repro-lambda 0.5.2__tar.gz → 0.6.1__tar.gz

{repro_lambda-0.5.2 → repro_lambda-0.6.1}/.github/workflows/build.yml

@@ -25,6 +25,27 @@ on:
         required: false
         default: ""
         description: S3 bucket name for prod Lambda artifacts (master push only).
+      promotion_repo:
+        type: string
+        required: false
+        default: ""
+        description: >-
+          owner/repo of the centralized promotion workflow. When set, the build Step
+          Summary renders a ready-to-run `gh workflow run` command per function. Generic
+          by design - the reusable workflow never hardcodes a promotion target; the caller
+          supplies it (keep this empty for public callers).
+      promotion_workflow:
+        type: string
+        required: false
+        default: promote-lambda.yml
+        description: Workflow file name dispatched by the promotion command in the Step Summary.
+      project:
+        type: string
+        required: false
+        default: ""
+        description: >-
+          Project key the promotion workflow expects (-f project=...). Defaults to the
+          caller repo name when empty.
     secrets:
       sources_token:
         required: false
@@ -92,7 +113,78 @@ jobs:
         env:
           REPRO_LAMBDA_BUCKET: ${{ inputs.dev_bucket }}
           REPRO_LAMBDA_SOURCES_TOKEN: ${{ secrets.sources_token }}
-        run: uvx --from repro-lambda repro-lambda build --manifest "${{ inputs.manifest_path }}" --arch "${{ matrix.arch }}"
+        run: uvx --from repro-lambda repro-lambda build --manifest "${{ inputs.manifest_path }}" --arch "${{ matrix.arch }}" --json-out "$RUNNER_TEMP/build-summary.json"
+
+      # Render the dev build's content shas + a copy-paste promotion command per function
+      # into the run's Step Summary (the build JSON is otherwise buried in step logs).
+      # NB: the JSON lives in RUNNER_TEMP (outside the workspace), so hashFiles() can't guard
+      # it - run on success() and skip inside the script if the file is somehow absent.
+      - name: Build summary (content shas + promote commands)
+        if: success()
+        env:
+          SUMMARY_JSON: ${{ runner.temp }}/build-summary.json
+          PROMOTION_REPO: ${{ inputs.promotion_repo }}
+          PROMOTION_WORKFLOW: ${{ inputs.promotion_workflow }}
+          PROJECT: ${{ inputs.project != '' && inputs.project || github.event.repository.name }}
+          ARCH: ${{ matrix.arch }}
+          SRC_REPO: ${{ github.repository }}
+          SRC_COMMIT: ${{ github.sha }}
+        run: |
+          python3 - <<'PY'
+          import json, os, sys
+
+          path = os.environ["SUMMARY_JSON"]
+          if not os.path.exists(path):
+              print(f"::notice::no build summary JSON at {path}; skipping summary.")
+              sys.exit(0)
+          rows = json.load(open(path))
+          repo = os.environ["PROMOTION_REPO"]
+          wf = os.environ["PROMOTION_WORKFLOW"]
+          project = os.environ["PROJECT"]
+          arch = os.environ["ARCH"]
+          src = os.environ["SRC_REPO"]
+          commit = os.environ["SRC_COMMIT"]
+
+          out = [
+              f"## Lambda build ({arch})",
+              "",
+              f"Source: `{src}` @ `{commit[:12]}`",
+              "",
+              "| Function | Outcome | Content SHA | Dev key |",
+              "| --- | --- | --- | --- |",
+          ]
+          for r in rows:
+              out.append(
+                  f"| `{r['logical_name']}` | {r['outcome']} | `{r['sha256']}` | `{r['bucket_key']}` |"
+              )
+          out += [
+              "",
+              "### Pipeline",
+              "",
+              "1. **Build** (this run) - artifacts uploaded to the dev bucket, keyed by content sha.",
+              "2. **Pin dev** - point the dev stack's lambda pin at the sha below, then apply dev and test.",
+              "3. **Promote to prod** - run the promote command below (copies dev -> prod by content"
+              " sha + opens the prod-pin PR), then apply prod.",
+              "",
+              "### Per-function",
+              "",
+          ]
+          for r in rows:
+              fn, sha = r["logical_name"], r["sha256"]
+              out += [f"**`{fn}`** - content sha `{sha}`", "", f"- dev pin: `{fn} = \"{sha}\"`"]
+              if repo:
+                  out += [
+                      "- promote to prod:",
+                      "```bash",
+                      f"gh workflow run {wf} --repo {repo} "
+                      f"-f project={project} -f function={fn} -f sha={sha}",
+                      "```",
+                  ]
+              out += [""]
+
+          with open(os.environ["GITHUB_STEP_SUMMARY"], "a") as f:
+              f.write("\n".join(out) + "\n")
+          PY
 
       - name: Verify reproducible (PR only)
         if: github.event_name == 'pull_request'

{repro_lambda-0.5.2 → repro_lambda-0.6.1}/.github/workflows/ci.yml

@@ -3,7 +3,7 @@ name: ci
 on:
   pull_request:
   push:
-    branches: [main]
+    branches: [master]
 
 jobs:
   lint-and-test:

repro_lambda-0.6.1/.github/workflows/release.yml

@@ -0,0 +1,85 @@
+name: release
+
+# Automated releases via release-please. On every push to master, release-please
+# maintains a "release PR" that bumps the version (pyproject.toml + __init__.py) and
+# the CHANGELOG. Merging that PR creates the vX.Y.Z tag + GitHub Release, then this
+# same run publishes to PyPI (OIDC) and force-moves the sliding v0 major tag.
+#
+# Why publish here instead of relying on publish.yml's tag trigger: release-please
+# creates the tag via the GitHub API using GITHUB_TOKEN, and a GITHUB_TOKEN-created
+# tag does NOT trigger other workflows. So the publish + major-tag steps run as
+# release_created-gated jobs in this workflow. publish.yml / move-major-tag.yml stay
+# as the manual-tag fallback (a human can still `git tag vX.Y.Z && git push`).
+
+on:
+  push:
+    branches: [master]
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  release-please:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write        # create the release commit, tag, and GitHub Release
+      pull-requests: write    # open/update the release PR
+      issues: write           # manage the autorelease:* labels
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
+    steps:
+      - uses: googleapis/release-please-action@v5
+        id: release
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          target-branch: master
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
+
+  publish:
+    needs: release-please
+    if: ${{ needs.release-please.outputs.release_created == 'true' }}
+    runs-on: ubuntu-24.04
+    permissions:
+      id-token: write        # PyPI OIDC Trusted Publishing
+      contents: read
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v8.2.0
+      - run: uv sync --all-extras
+      - name: Verify tag matches package version
+        env:
+          TAG_NAME: ${{ needs.release-please.outputs.tag_name }}
+        run: |
+          TAG="${TAG_NAME#v}"
+          PKG=$(uv run python -c "import repro_lambda; print(repro_lambda.__version__)")
+          if [[ "$TAG" != "$PKG" ]]; then
+            echo "tag $TAG != package version $PKG" >&2
+            exit 1
+          fi
+      - name: Build sdist + wheel
+        run: uv build
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist/
+
+  major-tag:
+    needs: release-please
+    if: ${{ needs.release-please.outputs.release_created == 'true' }}
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+      - name: Force-move sliding major tag
+        env:
+          TAG: ${{ needs.release-please.outputs.tag_name }}
+        run: |
+          MAJOR="${TAG%%.*}"   # v0.4.1 -> v0
+          git tag -f "$MAJOR" "$TAG"
+          git push -f origin "refs/tags/$MAJOR"

repro_lambda-0.6.1/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.6.1"
+}

{repro_lambda-0.5.2 → repro_lambda-0.6.1}/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.6.1](https://github.com/antonbabenko/repro-lambda/compare/v0.6.0...v0.6.1) (2026-06-22)
+
+
+### Bug Fixes
+
+* **ci:** render the build Step Summary (hashFiles cannot guard a RUNNER_TEMP file) ([#5](https://github.com/antonbabenko/repro-lambda/issues/5)) ([4fadb30](https://github.com/antonbabenko/repro-lambda/commit/4fadb307136f4dffd8c7e6bf5303d79f1a641f5a))
+
 ## v0.5.2 - 2026-06-21
 
 ### Fixed

{repro_lambda-0.5.2 → repro_lambda-0.6.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: repro-lambda
-Version: 0.5.2
+Version: 0.6.1
 Summary: Build reproducible AWS Lambda packages outside Terraform, optimized for terraform-aws-lambda by serverless.tf.
 Project-URL: Homepage, https://github.com/antonbabenko/repro-lambda
 Project-URL: Repository, https://github.com/antonbabenko/repro-lambda

{repro_lambda-0.5.2 → repro_lambda-0.6.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "repro-lambda"
-version = "0.5.2"
+version = "0.6.1"
 description = "Build reproducible AWS Lambda packages outside Terraform, optimized for terraform-aws-lambda by serverless.tf."
 readme = "README.md"
 requires-python = ">=3.11"

repro_lambda-0.6.1/release-please-config.json

@@ -0,0 +1,26 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "packages": {
+    ".": {
+      "release-type": "python",
+      "package-name": "repro-lambda",
+      "include-component-in-tag": false,
+      "bump-minor-pre-major": true,
+      "bump-patch-for-minor-pre-major": false,
+      "changelog-path": "CHANGELOG.md",
+      "extra-files": [
+        "src/repro_lambda/__init__.py"
+      ],
+      "changelog-sections": [
+        { "type": "feat", "section": "Features" },
+        { "type": "fix", "section": "Bug Fixes" },
+        { "type": "perf", "section": "Performance Improvements" },
+        { "type": "refactor", "section": "Code Refactoring" },
+        { "type": "docs", "section": "Documentation" },
+        { "type": "test", "section": "Tests", "hidden": true },
+        { "type": "chore", "section": "Miscellaneous", "hidden": true },
+        { "type": "ci", "section": "Continuous Integration", "hidden": true }
+      ]
+    }
+  }
+}

{repro_lambda-0.5.2 → repro_lambda-0.6.1}/src/repro_lambda/__init__.py

@@ -1,3 +1,3 @@
 """repro-lambda — reproducible AWS Lambda packaging outside Terraform."""
 
-__version__ = "0.5.2"
+__version__ = "0.6.1"  # x-release-please-version

{repro_lambda-0.5.2 → repro_lambda-0.6.1}/src/repro_lambda/cli.py

@@ -70,6 +70,13 @@ def build(
             "--arch", help="Only build lambdas with this arch (e.g. arm64, x86_64). Empty = all."
         ),
     ] = "",
+    json_out: Annotated[
+        Path | None,
+        typer.Option(
+            "--json-out",
+            help="Also write the build summary JSON array to this file (for CI Step Summary).",
+        ),
+    ] = None,
 ) -> None:
     """Build one lambda (or all) per manifest and upload to S3."""
     import json
@@ -170,6 +177,9 @@ def build(
     if not dry_run:
         catalog.save(catalog_path)
 
+    if json_out is not None:
+        json_out.write_text(json.dumps(summary, indent=2))
+
     typer.echo(json.dumps(summary, indent=2))
 
 
@@ -196,14 +206,25 @@ def promote(
             help="Destination (prod) base bucket; us-east-1 variant auto-derived.",
         ),
     ] = "",
+    sha: Annotated[
+        str,
+        typer.Option(
+            "--sha",
+            help="Promote this exact 64-hex content sha instead of the catalog's current. "
+            "Requires a single lambda target (not 'all').",
+        ),
+    ] = "",
     dry_run: Annotated[bool, typer.Option("--dry-run")] = False,
 ) -> None:
     """Copy built artifacts dev -> prod by content hash (no rebuild).
 
-    The sha per lambda is read from builds/catalog.json, so the artifact promoted
-    is exactly the one the source commit built and tested in dev.
+    By default the sha per lambda is read from builds/catalog.json, so the artifact
+    promoted is exactly the one the source commit built and tested in dev. Pass
+    ``--sha`` to promote one explicit content sha (e.g. copy-pasted from a build run's
+    Step Summary), bypassing the catalog.
     """
     import json
+    import re
 
     from repro_lambda.manifest import load_manifest
     from repro_lambda.promote import (
@@ -225,6 +246,14 @@ def promote(
         typer.echo(f"no lambda named {target!r} in {manifest}", err=True)
         raise typer.Exit(2)
 
+    if sha:
+        if target == "all" or len(selected) != 1:
+            typer.echo("--sha requires a single lambda target (not 'all')", err=True)
+            raise typer.Exit(2)
+        if not re.fullmatch(r"[a-f0-9]{64}", sha):
+            typer.echo(f"--sha must be 64 lowercase hex chars, got {sha!r}", err=True)
+            raise typer.Exit(2)
+
     if not dry_run and (not dev_bucket or not prod_bucket):
         typer.echo(
             "--dev-bucket and --prod-bucket (or REPRO_LAMBDA_DEV_BUCKET / "
@@ -237,10 +266,10 @@ def promote(
     summary = []
     for spec in selected:
         try:
-            sha = sha_from_catalog(catalog_path, spec.logical_name)
+            resolved_sha = sha or sha_from_catalog(catalog_path, spec.logical_name)
             outcome = promote_one(
                 spec=spec,
-                sha=sha,
+                sha=resolved_sha,
                 dev_bucket=dev_bucket,
                 prod_bucket=prod_bucket,
                 dry_run=dry_run,

{repro_lambda-0.5.2 → repro_lambda-0.6.1}/tests/test_promote.py

@@ -226,3 +226,74 @@ def test_cli_promote_unknown_target_exits_2(tmp_path: Path):
         ],
     )
     assert result.exit_code == 2
+
+
+_EXPLICIT_SHA = "a" * 64  # 64-hex, deliberately NOT the catalog's "cafef00d"
+
+
+def test_cli_promote_explicit_sha_bypasses_catalog(tmp_path: Path):
+    repo = _consumer(tmp_path)
+    with mock_aws():
+        c = boto3.client("s3", region_name="eu-west-1")
+        _make_bucket(c, DEV, "eu-west-1")
+        _make_bucket(c, PROD, "eu-west-1")
+        # Only the explicit-sha object exists; the catalog's current sha does not.
+        c.put_object(Bucket=DEV, Key=f"lambdas/app/{_EXPLICIT_SHA}.zip", Body=b"z")
+
+        result = runner.invoke(
+            app,
+            [
+                "promote",
+                "app",
+                "--manifest",
+                str(repo / "lambdas.toml"),
+                "--dev-bucket",
+                DEV,
+                "--prod-bucket",
+                PROD,
+                "--sha",
+                _EXPLICIT_SHA,
+            ],
+        )
+        assert result.exit_code == 0, result.stdout
+        assert c.head_object(Bucket=PROD, Key=f"lambdas/app/{_EXPLICIT_SHA}.zip")
+
+
+def test_cli_promote_sha_rejects_all_target(tmp_path: Path):
+    repo = _consumer(tmp_path)
+    result = runner.invoke(
+        app,
+        [
+            "promote",
+            "all",
+            "--manifest",
+            str(repo / "lambdas.toml"),
+            "--dev-bucket",
+            DEV,
+            "--prod-bucket",
+            PROD,
+            "--sha",
+            _EXPLICIT_SHA,
+        ],
+    )
+    assert result.exit_code == 2  # --sha forbidden with 'all'
+
+
+def test_cli_promote_sha_invalid_hex_exits_2(tmp_path: Path):
+    repo = _consumer(tmp_path)
+    result = runner.invoke(
+        app,
+        [
+            "promote",
+            "app",
+            "--manifest",
+            str(repo / "lambdas.toml"),
+            "--dev-bucket",
+            DEV,
+            "--prod-bucket",
+            PROD,
+            "--sha",
+            "not-a-valid-sha",
+        ],
+    )
+    assert result.exit_code == 2  # not 64-hex

{repro_lambda-0.5.2 → repro_lambda-0.6.1}/uv.lock

@@ -646,7 +646,7 @@ wheels = [
 
 [[package]]
 name = "repro-lambda"
-version = "0.5.2"
+version = "0.6.1"
 source = { editable = "." }
 dependencies = [
     { name = "boto3" },