fix(cfn-lang-ext): route Fn::ForEach dynamic-property consumers through jmespath

PACKAGEABLE_RESOURCE_ARTIFACT_PROPERTIES now contains dotted paths like
Command.ScriptLocation (Glue) and Code.ImageUri (Lambda image), but four
call sites in build_context, sam_integration, and language_extensions_packaging
were still doing flat-key dict access:

- _update_foreach_artifact_paths
- _count_dynamic_properties
- _get_artifact_value
- detect_foreach_dynamic_properties

For dotted entries those reads return None, the early skip kicks in, no
SAM* mapping is generated, and the dotted artifact value never propagates
back to the Fn::ForEach body. CloudFormation Mapping names and FindInMap
third-arg keys also can't contain dots.

Switch the four sites to _get_prop_value / _set_prop_value, derive the
Mapping name and FindInMap third-arg from the leaf segment via a new
_leaf_prop_name helper, and add _resolve_property_paths to skip parent
paths when a more specific dotted child is present (so Lambda::Function
"Code" doesn't shadow "Code.ImageUri" for image functions).

Adds 6 regression tests covering Fn::ForEach over Glue::Job with
templated Command.ScriptLocation and Lambda::Function with templated
Code.ImageUri at both detection and Mapping-generation layers.

Addresses review feedback on PR #9009.

Author: bnusunny

samcli/commands/build/build_context.py

@@ -553,6 +553,12 @@ def _update_foreach_artifact_paths(
         """
         from samcli.lib.cfn_language_extensions.models import PACKAGEABLE_RESOURCE_ARTIFACT_PROPERTIES
         from samcli.lib.cfn_language_extensions.sam_integration import resolve_collection
+        from samcli.lib.package.language_extensions_packaging import (
+            _get_prop_value,
+            _leaf_prop_name,
+            _resolve_property_paths,
+            _set_prop_value,
+        )
 
         generated_mappings: Dict[str, Dict[str, Dict[str, str]]] = {}
 
@@ -599,11 +605,17 @@ def _update_foreach_artifact_paths(
             if not isinstance(properties, dict):
                 continue
 
-            for prop_name in PACKAGEABLE_RESOURCE_ARTIFACT_PROPERTIES.get(resource_type, []):
-                prop_value = properties.get(prop_name)
+            candidate_paths = PACKAGEABLE_RESOURCE_ARTIFACT_PROPERTIES.get(resource_type, [])
+            for prop_name in _resolve_property_paths(candidate_paths, properties):
+                prop_value = _get_prop_value(properties, prop_name)
                 if prop_value is None:
                     continue
 
+                # CloudFormation Mapping names and FindInMap third-args must be alphanumeric,
+                # so dotted property names (e.g. "Command.ScriptLocation") use the leaf segment
+                # for those identifiers while the dotted form is preserved for property addressing.
+                leaf_name = _leaf_prop_name(prop_name)
+
                 if contains_loop_variable(prop_value, loop_variable) and collection_values:
                     # Determine which outer loop variables the property references
                     referenced_outer_vars = []
@@ -622,7 +634,7 @@ def _update_foreach_artifact_paths(
                         referenced_outer_vars=referenced_outer_vars,
                     )
                     if mapping_entries:
-                        mapping_name = f"SAM{prop_name}{nesting_path}"
+                        mapping_name = f"SAM{leaf_name}{nesting_path}"
                         if dynamic_props_count.get(prop_name, 0) > 1:
                             suffix = sanitize_resource_key_for_mapping(resource_template_key)
                             mapping_name = f"{mapping_name}{suffix}"
@@ -637,7 +649,7 @@ def _update_foreach_artifact_paths(
                         else:
                             lookup_key = {"Ref": loop_variable}
 
-                        properties[prop_name] = {"Fn::FindInMap": [mapping_name, lookup_key, prop_name]}
+                        _set_prop_value(properties, prop_name, {"Fn::FindInMap": [mapping_name, lookup_key, leaf_name]})
                 else:
                     expanded_key = self._build_expanded_key(
                         resource_template_key,
@@ -648,7 +660,7 @@ def _update_foreach_artifact_paths(
                     if expanded_key:
                         artifact_value = self._get_artifact_value(modified_resources, expanded_key, prop_name)
                         if artifact_value is not None:
-                            properties[prop_name] = artifact_value
+                            _set_prop_value(properties, prop_name, artifact_value)
 
             # Propagate auto dependency layer references from expanded functions
             # to the ForEach body. Each expanded function may have Layers entries
@@ -707,6 +719,7 @@ def _count_dynamic_properties(
         share the same property name (e.g., two resources both with DefinitionUri).
         """
         from samcli.lib.cfn_language_extensions.models import PACKAGEABLE_RESOURCE_ARTIFACT_PROPERTIES
+        from samcli.lib.package.language_extensions_packaging import _get_prop_value, _resolve_property_paths
 
         count: Counter = Counter()
         for rtk, rt in body.items():
@@ -718,8 +731,9 @@ def _count_dynamic_properties(
             rprops = rt.get("Properties", {})
             if not isinstance(rprops, dict):
                 continue
-            for pname in PACKAGEABLE_RESOURCE_ARTIFACT_PROPERTIES.get(rtype, []):
-                pval = rprops.get(pname)
+            candidate_paths = PACKAGEABLE_RESOURCE_ARTIFACT_PROPERTIES.get(rtype, [])
+            for pname in _resolve_property_paths(candidate_paths, rprops):
+                pval = _get_prop_value(rprops, pname)
                 if pval is not None and contains_loop_variable(pval, loop_variable) and collection_values:
                     count[pname] += 1
         return count
@@ -759,8 +773,15 @@ def _collect_dynamic_mapping_entries(
 
         For nested ForEach, enumerates all outer value combinations to find
         the fully-expanded resource name.
+
+        ``prop_name`` may be a jmespath dotted path; the value-dict key stored
+        in the Mapping uses the leaf segment so it stays alphanumeric and
+        matches the third argument of the generated Fn::FindInMap.
         """
+        from samcli.lib.package.language_extensions_packaging import _leaf_prop_name
+
         mapping_entries: Dict[str, Dict[str, str]] = {}
+        leaf_name = _leaf_prop_name(prop_name)
 
         for coll_value in collection_values:
             if outer_context:
@@ -778,7 +799,7 @@ def _collect_dynamic_mapping_entries(
                 expanded_key = substitute_loop_variable(resource_template_key, loop_variable, coll_value)
                 artifact_value = self._get_artifact_value(modified_resources, expanded_key, prop_name)
                 if artifact_value is not None:
-                    mapping_entries[coll_value] = {prop_name: artifact_value}
+                    mapping_entries[coll_value] = {leaf_name: artifact_value}
 
         return mapping_entries
 
@@ -793,9 +814,15 @@ def _collect_nested_mapping_entry(
         mapping_entries: Dict[str, Dict[str, str]],
         referenced_outer_vars: Optional[List[Tuple[str, List[str]]]] = None,
     ) -> None:
-        """Enumerate outer value combinations to find expanded resource for a nested ForEach."""
+        """Enumerate outer value combinations to find expanded resource for a nested ForEach.
+
+        ``prop_name`` may be a jmespath dotted path; the value-dict key uses the leaf segment.
+        """
         import itertools
 
+        from samcli.lib.package.language_extensions_packaging import _leaf_prop_name
+
+        leaf_name = _leaf_prop_name(prop_name)
         outer_collections = [oc[1] for oc in outer_context]
         outer_vars = [oc[0] for oc in outer_context]
 
@@ -821,7 +848,7 @@ def _collect_nested_mapping_entry(
                 mapping_key = coll_value
 
             if mapping_key not in mapping_entries:
-                mapping_entries[mapping_key] = {prop_name: artifact_value}
+                mapping_entries[mapping_key] = {leaf_name: artifact_value}
 
     def _collect_foreach_layer_mappings(
         self,
@@ -895,14 +922,19 @@ def _extract_nested_stack_layer_output(modified_resources: Dict, expanded_key: s
 
     @staticmethod
     def _get_artifact_value(modified_resources: Dict, expanded_key: str, prop_name: str) -> Optional[Any]:
-        """Extract an artifact property value from an expanded resource, or return None."""
+        """Extract an artifact property value from an expanded resource, or return None.
+
+        ``prop_name`` may be a jmespath dotted path (e.g. "Command.ScriptLocation").
+        """
+        from samcli.lib.package.language_extensions_packaging import _get_prop_value
+
         modified_resource = modified_resources.get(expanded_key, {})
         if not isinstance(modified_resource, dict):
             return None
         modified_props = modified_resource.get("Properties", {})
         if not isinstance(modified_props, dict):
             return None
-        return modified_props.get(prop_name)
+        return _get_prop_value(modified_props, prop_name)
 
     def _copy_artifact_paths(self, original_resource: Dict, modified_resource: Dict) -> None:
         """

samcli/lib/cfn_language_extensions/sam_integration.py

@@ -412,8 +412,10 @@ def detect_foreach_dynamic_properties(
         if not isinstance(properties, dict):
             continue
 
-        for prop_name in artifact_properties:
-            prop_value = properties.get(prop_name)
+        from samcli.lib.package.language_extensions_packaging import _get_prop_value, _resolve_property_paths
+
+        for prop_name in _resolve_property_paths(artifact_properties, properties):
+            prop_value = _get_prop_value(properties, prop_name)
             if prop_value is not None:
                 if contains_loop_variable(prop_value, loop_variable):
                     dynamic_properties.append(

samcli/lib/package/language_extensions_packaging.py

@@ -134,6 +134,50 @@ def _set_prop_value(props: Dict[str, Any], prop_name: str, value: Any) -> None:
     set_value_from_jmespath(props, prop_name, value)
 
 
+def _leaf_prop_name(prop_name: str) -> str:
+    """Return the last segment of a jmespath property name.
+
+    CloudFormation Mapping names must be alphanumeric, and the third argument of
+    Fn::FindInMap and the keys of Mapping value-dicts must match each other as
+    plain strings. Dotted property names (e.g. "Command.ScriptLocation") are
+    used to *address* the property on a resource, but the *identifier* used in
+    Mapping names and FindInMap lookups must use only the leaf segment so the
+    generated CloudFormation is well-formed.
+    """
+    return prop_name.rsplit(".", 1)[-1]
+
+
+def _resolve_property_paths(prop_names: List[str], properties: Dict[str, Any]) -> List[str]:
+    """Filter ``prop_names`` so a parent path is dropped when a more specific
+    child path is present in ``properties``.
+
+    Some resource types declare multiple alternative artifact paths in
+    ``PACKAGEABLE_RESOURCE_ARTIFACT_PROPERTIES``. For example,
+    ``AWS::Lambda::Function`` lists ``Code`` (used for ZIP packages) and
+    ``Code.ImageUri`` (used for image packages). A given user template uses
+    only one of these shapes, but ``Code`` is a prefix of ``Code.ImageUri``,
+    so a naive iteration would address both paths and treat the same nested
+    value twice. Returning only the most specific resolved path picks the
+    correct interpretation for the user's actual property shape.
+    """
+    # Sort longest-first so child paths win over their parents.
+    sorted_paths = sorted(prop_names, key=lambda p: -p.count("."))
+    consumed_prefixes: set = set()
+    selected: List[str] = []
+    for path in sorted_paths:
+        if _get_prop_value(properties, path) is None:
+            continue
+        # If a more specific path under this prefix has already been selected, skip.
+        if any(other.startswith(path + ".") for other in consumed_prefixes):
+            continue
+        selected.append(path)
+        consumed_prefixes.add(path)
+    # Preserve original ordering for callers that care.
+    order = {p: i for i, p in enumerate(prop_names)}
+    selected.sort(key=lambda p: order.get(p, 0))
+    return selected
+
+
 # ---------------------------------------------------------------------------
 # Merge helpers
 # ---------------------------------------------------------------------------
@@ -330,7 +374,9 @@ def _compute_mapping_name(
     compatibility.
     """
     npath = _nesting_path(prop)
-    base_name = f"SAM{prop.property_name}{npath}"
+    # Use the leaf segment for the Mapping name so dotted property paths (e.g.
+    # "Command.ScriptLocation") yield well-formed alphanumeric Mapping names.
+    base_name = f"SAM{_leaf_prop_name(prop.property_name)}{npath}"
     key = (npath, prop.property_name)
     if collision_groups.get(key, 0) <= 1:
         return base_name
@@ -363,6 +409,10 @@ def _generate_artifact_mappings(
         _validate_mapping_key_compatibility(prop)
 
         mapping_name = _compute_mapping_name(prop, collision_groups)
+        # The Mapping value-dict key and the third FindInMap argument must use
+        # the leaf segment so dotted property paths produce well-formed
+        # CloudFormation (Mappings can't contain dots in either name or keys).
+        leaf_name = _leaf_prop_name(prop.property_name)
 
         if mapping_name not in mappings:
             mappings[mapping_name] = {}
@@ -394,7 +444,7 @@ def _generate_artifact_mappings(
                 )
 
                 if s3_uri:
-                    mappings[mapping_name][compound_key] = {prop.property_name: s3_uri}
+                    mappings[mapping_name][compound_key] = {leaf_name: s3_uri}
                 else:
                     LOG.warning(
                         "Could not find S3 URI for %s in expanded resource %s",
@@ -421,7 +471,7 @@ def _generate_artifact_mappings(
                 )
 
                 if s3_uri:
-                    mappings[mapping_name][collection_value] = {prop.property_name: s3_uri}
+                    mappings[mapping_name][collection_value] = {leaf_name: s3_uri}
                 else:
                     LOG.warning(
                         "Could not find S3 URI for %s in expanded resource %s",
@@ -465,7 +515,8 @@ def _find_artifact_uri_for_resource(
     Find the artifact URI for a specific resource and property from the exported resources.
 
     Handles all artifact property export formats (string URIs, {S3Bucket, S3Key},
-    {Bucket, Key}, {ImageUri}).
+    {Bucket, Key}, {ImageUri}). ``property_name`` may be a jmespath dotted path
+    (e.g. "Command.ScriptLocation").
     """
     resource = exported_resources.get(resource_key)
     if not isinstance(resource, dict):
@@ -478,7 +529,7 @@ def _find_artifact_uri_for_resource(
     if not isinstance(properties, dict):
         return None
 
-    artifact_uri = properties.get(property_name)
+    artifact_uri = _get_prop_value(properties, property_name)
 
     if isinstance(artifact_uri, str):
         return artifact_uri
@@ -531,7 +582,8 @@ def _replace_dynamic_artifact_with_findmap(
     Replace a dynamic artifact property value with Fn::FindInMap reference.
     """
     if mapping_name is None:
-        mapping_name = f"SAM{prop.property_name}{_nesting_path(prop)}"
+        # Use the leaf segment so dotted paths produce alphanumeric Mapping names.
+        mapping_name = f"SAM{_leaf_prop_name(prop.property_name)}{_nesting_path(prop)}"
 
     current_scope = resources
     if prop.outer_loops:
@@ -581,13 +633,20 @@ def _replace_dynamic_artifact_with_findmap(
     else:
         lookup_key = {"Ref": prop.loop_variable}
 
-    properties[prop.property_name] = {
-        "Fn::FindInMap": [
-            mapping_name,
-            lookup_key,
-            prop.property_name,
-        ]
-    }
+    # Address the property at its dotted location (creating intermediate dicts
+    # if needed) and use the leaf segment as the FindInMap third argument so
+    # the lookup matches the Mapping value-dict key.
+    _set_prop_value(
+        properties,
+        prop.property_name,
+        {
+            "Fn::FindInMap": [
+                mapping_name,
+                lookup_key,
+                _leaf_prop_name(prop.property_name),
+            ]
+        },
+    )
 
     LOG.debug(
         "Replaced %s in %s/%s with Fn::FindInMap reference to %s",