repro-lambda 0.1.0__tar.gz

repro_lambda-0.1.0/.github/workflows/build.yml

@@ -0,0 +1,98 @@
+name: build-lambdas (reusable)
+
+on:
+  workflow_call:
+    inputs:
+      manifest_path:
+        type: string
+        default: lambdas.toml
+        description: Path to lambdas.toml in the caller repo.
+      repro_lambda_version:
+        type: string
+        default: "0.1.0"
+        description: Pinned repro-lambda PyPI version.
+    secrets:
+      aws-dev-role-arn:
+        required: true
+      aws-prod-role-arn:
+        required: false
+
+jobs:
+  detect-arches:
+    runs-on: ubuntu-24.04
+    outputs:
+      arches: ${{ steps.parse.outputs.arches }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v3
+      - id: parse
+        shell: bash
+        run: |
+          uv run python - <<'PY'
+          import json, os, sys
+          try:
+              import tomllib
+          except ImportError:
+              import tomli as tomllib
+          with open("${{ inputs.manifest_path }}", "rb") as f:
+              data = tomllib.load(f)
+          arches = sorted({l["arch"] for l in data.get("lambda", [])})
+          with open(os.environ["GITHUB_OUTPUT"], "a") as f:
+              f.write(f"arches={json.dumps(arches)}\n")
+          PY
+
+  build:
+    needs: detect-arches
+    strategy:
+      fail-fast: false
+      matrix:
+        arch: ${{ fromJSON(needs.detect-arches.outputs.arches) }}
+    runs-on: ${{ matrix.arch == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-24.04' }}
+    permissions:
+      id-token: write
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v3
+
+      - name: Install repro-lambda
+        run: uv pip install --system "repro-lambda==${{ inputs.repro_lambda_version }}"
+
+      - name: Configure AWS credentials (dev)
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.aws-dev-role-arn }}
+          aws-region: eu-west-1
+
+      - name: Build (dev bucket)
+        env:
+          REPRO_LAMBDA_BUCKET: dev-ctf-lambda-artifacts
+        run: repro-lambda build --manifest "${{ inputs.manifest_path }}"
+
+      - name: Verify reproducible (PR only)
+        if: github.event_name == 'pull_request'
+        run: repro-lambda build --manifest "${{ inputs.manifest_path }}" --verify --dry-run
+
+      - name: Configure AWS credentials (prod)
+        if: github.ref == 'refs/heads/master' && secrets.aws-prod-role-arn != ''
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.aws-prod-role-arn }}
+          aws-region: eu-west-1
+
+      - name: Build (prod bucket)
+        if: github.ref == 'refs/heads/master' && secrets.aws-prod-role-arn != ''
+        env:
+          REPRO_LAMBDA_BUCKET: prod-ctf-lambda-artifacts
+        run: repro-lambda build --manifest "${{ inputs.manifest_path }}"
+
+      - name: Commit catalog drift (master only, dev bot)
+        if: github.ref == 'refs/heads/master'
+        run: |
+          if [[ -n "$(git status --porcelain builds/catalog.json)" ]]; then
+            git config user.email "github-actions[bot]@users.noreply.github.com"
+            git config user.name "github-actions[bot]"
+            git add builds/catalog.json
+            git commit -m "chore(catalog): auto-update after build [skip ci]"
+            git push
+          fi

repro_lambda-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,22 @@
+name: ci
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  lint-and-test:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v3
+        with:
+          enable-cache: true
+      - run: uv sync --all-extras
+      - name: ruff format
+        run: uv run ruff format --check src tests
+      - name: ruff check
+        run: uv run ruff check src tests
+      - name: pytest (no docker)
+        run: uv run pytest -v -m "not docker"

repro_lambda-0.1.0/.github/workflows/publish.yml

@@ -0,0 +1,33 @@
+name: publish
+
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  build-and-publish:
+    runs-on: ubuntu-24.04
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v3
+      - run: uv sync --all-extras
+
+      - name: Verify tag matches package version
+        run: |
+          TAG="${GITHUB_REF#refs/tags/v}"
+          PKG=$(uv run python -c "import repro_lambda; print(repro_lambda.__version__)")
+          if [[ "$TAG" != "$PKG" ]]; then
+            echo "tag $TAG != package version $PKG" >&2
+            exit 1
+          fi
+
+      - name: Build sdist + wheel
+        run: uv build
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist/

repro_lambda-0.1.0/.gitignore

@@ -0,0 +1,18 @@
+.venv/
+__pycache__/
+*.pyc
+.pytest_cache/
+.ruff_cache/
+*.egg-info/
+dist/
+build/
+.coverage
+*.zip
+
+# Local-only tooling state (never published to public remote)
+.beads/
+.dolt/
+.beads-credential-key
+.claude/
+AGENTS.md
+CLAUDE.md

repro_lambda-0.1.0/.pre-commit-config.yaml

@@ -0,0 +1,15 @@
+repos:
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.5.7
+    hooks:
+      - id: ruff-format
+      - id: ruff
+        args: [--fix]
+  - repo: local
+    hooks:
+      - id: pytest
+        name: pytest
+        entry: uv run pytest -m "not docker"
+        language: system
+        pass_filenames: false
+        stages: [pre-push]

repro_lambda-0.1.0/CHANGELOG.md

@@ -0,0 +1,26 @@
+# Changelog
+
+## v0.1.0 — 2026-05-27
+
+Initial public release.
+
+### Features
+
+- Python 3.11/3.12/3.13 Lambda packaging with `pip install --require-hashes`
+- Byte-reproducible zips via deterministic `zipfile.ZipFile` writes
+  (sorted entries, fixed mtime 1980-01-01, 0o755 dirs / 0o644 files / 0o755 executables)
+- Content-hash sha256 cache key (source tree + lockfile + spec + base image digest + builder version)
+- Idempotent S3 upload via `If-None-Match=*`, designed for bucket-policy-enforced immutability
+- `--verify` two-pass byte-reproducibility check
+- `--dry-run` for hash + catalog inspection
+- `--allow-dirty` for local iteration
+- `builds/catalog.json` with bounded 10-entry history per lambda
+- Per-arch lockfile generation via `uv pip compile`
+- Reusable GitHub Actions workflow at `.github/workflows/build.yml`
+- Native arm64 + x86_64 build matrix (no QEMU)
+
+### Not yet supported (planned for v0.2)
+
+- Node.js / npm packaging
+- Lambda@Edge-specific constraints (us-east-1 routing, no env vars)
+- Rust runtime

repro_lambda-0.1.0/LICENSE

@@ -0,0 +1,177 @@
+Apache License
+Version 2.0, January 2004
+
+http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+   "License" shall mean the terms and conditions for use, reproduction,
+   and distribution as defined in Sections 1 through 9 of this document.
+
+   "Licensor" shall mean the copyright owner or entity authorized by
+   the copyright owner that is granting the License.
+
+   "Legal Entity" shall mean the union of the acting entity and all
+   other entities that control, are controlled by, or are under common
+   control with that entity. For the purposes of this definition,
+   "control" means (i) the power, direct or indirect, to cause the
+   direction or management of such entity, whether by contract or
+   otherwise, or (ii) ownership of fifty percent (50%) or more of the
+   outstanding shares, or (iii) beneficial ownership of such entity.
+
+   "You" (or "Your") shall mean an individual or Legal Entity exercising
+   permissions granted by this License.
+
+   "Source" form shall mean the preferred form for making modifications,
+   including but not limited to software source code, documentation
+   source, and configuration files.
+
+   "Object" form shall mean any form resulting from mechanical
+   transformation or translation of a Source form, including but
+   not limited to compiled object code, generated documentation,
+   and conversions to other media types.
+
+   "Work" shall mean the work of authorship, whether in Source or Object
+   form, made available under the License, as indicated by a copyright
+   notice that is included in or attached to the work (an example is
+   provided in the Appendix below).
+
+   "Derivative Works" shall mean any work, whether in Source or Object
+   form, that is based on (or derived from) the Work and for which the
+   editorial revisions, annotations, elaborations, or other modifications
+   represent, as a whole, an original work of authorship. For the purposes
+   of this License, Derivative Works shall not include works that remain
+   separable from, or merely link (or bind by name) to the interfaces of,
+   the Work and Derivative Works thereof.
+
+   "Contribution" shall mean any work of authorship, including
+   the original Work and any Derivative Works thereof, that is intentionally
+   submitted to, or received by, Licensor for inclusion in the Work
+   by the copyright owner or by an individual or Legal Entity authorized
+   to submit on behalf of the copyright owner. For the purposes of this
+   definition, "submitted" means any form of electronic, verbal, or
+   written communication sent to the Licensor or its representatives,
+   including but not limited to communication on electronic mailing lists,
+   source code control systems, and issue tracking systems that are
+   managed by, or on behalf of, the Licensor for the purpose of
+   discussing and improving the Work, but excluding communication
+   that is conspicuously marked or otherwise designated in writing by
+   the copyright owner as "Not a Contribution."
+
+   "Contributor" shall mean any individual or Legal Entity on behalf
+   of whom a Contribution has been received by Licensor and subsequently
+   incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   copyright license to reproduce, prepare Derivative Works of,
+   publicly display, publicly perform, sublicense, and distribute the
+   Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   (except as stated in this section) patent license to make, have made,
+   use, offer to sell, sell, import, and otherwise transfer the Work,
+   where such license applies only to those patent claims licensable
+   by such Contributor that are necessarily infringed by their
+   Contribution(s) alone or by combination of their Contribution(s)
+   with the Work to which such Contribution(s) was submitted. If You
+   institute patent litigation against any entity (including a
+   cross-claim or counterclaim in a lawsuit) alleging that the Work
+   or a Contribution incorporated within the Work constitutes direct
+   or contributory patent infringement, then any patent licenses
+   granted to You under this License for that Work shall terminate
+   as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+   Work or Derivative Works thereof in any medium, with or without
+   modifications, and in Source or Object form, provided that You
+   meet the following conditions:
+
+   (a) You must give any other recipients of the Work or
+       Derivative Works a copy of this License; and
+
+   (b) You must cause any modified files to carry prominent notices
+       stating that You changed the files; and
+
+   (c) You must retain, in the Source form of any Derivative Works
+       that You distribute, all copyright, patent, trademark, and
+       attribution notices from the Source form of the Work,
+       excluding those notices that do not pertain to any part of
+       the Derivative Works; and
+
+   (d) If the Work includes a "NOTICE" text file, then any
+       Derivative Works that You distribute must include a readable
+       copy of the attribution notices contained
+       within such NOTICE file, excluding those notices that do not
+       pertain to any part of the Derivative Works, in at least one
+       of the following places: within a NOTICE text file distributed
+       as part of the Derivative Works; within the Source form or
+       documentation, if provided along with the Derivative Works; or,
+       within a display generated by the Derivative Works, if and
+       wherever such third-party notices normally appear. The contents
+       of the NOTICE file are for informational purposes only and
+       do not modify the License. You may add Your own attribution
+       notices within Derivative Works that You distribute, alongside
+       or as an addendum to the NOTICE from the Work, provided that
+       such additional attribution notices cannot be construed as
+       modifying the License.
+
+   You may add Your own copyright statement to Your modifications and
+   may provide additional or different license terms and conditions
+   for use, reproduction, or distribution of Your modifications, or
+   for any such Derivative Works as a whole, provided Your use,
+   reproduction, and distribution of the Work otherwise complies with
+   the conditions of this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+   any Contribution intentionally submitted for inclusion in the Work
+   by You to the Licensor shall be under the terms and conditions of
+   this License, without any additional terms or conditions.
+   Notwithstanding the above, nothing herein shall supersede or modify
+   the terms of any separate license agreement you may have executed
+   with Licensor regarding such Contribution.
+
+6. Trademarks. This License does not grant permission to use the trade
+   names, trademarks, service marks, or product names of the Licensor,
+   except as required for reasonable and customary use in describing the
+   origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+   agreed to in writing, Licensor provides the Work (and each
+   Contributor provides its Contributions) on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied, including, without limitation, any warranties or conditions
+   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+   PARTICULAR PURPOSE. You are solely responsible for determining the
+   appropriateness of using or redistributing the Work and assume any
+   risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+   whether in tort (including negligence), contract, or otherwise,
+   unless required by applicable law (such as deliberate and grossly
+   negligent acts) or agreed to in writing, shall any Contributor be
+   liable to You for damages, including any direct, indirect, special,
+   incidental, or consequential damages of any character arising as a
+   result of this License or out of the use or inability to use the
+   Work (including but not limited to damages for loss of goodwill,
+   work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses), even if such Contributor
+   has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+   the Work or Derivative Works thereof, You may choose to offer,
+   and charge a fee for, acceptance of support, warranty, indemnity,
+   or other liability obligations and/or rights consistent with this
+   License. However, in accepting such obligations, You may act only
+   on Your own behalf and on Your sole responsibility, not on behalf
+   of any other Contributor, and only if You agree to indemnify,
+   defend, and hold each Contributor harmless for any liability
+   incurred by, or claims asserted against, such Contributor by reason
+   of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS

repro_lambda-0.1.0/PKG-INFO

@@ -0,0 +1,68 @@
+Metadata-Version: 2.4
+Name: repro-lambda
+Version: 0.1.0
+Summary: Build reproducible AWS Lambda packages outside Terraform, optimized for terraform-aws-lambda by serverless.tf.
+Project-URL: Homepage, https://github.com/antonbabenko/repro-lambda
+Project-URL: Repository, https://github.com/antonbabenko/repro-lambda
+Project-URL: Issues, https://github.com/antonbabenko/repro-lambda/issues
+Author-email: Anton Babenko <anton@antonbabenko.com>
+License: Apache-2.0
+License-File: LICENSE
+Keywords: aws,lambda,reproducible-builds,serverless,terraform
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Operating System :: MacOS :: MacOS X
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Software Development :: Build Tools
+Requires-Python: >=3.11
+Requires-Dist: boto3>=1.34
+Requires-Dist: repro-zipfile>=0.3.1
+Requires-Dist: typer>=0.12
+Provides-Extra: dev
+Requires-Dist: moto[s3]>=5; extra == 'dev'
+Requires-Dist: pre-commit>=3.7; extra == 'dev'
+Requires-Dist: pytest-mock>=3.12; extra == 'dev'
+Requires-Dist: pytest>=8; extra == 'dev'
+Requires-Dist: pyyaml>=6; extra == 'dev'
+Requires-Dist: ruff>=0.5; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# repro-lambda
+
+Build reproducible AWS Lambda packages outside Terraform, optimized for
+[terraform-aws-lambda by serverless.tf](https://registry.terraform.io/modules/terraform-aws-modules/lambda/aws/latest).
+
+Produces byte-identical zip files across local dev (macOS) and CI (Linux),
+uploads to S3 by content-hash key, and lets Terraform read `s3_existing_package`
+instead of building during `terraform plan`/`apply`.
+
+## Install
+
+    pip install repro-lambda
+
+## Usage
+
+    repro-lambda init           # scaffold lambdas.toml and CI caller workflow
+    repro-lambda lock           # regenerate per-arch lockfiles
+    repro-lambda build          # build all lambdas in lambdas.toml, upload to S3
+    repro-lambda build --verify # two-pass byte-reproducibility check
+
+See `docs/` for full design.
+
+## Release
+
+Releases are tag-driven. To cut v0.1.1:
+
+    git tag v0.1.1
+    git push origin v0.1.1
+
+The `publish.yml` workflow uses PyPI Trusted Publishing (OIDC) — no PyPI token
+needed in repo secrets. Configure once via PyPI's "Publishing" panel:
+
+- Owner: `antonbabenko`
+- Repository: `repro-lambda`
+- Workflow: `publish.yml`
+- Environment: (leave blank)

repro_lambda-0.1.0/README.md

@@ -0,0 +1,36 @@
+# repro-lambda
+
+Build reproducible AWS Lambda packages outside Terraform, optimized for
+[terraform-aws-lambda by serverless.tf](https://registry.terraform.io/modules/terraform-aws-modules/lambda/aws/latest).
+
+Produces byte-identical zip files across local dev (macOS) and CI (Linux),
+uploads to S3 by content-hash key, and lets Terraform read `s3_existing_package`
+instead of building during `terraform plan`/`apply`.
+
+## Install
+
+    pip install repro-lambda
+
+## Usage
+
+    repro-lambda init           # scaffold lambdas.toml and CI caller workflow
+    repro-lambda lock           # regenerate per-arch lockfiles
+    repro-lambda build          # build all lambdas in lambdas.toml, upload to S3
+    repro-lambda build --verify # two-pass byte-reproducibility check
+
+See `docs/` for full design.
+
+## Release
+
+Releases are tag-driven. To cut v0.1.1:
+
+    git tag v0.1.1
+    git push origin v0.1.1
+
+The `publish.yml` workflow uses PyPI Trusted Publishing (OIDC) — no PyPI token
+needed in repo secrets. Configure once via PyPI's "Publishing" panel:
+
+- Owner: `antonbabenko`
+- Repository: `repro-lambda`
+- Workflow: `publish.yml`
+- Environment: (leave blank)

repro_lambda-0.1.0/pyproject.toml

@@ -0,0 +1,62 @@
+[project]
+name = "repro-lambda"
+version = "0.1.0"
+description = "Build reproducible AWS Lambda packages outside Terraform, optimized for terraform-aws-lambda by serverless.tf."
+readme = "README.md"
+requires-python = ">=3.11"
+license = { text = "Apache-2.0" }
+authors = [{ name = "Anton Babenko", email = "anton@antonbabenko.com" }]
+keywords = ["aws", "lambda", "terraform", "reproducible-builds", "serverless"]
+classifiers = [
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+  "Programming Language :: Python :: 3.13",
+  "License :: OSI Approved :: Apache Software License",
+  "Operating System :: POSIX :: Linux",
+  "Operating System :: MacOS :: MacOS X",
+  "Topic :: Software Development :: Build Tools",
+]
+dependencies = [
+  "typer>=0.12",
+  "repro-zipfile>=0.3.1",
+  "boto3>=1.34",
+  
+]
+
+[project.optional-dependencies]
+dev = [
+  "pytest>=8",
+  "pytest-mock>=3.12",
+  "moto[s3]>=5",
+  "ruff>=0.5",
+  "pre-commit>=3.7",
+  "pyyaml>=6",
+]
+
+[project.scripts]
+repro-lambda = "repro_lambda.cli:app"
+
+[project.urls]
+Homepage = "https://github.com/antonbabenko/repro-lambda"
+Repository = "https://github.com/antonbabenko/repro-lambda"
+Issues = "https://github.com/antonbabenko/repro-lambda/issues"
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/repro_lambda"]
+
+[tool.ruff]
+line-length = 100
+target-version = "py311"
+
+[tool.ruff.lint]
+select = ["E", "F", "I", "B", "UP", "SIM"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+addopts = "-ra --strict-markers"
+markers = ["docker: requires docker daemon"]

repro_lambda-0.1.0/src/repro_lambda/__init__.py

@@ -0,0 +1,3 @@
+"""repro-lambda — reproducible AWS Lambda packaging outside Terraform."""
+
+__version__ = "0.1.0"

repro_lambda-0.1.0/src/repro_lambda/__main__.py

@@ -0,0 +1,6 @@
+"""Allow `python -m repro_lambda ...` invocation."""
+
+from repro_lambda.cli import app
+
+if __name__ == "__main__":
+    app()