lambda-ci.yaml

#╔══════════════════════════════════════════════════════════════════════════════╗
#║                              CraftForm                                       ║
#╠══════════════════════════════════════════════════════════════════════════════╣
#║  WORKFLOW  ::  lambda-ci.yaml                                                ║
#║  Performs automated code checks on the lambda python code                    ║
#║  Acts as a child workflow to be called in other workflows                    ║
#╚══════════════════════════════════════════════════════════════════════════════╝

name: Lambda-CI

on:
  # run on other workflow calls
  workflow_call:
  # manual trigger
  workflow_dispatch:
    
permissions:
  contents: read

jobs:

  quality:
    name: Quality - ${{ matrix.package }}
    runs-on: ubuntu-latest

    # matrix the workflow across every python package -- both lambdas plus the codebuild
    # server bake. `package` is only the label (it names the check, so startup/operations
    # keep their old "Quality - <name>" checks), `dir` is where the code actually lives
    strategy:
      fail-fast: false    # make sure if one matrix fails, the others run too
      matrix:
        include:
          - { package: startup,         dir: lambda/startup }
          - { package: operations,      dir: lambda/operations }
          - { package: codebuild-server, dir: codebuild/server }

    # the working directory for the specific code matrix
    defaults:
      run:
        working-directory: ${{ matrix.dir }}
    
    steps:

      - name: Checkout Repo
        uses: actions/checkout@v7

      # no `version:` on purpose -- setup-uv reads required-version from the root pyproject.toml,
      # the ONE place the uv version lives (matches the flake's uv)
      - name: Setup uv + Python
        uses: astral-sh/setup-uv@v10.3.3
        with:
          python-version: "3.12"  # uv finds or downloads it

      # install from uv.lock. --locked FAILS if the lock is stale instead of quietly fixing it.
      # then put .venv/bin on PATH
      - name: Install Dependencies
        working-directory: ${{ github.workspace }}   # repo root, where .venv lives
        run: |
          uv sync --locked
          echo "$GITHUB_WORKSPACE/.venv/bin" >> "$GITHUB_PATH"

      # checks formatting using ruff in read-only mode. fails if ruff would change anything
      - name: Check Formatting
        run: ruff format --diff .
      
      # performs a lint check on the code using lint
      - name: Lint
        run: ruff check .
      
      # reads type annotations and catches type mismatches (needs boto3-stubs for aws client calls)
      - name: Type Check
        run: mypy .
      
      # performs a basic security scan on all the python files and ignore low-level severity
      - name: Security Scan
        run: bandit -r . -ll

      # runs the tests. exit code 5 = "found no tests" -- let that pass while packages are still
      # getting their first tests. TODO: drop the `|| [ $? -eq 5 ]` once every package has one
      - name: Tests
        run: pytest || [ $? -eq 5 ]