feat(build): build Docker images instead of zip archive (#21)

Author: SafeEval

.github/workflows/pull-request-code.yml

@@ -0,0 +1,62 @@
+name: PR Checks
+
+on:
+  pull_request:
+    branches:
+      - main
+      - master
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - edited
+
+jobs:
+  pr-code-checks:
+    name: Code
+    runs-on: ubuntu-latest
+    if: github.event.action == 'opened' || github.event.action == 'synchronize' || github.event.action == 'reopened'
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ github.head_ref || github.ref }}
+          # Need full history and tags to find the last release.
+          fetch-depth: 0
+          fetch-tags: true
+
+      # Work around occasional fetch-tags quirks.
+      - run: git fetch --tags --force
+
+      - name: Install Python
+        uses: actions/setup-python@v5
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6.4.3
+        with:
+          version: latest
+
+      - name: Setup
+        run: uv run task setup
+
+      - name: Lint
+        run: uv run task lint
+
+      - name: Unit Test
+        run: uv run task unit-test
+
+      - name: Build
+        run: uv run task build
+
+      - name: Integration Test
+        run: uv run task integration-test-no-build
+
+  pr-content-checks:
+    name: Content
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Validate PR title
+        run: ./scripts/conventional-commit.sh "${{ github.event.pull_request.title }}"

.github/workflows/pull-request-format.yml

@@ -0,0 +1,56 @@
+########################################################
+# Stage 1: Install dependencies with uv and copy to /opt/python
+########################################################
+FROM python:3.12-slim AS deps
+
+# Avoid prompts & keep images small
+ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \
+    PIP_NO_CACHE_DIR=1
+
+ARG APP_ROOT="/app"
+WORKDIR ${APP_ROOT}
+
+# Bring in lockfiles first for better caching
+COPY pyproject.toml ${APP_ROOT}/
+COPY uv.lock ${APP_ROOT}/
+
+# Install uv and create a local venv, then sync (no dev deps)
+RUN pip install --no-cache-dir uv
+RUN uv sync --no-group dev --frozen
+
+# Materialize a Lambda-style "layer" dir with only runtime packages
+# (Lambda adds /opt/python to sys.path automatically)
+RUN mkdir -p /opt/python
+RUN cp -a ${APP_ROOT}/.venv/lib/python3.12/site-packages/. /opt/python/
+
+
+########################################################
+# Stage 2: Create final AWS Lambda image
+########################################################
+#FROM public.ecr.aws/lambda/python:3.12-arm64
+FROM public.ecr.aws/lambda/python:3.12
+
+ARG APP_NAME
+ARG APP_VERSION
+ARG COMMIT_SHA
+ARG BRANCH
+ARG BUILD_DATE
+
+ENV APP_NAME="${APP_NAME}"
+ENV APP_VERSION="${APP_VERSION}"
+ENV COMMIT_SHA="${COMMIT_SHA}"
+ENV BRANCH="${BRANCH}"
+ENV BUILD_DATE="${BUILD_DATE}"
+
+LABEL org.opencontainers.image.name="${APP_NAME}" \
+      org.opencontainers.image.version="${APP_VERSION}" \
+      org.opencontainers.image.revision="${COMMIT_SHA}" \
+      org.opencontainers.image.ref.branch="${BRANCH}" \
+      org.opencontainers.image.created="${BUILD_DATE}"
+
+# This image automatically adds packages in /opt/python to sys.path
+COPY --from=deps /opt/python /opt/python
+COPY src/ ${LAMBDA_TASK_ROOT}/
+
+ENV _HANDLER="main.handler"
+CMD ["main.handler"]

.github/workflows/pull-request.yml

@@ -1,2 +1,3 @@
-# lambda-application
-Lambda app code and release, decoupled from Terraformed infrastructure
+# Demo Lambda Application
+
+Lambda app code and release, decoupled from Terraformed infrastructure.

Dockerfile

@@ -2,6 +2,12 @@
 
 version: "3"
 
+vars:
+  DOCKER_IMAGE_NAME: lambda-application
+  DOCKER_IMAGE_TAG:
+    sh: ./scripts/get-version.sh
+  DOCKER_IMAGE: "{{.DOCKER_IMAGE_NAME}}:{{.DOCKER_IMAGE_TAG}}"
+
 tasks:
   default:
     cmds:
@@ -18,6 +24,11 @@ tasks:
     cmds:
       - ./scripts/setup.sh
 
+  get-version:
+    run: once
+    cmds:
+      - ./scripts/get-version.sh
+
   format:
     run: once
     cmds:
@@ -31,28 +42,37 @@ tasks:
   build:
     run: once
     cmds:
-      - ./scripts/build.sh
+      - ./scripts/build-image.sh
 
   unit-test:
     run: once
     cmds:
       - ./scripts/unit-test.sh
 
+  integration-test-no-build:
+    run: once
+    cmds:
+      - task: start-local-instance
+      - defer: { task: stop-local-instance }
+      - ./scripts/integration-test.sh
+
   integration-test:
     run: once
     deps:
       - build
     cmds:
       - task: start-local-instance
+      - defer: { task: stop-local-instance }
       - ./scripts/integration-test.sh
-      - task: stop-local-instance
 
   start-local-instance:
+    desc: Start a local Lambda instance for testing
     run: once
     cmds:
-      - ./scripts/local-instance.sh start
+      - ./scripts/local-instance.sh start {{.DOCKER_IMAGE}}
 
   stop-local-instance:
+    desc: Stop the local Lambda instance
     run: once
     cmds:
-      - ./scripts/local-instance.sh stop
+      - ./scripts/local-instance.sh stop {{.DOCKER_IMAGE}}