fix: remove expansion cache to fix sync watch nested stack failures

.coveragerc_no_lang_ext

@@ -0,0 +1,15 @@
+# Coverage config for `make test` which skips cfn_language_extensions tests.
+# Extends the base .coveragerc and also excludes the language extensions source
+# so coverage % isn't penalized when those tests are skipped.
+[run]
+branch = True
+omit =
+    samcli/lib/cfn_language_extensions/*
+    # Inherited from .coveragerc
+    samcli/lib/iac/plugins_interfaces.py
+    samcli/lib/init/templates/*
+    samcli/hook_packages/terraform/copy_terraform_built_artifacts.py
+[report]
+exclude_lines =
+    pragma: no cover
+    raise NotImplementedError.*

.github/workflows/build.yml

@@ -68,6 +68,7 @@ jobs:
     - uses: actions/setup-python@v6
       with:
         python-version: ${{ matrix.python }}
+    - uses: astral-sh/setup-uv@v7
     - run: test -f "./.github/ISSUE_TEMPLATE/Bug_report.md"  # prevent Bug_report.md from being renamed or deleted
     - run: make pr
 

.github/workflows/integration-tests.yml

@@ -121,6 +121,9 @@ jobs:
             3.13
             3.14
 
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+
       - name: Set up Node.js
         if: contains(fromJSON('["build-integ", "build-integ-java-python-provided", "build-integ-dotnet-node-ruby", "build-integ-arm64"]'), matrix.test_suite) && matrix.container_runtime == 'no-container'
         uses: actions/setup-node@v6

.github/workflows/test-sync-fix.yml

@@ -0,0 +1,147 @@
+name: Test Sync Fix - Cache Removal
+
+on:
+  workflow_dispatch:
+
+permissions:
+  id-token: write
+  contents: read
+
+env:
+  AWS_DEFAULT_REGION: us-east-1
+  SAM_CLI_DEV: 1
+  SAM_CLI_TELEMETRY: 0
+  SAM_CLI_CONTAINER_CONNECTION_TIMEOUT: 60
+  NOSE_PARAMETERIZED_NO_WARN: 1
+  BY_CANARY: true
+  UV_PYTHON: python3.11
+  CREDENTIAL_DISTRIBUTION_LAMBDA_ARN: ${{ secrets.CREDENTIAL_DISTRIBUTION_LAMBDA_ARN }}
+  ACCOUNT_RESET_LAMBDA_ARN: ${{ secrets.ACCOUNT_RESET_LAMBDA_ARN }}
+
+jobs:
+  sync-tests:
+    name: Sync Integration Tests (docker)
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Free up disk space
+        run: |
+          sudo rm -rf /usr/local/share/powershell /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL
+          sudo apt-get clean
+          docker system prune -af --volumes || true
+
+      - name: Configure AWS credentials via OIDC
+        uses: aws-actions/configure-aws-credentials@v6
+        with:
+          role-to-assume: ${{ secrets.OIDC_ROLE_ARN }}
+          aws-region: us-east-1
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: |
+            3.11
+            3.9
+            3.10
+            3.12
+            3.13
+            3.14
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+
+      - name: Set up Java 25
+        uses: actions/setup-java@v5
+        with:
+          distribution: 'corretto'
+          java-version: '25'
+
+      - name: Install Maven and Gradle
+        run: |
+          sudo apt-get remove -y maven || true
+          wget https://dlcdn.apache.org/maven/maven-3/3.9.12/binaries/apache-maven-3.9.12-bin.zip -P /tmp
+          sudo unzip -d /opt/mvn /tmp/apache-maven-*.zip
+          wget https://services.gradle.org/distributions/gradle-9.2.0-bin.zip -P /tmp
+          sudo unzip -d /opt/gradle /tmp/gradle-*.zip
+          sudo ln -sf /opt/mvn/apache-maven-3.9.12/bin/mvn /usr/local/bin/mvn
+          sudo ln -sf /opt/gradle/gradle-9.2.0/bin/gradle /usr/local/bin/gradle
+          echo "/opt/mvn/apache-maven-3.9.12/bin" >> $GITHUB_PATH
+          echo "/opt/gradle/gradle-9.2.0/bin" >> $GITHUB_PATH
+          echo "MAVEN_HOME=/opt/mvn/apache-maven-3.9.12" >> $GITHUB_ENV
+
+      - name: Set up Ruby 3.4.7
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.4.7'
+
+      - name: Setup QEMU for ARM64 emulation
+        run: docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
+
+      - name: Initialize project
+        run: make init
+
+      - name: Get testing resources and credentials
+        run: |
+          test_env_var=$(python3.11 tests/get_testing_resources.py skip_role_deletion)
+          if [ $? -ne 0 ]; then
+            test_env_var=$(python3.11 tests/get_testing_resources.py)
+            if [ $? -ne 0 ]; then
+              echo "Failed to acquire credentials or test resources."
+              exit 1
+            fi
+          fi
+
+          echo "CI_ACCESS_ROLE_AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID" >> $GITHUB_ENV
+          echo "CI_ACCESS_ROLE_AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY" >> $GITHUB_ENV
+          echo "CI_ACCESS_ROLE_AWS_SESSION_TOKEN=$AWS_SESSION_TOKEN" >> $GITHUB_ENV
+
+          TEST_ACCESS_KEY_ID=$(echo "$test_env_var" | jq -j ".accessKeyID")
+          TEST_SECRET_ACCESS_KEY=$(echo "$test_env_var" | jq -j ".secretAccessKey")
+          TEST_SESSION_TOKEN=$(echo "$test_env_var" | jq -j ".sessionToken")
+          TEST_TASK_TOKEN=$(echo "$test_env_var" | jq -j ".taskToken")
+
+          echo "::add-mask::$TEST_ACCESS_KEY_ID"
+          echo "::add-mask::$TEST_SECRET_ACCESS_KEY"
+          echo "::add-mask::$TEST_SESSION_TOKEN"
+          echo "::add-mask::$TEST_TASK_TOKEN"
+
+          echo "AWS_ACCESS_KEY_ID=$TEST_ACCESS_KEY_ID" >> $GITHUB_ENV
+          echo "AWS_SECRET_ACCESS_KEY=$TEST_SECRET_ACCESS_KEY" >> $GITHUB_ENV
+          echo "AWS_SESSION_TOKEN=$TEST_SESSION_TOKEN" >> $GITHUB_ENV
+          echo "TASK_TOKEN=$TEST_TASK_TOKEN" >> $GITHUB_ENV
+          echo "AWS_S3_TESTING=$(echo "$test_env_var" | jq -j ".TestBucketName")" >> $GITHUB_ENV
+          echo "AWS_ECR_TESTING=$(echo "$test_env_var" | jq -j ".TestECRURI")" >> $GITHUB_ENV
+          echo "AWS_KMS_KEY=$(echo "$test_env_var" | jq -j ".TestKMSKeyArn")" >> $GITHUB_ENV
+          echo "AWS_SIGNING_PROFILE_NAME=$(echo "$test_env_var" | jq -j ".TestSigningProfileName")" >> $GITHUB_ENV
+          echo "AWS_SIGNING_PROFILE_VERSION_ARN=$(echo "$test_env_var" | jq -j ".TestSigningProfileARN")" >> $GITHUB_ENV
+
+      - name: Login to Public ECR
+        run: |
+          aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws
+
+      - name: Run sync watch nested stack tests
+        run: |
+          pytest -vv tests/integration/sync/test_sync_watch.py -k "TestSyncInfraNestedStacks" --reruns 1 --json-report --json-report-file=TEST_REPORT-sync-nested.json
+
+      - name: Upload test results
+        if: always()
+        uses: actions/upload-artifact@v6
+        with:
+          name: test-results-sync-fix
+          path: TEST_REPORT-*.json
+
+      - name: Reset test account
+        if: always()
+        run: |
+          export AWS_ACCESS_KEY_ID=$CI_ACCESS_ROLE_AWS_ACCESS_KEY_ID
+          export AWS_SECRET_ACCESS_KEY=$CI_ACCESS_ROLE_AWS_SECRET_ACCESS_KEY
+          export AWS_SESSION_TOKEN=$CI_ACCESS_ROLE_AWS_SESSION_TOKEN
+          aws lambda invoke \
+            --function-name "$ACCOUNT_RESET_LAMBDA_ARN" \
+            --payload "{\"taskToken\": \"$TASK_TOKEN\", \"output\": \"{}\"}" \
+            ./lambda-output.txt \
+            --region us-west-2 \
+            --cli-binary-format raw-in-base64-out
+          cat ./lambda-output.txt

Makefile

@@ -13,11 +13,19 @@ init:
 	fi
 
 test:
-	# Run unit tests and fail if coverage falls below 94%
+	# Run unit tests (excluding cfn_language_extensions) and fail if coverage falls below 94%
+	pytest --cov samcli --cov schema --cov-report term-missing --cov-fail-under 94 tests/unit --ignore=tests/unit/lib/cfn_language_extensions --cov-config=.coveragerc_no_lang_ext
+
+test-lang-ext:
+	# Run cfn_language_extensions unit tests with coverage
+	pytest --cov samcli.lib.cfn_language_extensions --cov-report term-missing --cov-fail-under 94 tests/unit/lib/cfn_language_extensions
+
+test-all:
+	# Run all unit tests including cfn_language_extensions
 	pytest --cov samcli --cov schema --cov-report term-missing --cov-fail-under 94 tests/unit
 
 test-cov-report:
-	# Run unit tests with html coverage report
+	# Run all unit tests with html coverage report
 	pytest --cov samcli --cov schema --cov-report html --cov-fail-under 94 tests/unit
 
 integ-test:
@@ -45,7 +53,17 @@ lint:
 	mypy --exclude /testdata/ --exclude /init/templates/ --no-incremental setup.py samcli tests schema
 
 # Command to run everytime you make changes to verify everything works
-dev: lint test
+# Runs test-all if cfn_language_extensions files changed, otherwise test
+dev: lint
+	@if git diff --name-only origin/develop... 2>/dev/null | grep -qE 'cfn_language_extensions/'; then \
+		echo "Detected cfn_language_extensions changes — running all tests"; \
+		$(MAKE) test-all; \
+	else \
+		$(MAKE) test; \
+	fi
+
+# Run full verification including language extensions tests
+dev-all: lint test-all
 
 black:
 	black setup.py samcli tests schema
@@ -59,8 +77,8 @@ format: black
 schema:
 	python -m schema.make_schema
 
-# Verifications to run before sending a pull request
-pr: init schema black-check dev
+# Verifications to run before sending a pull request — runs ALL tests
+pr: init schema black-check lint test-all
 
 # lucashuy: Linux and MacOS are on the same Python version,
 # however we should follow up in a different change

installer/pyinstaller/build-linux.sh

@@ -20,7 +20,7 @@ if [ "$openssl_version" = "" ]; then
 fi
 
 if [ "$zlib_version" = "" ]; then
-    zlib_version="1.3.1";
+    zlib_version="1.3.2";
 fi
 
 if [ "$CI_OVERRIDE" = "1" ]; then

pyproject.toml

@@ -22,6 +22,7 @@ max-statements = 80
 "__init__.py" = ["F401", "E501"]
 "integration_uri.py" = ["E501"] # ARNs are long.
 "app.py" = ["E501"] # Doc links are long.
+"samcli/lib/cfn_language_extensions/**/*.py" = ["PLR2004", "PLR0911", "PLR1714"]  # Magic values and return statements are acceptable in intrinsic resolvers
 
 [tool.black]
 line-length = 120

requirements/base.txt

@@ -3,7 +3,7 @@ click==8.1.8
 Flask<3.2
 boto3[crt]==1.42.26
 jmespath~=1.0.1
-ruamel_yaml~=0.18.16
+ruamel_yaml~=0.19.1
 PyYAML~=6.0
 cookiecutter~=2.6.0
 aws-sam-translator==1.107.0