract_condition_keys(policy: IAMPolicy) -> list[str]:
     for stmt in policy.statement:
         if stmt.condition:
             # Condition format: {"StringEquals": {"aws:username": "johndoe"}}
-            for operator, key_values in stmt.condition.items():
+            for _, key_values in stmt.condition.items():
                 if isinstance(key_values, dict):
                     condition_keys.update(key_values.keys())
 
@@ -225,7 +225,7 @@ def find_statements_with_action(policy: IAMPolicy, action: str) -> list[Statemen
         >>> for stmt in stmts:
         ...     print(f"Statement {stmt.sid} allows s3:GetObject")
     """
-    import fnmatch
+    import fnmatch  # pylint: disable=import-outside-toplevel
 
     matching_statements = []
 
@@ -262,7 +262,7 @@ def find_statements_with_resource(policy: IAMPolicy, resource: str) -> list[Stat
         >>> stmts = find_statements_with_resource(policy, "arn:aws:s3:::my-bucket/*")
         >>> print(f"Found {len(stmts)} statements with this resource")
     """
-    import fnmatch
+    import fnmatch  # pylint: disable=import-outside-toplevel
 
     matching_statements = []
 

{iam_policy_validator-1.10.1 → iam_policy_validator-1.10.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "iam-policy-validator"
-version = "1.10.1"
+version = "1.10.2"
 description = "Validate AWS IAM policies for correctness and security using AWS Service Reference API"
 readme = "README.md"
 requires-python = ">=3.10"

{iam_policy_validator-1.10.1 → iam_policy_validator-1.10.2}/uv.lock

@@ -284,7 +284,7 @@ wheels = [
 
 [[package]]
 name = "iam-policy-validator"
-version = "1.10.0"
+version = "1.10.2"
 source = { editable = "." }
 dependencies = [
     { name = "boto3" },

iam_policy_validator-1.10.1/.python-version

@@ -1 +0,0 @@
-3.12