sdk main

.codecov.yml

@@ -0,0 +1,11 @@
+coverage:
+  status:
+    project:
+      default:
+        target: 90%    # overall coverage threshold
+    patch:
+      default:
+        target: 90%    # patch coverage threshold
+        base: auto
+        # Only post patch coverage on decreases
+        only_pulls: true

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -61,9 +61,10 @@ body:
       label: Steps to Reproduce
       description: Detailed steps to reproduce the behavior
       placeholder: |
-        1. Install Strands using...
-        2. Run the command...
-        3. See error...
+        1. Code Snippet (Minimal reproducible example)
+        2. Install Strands using...
+        3. Run the command...
+        4. See error...
     validations:
       required: true
   - type: textarea

.github/workflows/LAMDBA_LAYERS_SOP.md

@@ -0,0 +1,43 @@
+# Lambda Layers Standard Operating Procedures (SOP)
+
+## Overview
+
+This document defines the standard operating procedures for managing Strands Agents Lambda layers across all AWS regions, Python versions, and architectures.
+
+**Total: 136 individual Lambda layers** (17 regions × 2 architectures × 4 Python versions). All variants must maintain the same layer version number for each PyPI package version, with only one row per PyPI version appearing in documentation.
+
+## Deployment Process
+
+### 1. Initial Deployment
+1. Run workflow with ALL options selected (default)
+2. Specify PyPI package version
+3. Type "Create Lambda Layer {package_version}" to confirm
+4. All 136 individual layers deploy in parallel (4 Python × 2 arch × 17 regions)
+5. Each layer gets its own unique name: `strands-agents-py{PYTHON_VERSION}-{ARCH}`
+
+### 2. Version Buffering for New Variants
+When adding new variants (new Python version, architecture, or region):
+
+1. **Determine target layer version**: Check existing variants to find the highest layer version
+2. **Buffer deployment**: Deploy new variants multiple times until layer version matches existing variants
+3. **Example**: If existing variants are at layer version 5, deploy new variant 5 times to reach version 5
+
+### 3. Handling Transient Failures
+When some regions fail during deployment:
+
+1. **Identify failed regions**: Check which combinations didn't complete successfully
+2. **Targeted redeployment**: Use specific region/arch/Python inputs to redeploy failed combinations
+3. **Version alignment**: Continue deploying until all variants reach the same layer version
+4. **Verification**: Confirm all combinations have identical layer versions before updating docs
+
+## Yank Process
+
+### Yank Procedure
+1. Use the `yank_lambda_layer` GitHub action workflow
+2. Specify the layer version to yank
+3. Type "Yank Lambda Layer {layer_version}" to confirm
+4. **Full yank**: Run with ALL options selected (default) to yank all 136 variants OR **Partial yank**: Specify Python versions, architectures, and regions for targeted yanking
+6. Update documentation
+7. **Communication**: Notify users through appropriate channels
+
+**Note**: Yanking deletes layer versions completely. Existing Lambda functions using the layer continue to work, but new functions cannot use the yanked version.

.github/workflows/auto-close.yml

@@ -0,0 +1,242 @@
+name: Auto Close Issues
+
+on:
+  schedule:
+    - cron: '0 14 * * 1-5'  # 9 AM EST (2 PM UTC) Monday through Friday
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: 'Run in dry-run mode (no actions taken, only logging)'
+        required: false
+        default: 'false'
+        type: boolean
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
+jobs:
+  auto-close:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - label: 'autoclose in 3 days'
+            days: 3
+            issue_types: 'issues' #issues/pulls/both
+            replacement_label: ''
+            closure_message: 'This issue has been automatically closed as it was marked for auto-closure by the team and no additional responses was received within 3 days.'
+            dry_run: 'false'
+          - label: 'autoclose in 7 days'
+            days: 7
+            issue_types: 'issues'  # issues/pulls/both
+            replacement_label: ''
+            closure_message: 'This issue has been automatically closed as it was marked for auto-closure by the team and no additional responses was received within 7 days.'
+            dry_run: 'false'
+    steps:
+      - name: Validate and process ${{ matrix.label }}
+        uses: actions/github-script@v8
+        env:
+          LABEL_NAME: ${{ matrix.label }}
+          DAYS_TO_WAIT: ${{ matrix.days }}
+          AUTHORIZED_USERS: ''
+          AUTH_MODE: 'write-access'
+          ISSUE_TYPES: ${{ matrix.issue_types }}
+          DRY_RUN: ${{ matrix.dry_run }}
+          REPLACEMENT_LABEL: ${{ matrix.replacement_label }}
+          CLOSE_MESSAGE: ${{matrix.closure_message}}
+        with:
+          script: |
+            const REQUIRED_PERMISSIONS = ['write', 'admin'];
+            const CLOSE_MESSAGE = process.env.CLOSE_MESSAGE;
+            const isDryRun = '${{ inputs.dry_run }}' === 'true' || process.env.DRY_RUN === 'true';
+
+            const config = {
+              labelName: process.env.LABEL_NAME,
+              daysToWait: parseInt(process.env.DAYS_TO_WAIT),
+              authMode: process.env.AUTH_MODE,
+              authorizedUsers: process.env.AUTHORIZED_USERS?.split(',').map(u => u.trim()).filter(u => u) || [],
+              issueTypes: process.env.ISSUE_TYPES,
+              replacementLabel: process.env.REPLACEMENT_LABEL?.trim() || null
+            };
+
+            console.log(`🏷️ Processing label: "${config.labelName}" (${config.daysToWait} days)`);
+            if (isDryRun) console.log('🧪 DRY-RUN MODE: No actions will be taken');
+
+            const cutoffDate = new Date();
+            cutoffDate.setDate(cutoffDate.getDate() - config.daysToWait);
+
+            async function isAuthorizedUser(username) {
+              try {
+                if (config.authMode === 'users') {
+                  return config.authorizedUsers.includes(username);
+                } else if (config.authMode === 'write-access') {
+                  const { data } = await github.rest.repos.getCollaboratorPermissionLevel({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    username: username
+                  });
+                  return REQUIRED_PERMISSIONS.includes(data.permission);
+                }
+              } catch (error) {
+                console.log(`⚠️ Failed to check authorization for ${username}: ${error.message}`);
+                return false;
+              }
+              return false;
+            }
+
+            let allIssues = [];
+            let page = 1;
+
+            while (true) {
+              const { data: issues } = await github.rest.issues.listForRepo({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                state: 'open',
+                labels: config.labelName,
+                sort: 'updated',
+                direction: 'desc',
+                per_page: 100,
+                page: page
+              });
+
+              if (issues.length === 0) break;
+              allIssues = allIssues.concat(issues);
+              if (issues.length < 100) break;
+              page++;
+            }
+
+            const targetIssues = allIssues.filter(issue => {
+              if (config.issueTypes === 'issues' && issue.pull_request) return false;
+              if (config.issueTypes === 'pulls' && !issue.pull_request) return false;
+              return true;
+            });
+
+            console.log(`🔍 Found ${targetIssues.length} items with label "${config.labelName}"`);
+
+            if (targetIssues.length === 0) {
+              console.log('✅ No items to process');
+              return;
+            }
+
+            let closedCount = 0;
+            let labelRemovedCount = 0;
+            let skippedCount = 0;
+
+            for (const issue of targetIssues) {
+              console.log(`\n📋 Processing #${issue.number}: ${issue.title}`);
+
+              try {
+                const { data: events } = await github.rest.issues.listEvents({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: issue.number
+                });
+
+                const labelEvents = events
+                  .filter(e => e.event === 'labeled' && e.label?.name === config.labelName)
+                  .sort((a, b) => new Date(b.created_at) - new Date(a.created_at));
+
+                if (labelEvents.length === 0) {
+                  console.log(`⚠️ No label events found for #${issue.number}`);
+                  skippedCount++;
+                  continue;
+                }
+
+                const lastLabelAdded = new Date(labelEvents[0].created_at);
+                const labelAdder = labelEvents[0].actor.login;
+
+                const { data: comments } = await github.rest.issues.listComments({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: issue.number,
+                  since: lastLabelAdded.toISOString()
+                });
+
+                let hasUnauthorizedComment = false;
+
+                for (const comment of comments) {
+                  if (comment.user.login === labelAdder) continue;
+
+                  const isAuthorized = await isAuthorizedUser(comment.user.login);
+                  if (!isAuthorized) {
+                    console.log(`❌ New comment from ${comment.user.login}`);
+                    hasUnauthorizedComment = true;
+                    break;
+                  }
+                }
+
+                if (hasUnauthorizedComment) {
+                  if (isDryRun) {
+                    console.log(`🧪 DRY-RUN: Would remove ${config.labelName} label from #${issue.number}`);
+                    if (config.replacementLabel) {
+                      console.log(`🧪 DRY-RUN: Would add ${config.replacementLabel} label to #${issue.number}`);
+                    }
+                  } else {
+                    await github.rest.issues.removeLabel({
+                      owner: context.repo.owner,
+                      repo: context.repo.repo,
+                      issue_number: issue.number,
+                      name: config.labelName
+                    });
+                    console.log(`🏷️ Removed ${config.labelName} label from #${issue.number}`);
+
+                    if (config.replacementLabel) {
+                      await github.rest.issues.addLabels({
+                        owner: context.repo.owner,
+                        repo: context.repo.repo,
+                        issue_number: issue.number,
+                        labels: [config.replacementLabel]
+                      });
+                      console.log(`🏷️ Added ${config.replacementLabel} label to #${issue.number}`);
+                    }
+                  }
+                  labelRemovedCount++;
+                  continue;
+                }
+
+                if (lastLabelAdded > cutoffDate) {
+                  const daysRemaining = Math.ceil((lastLabelAdded - cutoffDate) / (1000 * 60 * 60 * 24));
+                  console.log(`⏳ Label added too recently (${daysRemaining} days remaining)`);
+                  skippedCount++;
+                  continue;
+                }
+
+                if (isDryRun) {
+                  console.log(`🧪 DRY-RUN: Would close #${issue.number} with comment`);
+                } else {
+                  await github.rest.issues.createComment({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: issue.number,
+                    body: CLOSE_MESSAGE
+                  });
+
+                  await github.rest.issues.update({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: issue.number,
+                    state: 'closed'
+                  });
+
+                  console.log(`🔒 Closed #${issue.number}`);
+                }
+                closedCount++;
+              } catch (error) {
+                console.log(`❌ Error processing #${issue.number}: ${error.message}`);
+                skippedCount++;
+              }
+            }
+
+            console.log(`\n📊 Summary for "${config.labelName}":`);
+            if (isDryRun) {
+              console.log(`   🧪 DRY-RUN MODE - No actual changes made:`);
+              console.log(`   • Issues that would be closed: ${closedCount}`);
+              console.log(`   • Labels that would be removed: ${labelRemovedCount}`);
+            } else {
+              console.log(`   • Issues closed: ${closedCount}`);
+              console.log(`   • Labels removed: ${labelRemovedCount}`);
+            }
+            console.log(`   • Issues skipped: ${skippedCount}`);
+            console.log(`   • Total processed: ${targetIssues.length}`);

.github/workflows/integration-test.yml

@@ -12,7 +12,7 @@ jobs:
       approval-env: ${{ steps.collab-check.outputs.result }}
     steps:
       - name: Collaborator Check
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         id: collab-check
         with:
           result-encoding: string
@@ -46,18 +46,18 @@ jobs:
       contents: read
     steps:
       - name: Configure Credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v5
         with:
          role-to-assume: ${{ secrets.STRANDS_INTEG_TEST_ROLE }}
          aws-region: us-east-1
          mask-aws-account-id: true
       - name: Checkout head commit
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: ${{ github.event.pull_request.head.sha }} # Pull the commit from the forked repo
           persist-credentials: false  # Don't persist credentials for subsequent actions
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.10'
       - name: Install dependencies
@@ -67,6 +67,7 @@ jobs:
         env:
           AWS_REGION: us-east-1
           AWS_REGION_NAME: us-east-1 # Needed for LiteLLM
+          STRANDS_TEST_API_KEYS_SECRET_NAME: ${{ secrets.STRANDS_TEST_API_KEYS_SECRET_NAME }}
         id: tests
         run: |
           hatch test tests_integ

.github/workflows/pr-and-push.yml

@@ -3,7 +3,7 @@ name: Pull Request and Push Action
 on:
   pull_request:  # Safer than pull_request_target for untrusted code
     branches: [ main ]
-    types: [opened, synchronize, reopened, ready_for_review, review_requested, review_request_removed]
+    types: [opened, synchronize, reopened, ready_for_review]
   push:
     branches: [ main ]  # Also run on direct pushes to main
 concurrency: