repro-lambda 0.5.1__tar.gz → 0.6.0__tar.gz

{repro_lambda-0.5.1 → repro_lambda-0.6.0}/.github/workflows/build.yml

@@ -25,6 +25,27 @@ on:
         required: false
         default: ""
         description: S3 bucket name for prod Lambda artifacts (master push only).
+      promotion_repo:
+        type: string
+        required: false
+        default: ""
+        description: >-
+          owner/repo of the centralized promotion workflow. When set, the build Step
+          Summary renders a ready-to-run `gh workflow run` command per function. Generic
+          by design - the reusable workflow never hardcodes a promotion target; the caller
+          supplies it (keep this empty for public callers).
+      promotion_workflow:
+        type: string
+        required: false
+        default: promote-lambda.yml
+        description: Workflow file name dispatched by the promotion command in the Step Summary.
+      project:
+        type: string
+        required: false
+        default: ""
+        description: >-
+          Project key the promotion workflow expects (-f project=...). Defaults to the
+          caller repo name when empty.
     secrets:
       sources_token:
         required: false
@@ -92,7 +113,60 @@ jobs:
         env:
           REPRO_LAMBDA_BUCKET: ${{ inputs.dev_bucket }}
           REPRO_LAMBDA_SOURCES_TOKEN: ${{ secrets.sources_token }}
-        run: uvx --from repro-lambda repro-lambda build --manifest "${{ inputs.manifest_path }}" --arch "${{ matrix.arch }}"
+        run: uvx --from repro-lambda repro-lambda build --manifest "${{ inputs.manifest_path }}" --arch "${{ matrix.arch }}" --json-out "$RUNNER_TEMP/build-summary.json"
+
+      # Render the dev build's content shas + a copy-paste promotion command per function
+      # into the run's Step Summary (the build JSON is otherwise buried in step logs).
+      - name: Build summary (content shas + promote commands)
+        if: ${{ hashFiles(format('{0}/build-summary.json', runner.temp)) != '' }}
+        env:
+          SUMMARY_JSON: ${{ runner.temp }}/build-summary.json
+          PROMOTION_REPO: ${{ inputs.promotion_repo }}
+          PROMOTION_WORKFLOW: ${{ inputs.promotion_workflow }}
+          PROJECT: ${{ inputs.project != '' && inputs.project || github.event.repository.name }}
+          ARCH: ${{ matrix.arch }}
+          SRC_REPO: ${{ github.repository }}
+          SRC_COMMIT: ${{ github.sha }}
+        run: |
+          python3 - <<'PY'
+          import json, os
+
+          rows = json.load(open(os.environ["SUMMARY_JSON"]))
+          repo = os.environ["PROMOTION_REPO"]
+          wf = os.environ["PROMOTION_WORKFLOW"]
+          project = os.environ["PROJECT"]
+          arch = os.environ["ARCH"]
+          src = os.environ["SRC_REPO"]
+          commit = os.environ["SRC_COMMIT"]
+
+          out = [
+              f"## Lambda build ({arch})",
+              "",
+              f"Source: `{src}` @ `{commit[:12]}`",
+              "",
+              "| Function | Outcome | Content SHA | Dev key |",
+              "| --- | --- | --- | --- |",
+          ]
+          for r in rows:
+              out.append(
+                  f"| `{r['logical_name']}` | {r['outcome']} | `{r['sha256']}` | `{r['bucket_key']}` |"
+              )
+          out += ["", "### Promote to prod", ""]
+          for r in rows:
+              fn, sha = r["logical_name"], r["sha256"]
+              out += [f"**`{fn}`** prod pin: `{fn} = \"{sha}\"`", ""]
+              if repo:
+                  out += [
+                      "```bash",
+                      f"gh workflow run {wf} --repo {repo} "
+                      f"-f project={project} -f function={fn} -f sha={sha}",
+                      "```",
+                      "",
+                  ]
+
+          with open(os.environ["GITHUB_STEP_SUMMARY"], "a") as f:
+              f.write("\n".join(out) + "\n")
+          PY
 
       - name: Verify reproducible (PR only)
         if: github.event_name == 'pull_request'

{repro_lambda-0.5.1 → repro_lambda-0.6.0}/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## v0.5.2 - 2026-06-21
+
+### Fixed
+- Pass the full compatible manylinux range to `pip install` instead of a single `--platform`, so compiled wheels are selected for every package. A single explicit `--platform` matches (close to) that exact tag - it does not broaden across baselines - so `manylinux_2_17` silently dropped compiled wheels tagged only at a higher baseline. Concretely, `wrapt`'s cp313 wheel is tagged `manylinux_2_28` (no `2_17`), so pip fell back to the pure-Python `py3-none-any` build; that broke `aws-xray-sdk`'s runtime boto3 patching and 500'd a Lambda whose package included it. The v0.4.1 change (2_28 -> 2_17, to catch `pydantic-core`'s 2_17-only wheel) had created the opposite failure - a single floor cannot satisfy both. Now `docker_runner.py` emits repeated `--platform` flags from `manylinux_2_34` down to `manylinux1` (x86_64) / `manylinux2014` (aarch64), capped at the AL2023 runtime's glibc 2.34, and pip picks the most-specific compiled wheel each package offers, only using `py3-none-any` when no compiled wheel exists. Verified end to end: a real build now ships `wrapt/_wrappers.*.so` again. The builder version bump re-keys all content hashes, as expected.
+
 ## v0.5.1 - 2026-06-21
 
 ### Fixed

{repro_lambda-0.5.1 → repro_lambda-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: repro-lambda
-Version: 0.5.1
+Version: 0.6.0
 Summary: Build reproducible AWS Lambda packages outside Terraform, optimized for terraform-aws-lambda by serverless.tf.
 Project-URL: Homepage, https://github.com/antonbabenko/repro-lambda
 Project-URL: Repository, https://github.com/antonbabenko/repro-lambda

{repro_lambda-0.5.1 → repro_lambda-0.6.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "repro-lambda"
-version = "0.5.1"
+version = "0.6.0"
 description = "Build reproducible AWS Lambda packages outside Terraform, optimized for terraform-aws-lambda by serverless.tf."
 readme = "README.md"
 requires-python = ">=3.11"

{repro_lambda-0.5.1 → repro_lambda-0.6.0}/src/repro_lambda/__init__.py

@@ -1,3 +1,3 @@
 """repro-lambda — reproducible AWS Lambda packaging outside Terraform."""
 
-__version__ = "0.5.1"
+__version__ = "0.6.0"

{repro_lambda-0.5.1 → repro_lambda-0.6.0}/src/repro_lambda/cli.py

@@ -70,6 +70,13 @@ def build(
             "--arch", help="Only build lambdas with this arch (e.g. arm64, x86_64). Empty = all."
         ),
     ] = "",
+    json_out: Annotated[
+        Path | None,
+        typer.Option(
+            "--json-out",
+            help="Also write the build summary JSON array to this file (for CI Step Summary).",
+        ),
+    ] = None,
 ) -> None:
     """Build one lambda (or all) per manifest and upload to S3."""
     import json
@@ -170,6 +177,9 @@ def build(
     if not dry_run:
         catalog.save(catalog_path)
 
+    if json_out is not None:
+        json_out.write_text(json.dumps(summary, indent=2))
+
     typer.echo(json.dumps(summary, indent=2))
 
 
@@ -196,14 +206,25 @@ def promote(
             help="Destination (prod) base bucket; us-east-1 variant auto-derived.",
         ),
     ] = "",
+    sha: Annotated[
+        str,
+        typer.Option(
+            "--sha",
+            help="Promote this exact 64-hex content sha instead of the catalog's current. "
+            "Requires a single lambda target (not 'all').",
+        ),
+    ] = "",
     dry_run: Annotated[bool, typer.Option("--dry-run")] = False,
 ) -> None:
     """Copy built artifacts dev -> prod by content hash (no rebuild).
 
-    The sha per lambda is read from builds/catalog.json, so the artifact promoted
-    is exactly the one the source commit built and tested in dev.
+    By default the sha per lambda is read from builds/catalog.json, so the artifact
+    promoted is exactly the one the source commit built and tested in dev. Pass
+    ``--sha`` to promote one explicit content sha (e.g. copy-pasted from a build run's
+    Step Summary), bypassing the catalog.
     """
     import json
+    import re
 
     from repro_lambda.manifest import load_manifest
     from repro_lambda.promote import (
@@ -225,6 +246,14 @@ def promote(
         typer.echo(f"no lambda named {target!r} in {manifest}", err=True)
         raise typer.Exit(2)
 
+    if sha:
+        if target == "all" or len(selected) != 1:
+            typer.echo("--sha requires a single lambda target (not 'all')", err=True)
+            raise typer.Exit(2)
+        if not re.fullmatch(r"[a-f0-9]{64}", sha):
+            typer.echo(f"--sha must be 64 lowercase hex chars, got {sha!r}", err=True)
+            raise typer.Exit(2)
+
     if not dry_run and (not dev_bucket or not prod_bucket):
         typer.echo(
             "--dev-bucket and --prod-bucket (or REPRO_LAMBDA_DEV_BUCKET / "
@@ -237,10 +266,10 @@ def promote(
     summary = []
     for spec in selected:
         try:
-            sha = sha_from_catalog(catalog_path, spec.logical_name)
+            resolved_sha = sha or sha_from_catalog(catalog_path, spec.logical_name)
             outcome = promote_one(
                 spec=spec,
-                sha=sha,
+                sha=resolved_sha,
                 dev_bucket=dev_bucket,
                 prod_bucket=prod_bucket,
                 dry_run=dry_run,

{repro_lambda-0.5.1 → repro_lambda-0.6.0}/src/repro_lambda/docker_runner.py

@@ -12,17 +12,50 @@ ARCH_TO_DOCKER_PLATFORM: dict[str, str] = {
     "x86_64": "linux/amd64",
 }
 
-# manylinux_2_17 (== manylinux2014) is the broadest baseline the AWS Lambda base
-# images (Amazon Linux 2023, glibc 2.34) still run, and pip's explicit --platform does
-# NOT expand a higher tag (e.g. 2_28) down to lower-baseline wheels. Many compiled
-# wheels (e.g. pydantic-core) ship only manylinux_2_17 for a given Python/arch, so a
-# 2_28 floor misses them with --only-binary=:all:. 2_17 matches 2_17 wheels and, via
-# pip's tag expansion, any lower baseline too.
-ARCH_TO_PIP_PLATFORM: dict[str, str] = {
-    "arm64": "manylinux_2_17_aarch64",
-    "x86_64": "manylinux_2_17_x86_64",
+# The AWS Lambda base images (Amazon Linux 2023) ship glibc 2.34, so the runtime can load
+# any manylinux wheel up to manylinux_2_34. pip's explicit --platform matches (close to)
+# that exact tag, so a SINGLE platform misses wheels tagged with other baselines in both
+# directions: a 2_28 floor misses 2_17-only wheels (e.g. pydantic-core), and a 2_17 floor
+# misses higher-baseline compiled wheels (e.g. wrapt ships cp313 only as manylinux_2_28 ->
+# pip silently falls back to py3-none-any, which broke aws-xray-sdk's runtime boto3 patching
+# and 500'd a Lambda). A single floor cannot satisfy both. Pass the FULL compatible range as
+# repeated --platform flags, newest -> oldest, capped at 2_34 (the runtime's glibc): pip then
+# selects the most-specific COMPILED wheel each package offers and only falls back to
+# py3-none-any when no compiled wheel exists. Never list a baseline ABOVE 2_34 - that would
+# let pip pick a wheel the runtime cannot load. (arm64 manylinux starts at 2014/2_17; the
+# manylinux1/2010/2_5 legacy aliases are x86_64-only.)
+ARCH_TO_PIP_PLATFORMS: dict[str, list[str]] = {
+    "x86_64": [
+        "manylinux_2_34_x86_64",
+        "manylinux_2_28_x86_64",
+        "manylinux_2_24_x86_64",
+        "manylinux2014_x86_64",
+        "manylinux_2_17_x86_64",
+        "manylinux_2_12_x86_64",
+        "manylinux2010_x86_64",
+        "manylinux_2_5_x86_64",
+        "manylinux1_x86_64",
+    ],
+    "arm64": [
+        "manylinux_2_34_aarch64",
+        "manylinux_2_28_aarch64",
+        "manylinux_2_24_aarch64",
+        "manylinux2014_aarch64",
+        "manylinux_2_17_aarch64",
+    ],
 }
 
+
+def pip_platform_flags(arch: str) -> str:
+    """Repeated ``--platform <tag>`` flags (space-joined) for an arch's manylinux range.
+
+    Word-split UNQUOTED into the pip command in the container so each tag becomes its own
+    flag. pip treats a wheel as compatible with ANY listed platform and prefers the
+    earliest (newest baseline) match, so compiled wheels win over the py3-none-any fallback.
+    """
+    return " ".join(f"--platform {tag}" for tag in ARCH_TO_PIP_PLATFORMS[arch])
+
+
 ARCH_TO_NPM_CPU: dict[str, str] = {
     "arm64": "arm64",
     "x86_64": "x64",
@@ -31,9 +64,9 @@ ARCH_TO_NPM_CPU: dict[str, str] = {
 # Invariance: keys must match across all arch lookup tables. Adding a new arch
 # to one without the other would cause install_nodejs_dependencies to raise
 # KeyError instead of DockerRunError. Caught at import time.
-assert set(ARCH_TO_DOCKER_PLATFORM) == set(ARCH_TO_PIP_PLATFORM) == set(ARCH_TO_NPM_CPU), (
+assert set(ARCH_TO_DOCKER_PLATFORM) == set(ARCH_TO_PIP_PLATFORMS) == set(ARCH_TO_NPM_CPU), (
     "arch lookup tables must share the same key set; "
-    f"DOCKER={set(ARCH_TO_DOCKER_PLATFORM)} PIP={set(ARCH_TO_PIP_PLATFORM)} NPM={set(ARCH_TO_NPM_CPU)}"
+    f"DOCKER={set(ARCH_TO_DOCKER_PLATFORM)} PIP={set(ARCH_TO_PIP_PLATFORMS)} NPM={set(ARCH_TO_NPM_CPU)}"
 )
 
 
@@ -49,7 +82,7 @@ cp -R /src/source/. "$PKG/"
 
 pip install \
   --no-cache-dir --no-compile --require-hashes --only-binary=:all: \
-  --platform "$PIP_PLATFORM" \
+  $PIP_PLATFORM_FLAGS \
   --abi "$PIP_ABI" \
   --python-version "$PIP_PYVER" \
   --implementation cp \
@@ -130,7 +163,7 @@ def build_python_lambda(
     python_version: str,
 ) -> None:
     """v0.1-compatible: install + pack inside the Python container."""
-    if arch not in ARCH_TO_PIP_PLATFORM:
+    if arch not in ARCH_TO_PIP_PLATFORMS:
         raise DockerRunError(f"unsupported arch {arch!r}")
     if shutil.which("docker") is None:
         raise DockerRunError("docker CLI not found on PATH")
@@ -158,7 +191,7 @@ def build_python_lambda(
         "-e",
         "PYTHONPATH=/builder",
         "-e",
-        f"PIP_PLATFORM={ARCH_TO_PIP_PLATFORM[arch]}",
+        f"PIP_PLATFORM_FLAGS={pip_platform_flags(arch)}",
         "-e",
         f"PIP_ABI=cp{pyver_compact}",
         "-e",

{repro_lambda-0.5.1 → repro_lambda-0.6.0}/tests/test_docker_runner.py

@@ -5,23 +5,39 @@ import pytest
 
 from repro_lambda.docker_runner import (
     ARCH_TO_DOCKER_PLATFORM,
-    ARCH_TO_PIP_PLATFORM,
+    ARCH_TO_PIP_PLATFORMS,
     DockerRunError,
     build_python_lambda,
+    pip_platform_flags,
 )
 
 
 def test_arch_mapping_tables_are_complete():
     for arch in ("arm64", "x86_64"):
         assert arch in ARCH_TO_DOCKER_PLATFORM
-        assert arch in ARCH_TO_PIP_PLATFORM
+        assert arch in ARCH_TO_PIP_PLATFORMS
 
 
 def test_arch_mapping_values():
     assert ARCH_TO_DOCKER_PLATFORM["arm64"] == "linux/arm64"
     assert ARCH_TO_DOCKER_PLATFORM["x86_64"] == "linux/amd64"
-    assert ARCH_TO_PIP_PLATFORM["arm64"] == "manylinux_2_17_aarch64"
-    assert ARCH_TO_PIP_PLATFORM["x86_64"] == "manylinux_2_17_x86_64"
+
+
+def test_pip_platform_flags_span_the_range_and_cap_at_2_34():
+    """Multiple --platform flags so pip picks the best COMPILED wheel per package; a single
+    tag silently dropped compiled wheels (e.g. wrapt -> py3-none-any). Cap at glibc 2.34."""
+    for arch, tag_arch in (("x86_64", "x86_64"), ("arm64", "aarch64")):
+        flags = pip_platform_flags(arch)
+        tags = ARCH_TO_PIP_PLATFORMS[arch]
+        # Repeated --platform, one per tag, in declared (newest-first) order.
+        assert flags == " ".join(f"--platform {t}" for t in tags)
+        assert flags.count("--platform ") == len(tags)
+        # Must include both the historical floors that each broke one direction.
+        assert f"manylinux_2_17_{tag_arch}" in flags  # pydantic-core (2_17-only) still resolves
+        assert f"manylinux_2_28_{tag_arch}" in flags  # wrapt's compiled cp313 wheel resolves
+        # Never a baseline above the runtime's glibc 2.34 (would be unloadable).
+        for n in (35, 36, 38, 40):
+            assert f"manylinux_2_{n}_" not in flags
 
 
 def test_build_python_lambda_raises_on_unknown_arch(tmp_path: Path):

{repro_lambda-0.5.1 → repro_lambda-0.6.0}/tests/test_promote.py

@@ -226,3 +226,74 @@ def test_cli_promote_unknown_target_exits_2(tmp_path: Path):
         ],
     )
     assert result.exit_code == 2
+
+
+_EXPLICIT_SHA = "a" * 64  # 64-hex, deliberately NOT the catalog's "cafef00d"
+
+
+def test_cli_promote_explicit_sha_bypasses_catalog(tmp_path: Path):
+    repo = _consumer(tmp_path)
+    with mock_aws():
+        c = boto3.client("s3", region_name="eu-west-1")
+        _make_bucket(c, DEV, "eu-west-1")
+        _make_bucket(c, PROD, "eu-west-1")
+        # Only the explicit-sha object exists; the catalog's current sha does not.
+        c.put_object(Bucket=DEV, Key=f"lambdas/app/{_EXPLICIT_SHA}.zip", Body=b"z")
+
+        result = runner.invoke(
+            app,
+            [
+                "promote",
+                "app",
+                "--manifest",
+                str(repo / "lambdas.toml"),
+                "--dev-bucket",
+                DEV,
+                "--prod-bucket",
+                PROD,
+                "--sha",
+                _EXPLICIT_SHA,
+            ],
+        )
+        assert result.exit_code == 0, result.stdout
+        assert c.head_object(Bucket=PROD, Key=f"lambdas/app/{_EXPLICIT_SHA}.zip")
+
+
+def test_cli_promote_sha_rejects_all_target(tmp_path: Path):
+    repo = _consumer(tmp_path)
+    result = runner.invoke(
+        app,
+        [
+            "promote",
+            "all",
+            "--manifest",
+            str(repo / "lambdas.toml"),
+            "--dev-bucket",
+            DEV,
+            "--prod-bucket",
+            PROD,
+            "--sha",
+            _EXPLICIT_SHA,
+        ],
+    )
+    assert result.exit_code == 2  # --sha forbidden with 'all'
+
+
+def test_cli_promote_sha_invalid_hex_exits_2(tmp_path: Path):
+    repo = _consumer(tmp_path)
+    result = runner.invoke(
+        app,
+        [
+            "promote",
+            "app",
+            "--manifest",
+            str(repo / "lambdas.toml"),
+            "--dev-bucket",
+            DEV,
+            "--prod-bucket",
+            PROD,
+            "--sha",
+            "not-a-valid-sha",
+        ],
+    )
+    assert result.exit_code == 2  # not 64-hex

{repro_lambda-0.5.1 → repro_lambda-0.6.0}/uv.lock

@@ -646,7 +646,7 @@ wheels = [
 
 [[package]]
 name = "repro-lambda"
-version = "0.5.1"
+version = "0.6.0"
 source = { editable = "." }
 dependencies = [
     { name = "boto3" },