Merge branch 'develop' into tmp-disallow-relative-imports

Author: vicheey

.github/workflows/build.yml

@@ -172,7 +172,7 @@ jobs:
           ruby-version: "3.3"
       - uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 24
       - uses: actions/setup-java@v5
         with:
           distribution: 'corretto'
@@ -186,18 +186,9 @@ jobs:
         with:
           dotnet-version: '10.0.x'
        # Install and configure Rust & Cargo Lambda
-      - name: Install and configure Rust & Cargo Lambda
+      - name: Install Rust toolchain and cargo-lambda
         if: ${{ matrix.os == 'ubuntu-latest' }}
-        run: |
-          : install rustup if needed
-          if ! command -v rustup &> /dev/null ; then
-            curl --proto '=https' --tlsv1.2 --retry 10 --retry-connrefused -fsSL "https://sh.rustup.rs" | sh -s -- --default-toolchain none -y
-            echo "${CARGO_HOME:-$HOME/.cargo}/bin" >> $GITHUB_PATH
-          fi
-          rustup toolchain install stable --profile minimal --no-self-update
-          rustup default stable
-          pip install cargo-lambda==$CARGO_LAMBDA_VERSION
-          echo "$HOME/.local/bin" >> $GITHUB_PATH
+        run: bash tests/install-rust.sh
       - name: Init samdev
         run: make init
       - name: uv install setuptools in Python3.12

.github/workflows/integration-tests.yml

@@ -5,9 +5,23 @@ on:
     # Run at 7pm PST (3am UTC next day) Monday-Friday
     # This translates to Tuesday-Saturday 3am UTC
     - cron: '0 3 * * 2-6'
+  release:
+    types: [published, edited]
+    # published → latest-release binary test (full releases only)
+    # edited + prerelease → nightly binary test (nightly pre-release gets edited with new artifacts)
   workflow_dispatch:  # Allow manual triggering
     # NOTE: This workflow can only be manually triggered from develop or main branches
     # The other branch will not pass the OIDC permission check
+    inputs:
+      install_mode:
+        description: '"code" to install from source (make init), "nightly-release" to install SAM CLI nightly binary, "latest-release" to install latest stable release binary'
+        required: false
+        default: 'code'
+        type: choice
+        options:
+          - code
+          - nightly-release
+          - latest-release
 
 permissions:
   id-token: write   # Required for OIDC
@@ -153,20 +167,9 @@ jobs:
         with:
           ruby-version: '3.4.7'
 
-      - name: Install Rust toolchain
+      - name: Install Rust toolchain and cargo-lambda
         if: contains(fromJSON('["build-x86-1", "build-x86-2", "build-arm64", "cloud-based-tests", "tier1-finch"]'), matrix.test_suite)
-        run: |
-          curl --proto '=https' --tlsv1.2 --retry 10 --retry-connrefused -fsSL https://sh.rustup.rs | sh -s -- --default-toolchain none -y
-          source $HOME/.cargo/env
-          rustup toolchain install stable --profile minimal --no-self-update
-          rustup default stable
-          rustup target add x86_64-unknown-linux-gnu --toolchain stable
-          rustup target add aarch64-unknown-linux-gnu --toolchain stable
-          echo "$HOME/.cargo/bin" >> $GITHUB_PATH
-
-      - name: Install cargo-lambda
-        if: contains(fromJSON('["build-x86-1", "build-x86-2", "build-arm64", "cloud-based-tests", "tier1-finch"]'), matrix.test_suite)
-        run: pip install cargo-lambda==${{ env.CARGO_LAMBDA_VERSION }}
+        run: bash tests/install-rust.sh
 
       - name: Install Terraform
         if: contains(fromJSON('["terraform-build", "terraform-start-api", "terraform-invoke-start-lambda", "cloud-based-tests", "tier1-finch"]'), matrix.test_suite)
@@ -193,18 +196,52 @@ jobs:
         if: "!contains(fromJSON('[\"build-x86-1\", \"build-x86-2\", \"build-x86-container-1\", \"build-x86-container-2\", \"tier1-finch\"]'), matrix.test_suite)"
         run: docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
 
-      - name: Initialize project
+      - name: Determine test type
         run: |
-          if [[ "${{ matrix.test_suite }}" == "tier1-finch" ]]; then
-            export CONTAINER_RUNTIME=finch
+          echo "CONTAINER_RUNTIME=${{ matrix.test_suite == 'tier1-finch' && 'finch' || 'docker' }}" >> $GITHUB_ENV
+          if [[ "${{ inputs.install_mode }}" == "nightly-release" ]] || \
+             [[ "${{ github.event.action }}" == "edited" && "${{ github.event.release.prerelease }}" == "true" ]]; then
+            echo "TEST_TYPE=nightly-release" >> $GITHUB_ENV
+          elif [[ "${{ inputs.install_mode }}" == "latest-release" ]] || \
+               [[ "${{ github.event.action }}" == "published" && "${{ github.event.release.prerelease }}" != "true" ]]; then
+            echo "TEST_TYPE=latest-release" >> $GITHUB_ENV
+          elif [[ "${{ github.ref }}" == "refs/heads/master" ]]; then
+            echo "TEST_TYPE=master" >> $GITHUB_ENV
+          elif [[ "${{ github.event_name }}" == "schedule" ]] || [[ "${{ github.ref }}" == "refs/heads/develop" ]]; then
+            echo "TEST_TYPE=develop" >> $GITHUB_ENV
           else
-            export CONTAINER_RUNTIME=docker
+            echo "TEST_TYPE=other" >> $GITHUB_ENV
           fi
+
+      - name: Initialize integration test
+        if: env.TEST_TYPE == 'develop' || env.TEST_TYPE == 'master' || env.TEST_TYPE == 'other'
+        run: |
           make init
+          echo "SCRIPT_PY=python3.11" >> $GITHUB_ENV
+
+      - name: Initialize nightly release test
+        if: env.TEST_TYPE == 'nightly-release'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          make setup-pytest
+          make init-nightly
+          echo "SAM_CLI_DEV=" >> $GITHUB_ENV
+          echo "SCRIPT_PY=$HOME/pytest/bin/python3" >> $GITHUB_ENV
+
+      - name: Initialize latest release test
+        if: env.TEST_TYPE == 'latest-release'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          make setup-pytest
+          make init-latest-release
+          echo "SAM_CLI_DEV=" >> $GITHUB_ENV
+          echo "SCRIPT_PY=$HOME/pytest/bin/python3" >> $GITHUB_ENV
 
       - name: Get testing resources and credentials
         if: "!contains(fromJSON('[\"build-x86-1\", \"build-x86-2\", \"build-arm64\", \"build-x86-container-1\", \"build-x86-container-2\", \"build-arm64-container-1\", \"build-arm64-container-2\", \"local-invoke\", \"local-start-api\", \"local-start-lambda\"]'), matrix.test_suite)"
-        run: python3.11 tests/setup_testing_resources.py
+        run: $SCRIPT_PY tests/setup_testing_resources.py
 
       - name: Login to Public ECR
         run: |
@@ -374,7 +411,7 @@ jobs:
 
       - name: Upload test results
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: test-results-${{ matrix.test_suite }}
           path: TEST_REPORT-*.json
@@ -398,4 +435,4 @@ jobs:
         if: always()
         env:
           TESTREPORTING_S3: ${{ secrets.TESTREPORTING_S3 }}
-        run: python3.11 tests/reset_testing_resources.py ${{ matrix.test_suite }}
+        run: $SCRIPT_PY tests/reset_testing_resources.py ${{ matrix.test_suite }}

.github/workflows/sync-to-mirror-repo.yml

@@ -10,6 +10,8 @@ jobs:
   sync-from-public:
     runs-on: ubuntu-latest
     if: github.repository != 'aws/aws-sam-cli' # Only run in mirror repo
+    permissions:
+      contents: write
     steps:
       - name: Checkout public repo
         uses: actions/checkout@v6
@@ -21,4 +23,4 @@ jobs:
       - name: Push to mirror repo
         run: |
           git remote set-url origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git
-          git push origin develop:develop --force-with-lease
+          git push origin develop:develop --force

.github/workflows/validate_pyinstaller.yml

@@ -32,7 +32,7 @@ jobs:
           sudo ./sam-installation/install
           sam-beta --version
           ./tests/sanity-check.sh
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7
         with:
           name: pyinstaller-linux-zip
           path: .build/output/aws-sam-cli-linux-x86_64.zip
@@ -61,7 +61,7 @@ jobs:
           sudo ./sam-installation/install
           sam-beta --version
           ./tests/sanity-check.sh
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7
         with:
           name: pyinstaller-macos-zip
           path: .build/output/aws-sam-cli-macos-x86_64.zip

Makefile

@@ -2,7 +2,7 @@
 # environment variable.
 SAM_CLI_TELEMETRY ?= 0
 
-.PHONY: schema
+.PHONY: schema init-nightly init-latest-release setup-pytest
 
 # Initialize environment specifically for Github action tests using uv
 init:
@@ -13,6 +13,21 @@ init:
 		SAM_CLI_DEV=1 pip install -e '.[dev]'; \
 	fi
 
+# Set up a pytest venv with test dependencies
+setup-pytest:
+	python3.11 -m venv $(HOME)/pytest
+	uv pip install --python $(HOME)/pytest/bin/python3 -r requirements/dev.txt -r requirements/base.txt
+	sudo ln -sf $(HOME)/pytest/bin/pytest /usr/local/bin/pytest
+	pytest --version
+
+# Install SAM CLI nightly binary
+init-nightly:
+	bash tests/install-sam-cli-binary.sh sam-cli-nightly
+
+# Install SAM CLI latest release binary
+init-latest-release:
+	bash tests/install-sam-cli-binary.sh
+
 test:
 	# Run unit tests and fail if coverage falls below 94%
 	pytest --cov samcli --cov schema --cov-report term-missing --cov-fail-under 94 tests/unit
@@ -52,7 +67,11 @@ black:
 	black setup.py samcli tests schema
 
 black-check:
-	black --check setup.py samcli tests schema
+	@if python -c "import sys; sys.exit(0 if sys.version_info >= (3, 10) else 1)" 2>/dev/null; then \
+		black --check setup.py samcli tests schema; \
+	else \
+		echo "Skipping black check on Python < 3.10"; \
+	fi
 
 format: black
 	ruff check samcli --fix

requirements/base.txt

@@ -1,23 +1,24 @@
 chevron~=0.12
 click==8.1.8
 Flask<3.2
-boto3[crt]==1.42.26
-jmespath~=1.0.1
+boto3[crt]==1.42.58
+jmespath~=1.1.0
 ruamel_yaml~=0.19.1
 PyYAML~=6.0
 cookiecutter~=2.6.0
 aws-sam-translator==1.107.0
 #docker minor version updates can include breaking changes. Auto update micro version only.
 docker~=7.1.0
-dateparser~=1.2
+dateparser~=1.3; python_version>="3.10"
+dateparser~=1.2; python_version<"3.10"
 requests~=2.32.5
 aws_lambda_builders==1.62.0
 tomlkit==0.14.0
 # NOTE: For supporting watchdog in Python3.8, version is pinned to 4.0.2 as 
 # version 5.0.2 introduced some breaking changes for versions > Python3.8
 watchdog==4.0.2
 
-rich~=14.2.0
+rich~=14.3.3
 pyopenssl~=25.3.0
 # Pin to <4.18 to until SAM-T no longer uses RefResolver
 jsonschema<4.27
@@ -31,7 +32,7 @@ regex!=2021.10.8
 tzlocal==5.3.1
 
 #Adding cfn-lint dependency for SAM validate
-cfn-lint~=1.43.1
+cfn-lint~=1.45.0
 
 # Type checking boto3 objects
 boto3-stubs[apigateway,cloudformation,ecr,iam,lambda,s3,schemas,secretsmanager,signer,stepfunctions,sts,xray,sqs,kinesis]>=1.41.0

requirements/dev.txt

@@ -1,7 +1,7 @@
 -r pre-dev.txt
 
-coverage==7.10.7; python_version>="3.9"
-coverage==7.6.1; python_version<"3.9"
+coverage==7.13.4; python_version>="3.10"
+coverage==7.10.7; python_version<"3.10"
 pytest-cov==7.0.0; python_version>="3.9"
 pytest-cov==5.0.0; python_version<"3.9"
 
@@ -15,11 +15,14 @@ types-pywin32==308.0.0.20241221; python_version<"3.9"
 types-PyYAML==6.0.12.20250915
 types-chevron==0.14.2.20250103
 types-psutil==7.2.2.20260130
-types-setuptools==80.10.0.20260124
+types-setuptools==82.0.0.20260210; python_version>="3.10"
+types-setuptools==80.10.0.20260124; python_version<"3.10"
 types-Pygments==2.19.0.20251121 
 types-colorama==0.4.15.20250801
-types-dateparser==1.2.2.20250809
-types-docutils==0.22.3.20251115
+types-dateparser==1.3.0.20260211; python_version>="3.10"
+types-dateparser==1.2.2.20250809; python_version<"3.10"
+types-docutils==0.22.3.20260223; python_version>="3.10"
+types-docutils==0.22.3.20251115; python_version<"3.10"
 types-jsonschema==4.26.0.20260202
 types-pyOpenSSL==24.1.0.20240722
 # lucashuy: pin `types-request` based on the Python version since newer versions of
@@ -30,7 +33,8 @@ types-urllib3==1.26.25.14
 
 # Test requirements
 
-pytest==8.4.1
+pytest==9.0.2; python_version>="3.10"
+pytest==8.4.1; python_version<"3.10"
 
 parameterized==0.9.0
 pytest-xdist==3.8.0
@@ -42,10 +46,13 @@ pytest-rerunfailures==16.0.1;  python_version<"3.10"
 pytest-metadata==3.1.1
 # NOTE (lucashuy): `pytest-json-report` was updated to `pytest-json-report-wip` as the original repository does not seem to be maintained anymore, if `-wip` is updated, validate the changes
 pytest-json-report-wip==1.5.1
-filelock==3.24.2;  python_version>="3.10"
+filelock==3.24.3;  python_version>="3.10"
 filelock==3.19.1;  python_version<"3.10"
 
 # formatter
-black==25.9.0; python_version>="3.9"
-black==24.8.0; python_version<"3.9"
-psutil==7.2.1
+black==26.1.0; python_version>"3.9"
+black==25.9.0; python_version<="3.9"
+psutil==7.2.2
+
+# Pin chardet to avoid requests compatibility assertion failure (requests requires chardet < 6)
+chardet<6

requirements/pre-dev.txt

@@ -1 +1 @@
-ruff==0.14.14
+ruff==0.15.4

requirements/pyinstaller-build.txt

@@ -1,3 +1,3 @@
 # Executable binary builder requirements
-setuptools==80.9.0
+setuptools==82.0.0
 pyinstaller==6.19.0