ci: Modernize GitHub Actions workflows

PeterNigh · PeterNigh · commit e004a01b8c57 · 2026-04-01T11:54:38.000-04:00
Update deprecated runners and EOL Python versions:
- Replace macos-12 (removed by GitHub) with macos-13
- Drop Python 3.8 (EOL Oct 2024) and 3.9 (EOL Oct 2025)
- Add Python 3.12 to test matrix
- Bump all actions to v4 (checkout, setup-python, setup-node,
  cache, upload-artifact, download-artifact)
- Remove unnecessary Python matrix from cd.yml delivery-python
- Add unique artifact names to prevent upload-artifact@v4 conflicts
diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
@@ -1,4 +1,3 @@
----
 # Continuous Delivery (Release)
 name: cd
 
@@ -12,8 +11,8 @@ jobs:
     name: Prepare for NPM
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
         with:
           node-version: 20
           registry-url: https://registry.npmjs.org/
@@ -28,47 +27,44 @@ jobs:
           npm pack
       - name: Upload NPM Artifacts
         id: upload_npm
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: package-npm
           path: cfn-rpdk-${{ env.VERSION }}.tgz
 
   delivery-python:
     name: Prepare for PyPI
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        python: [3.8]
     steps:
-      - uses: actions/checkout@v3
-      - name: Setup Python ${{ matrix.python }}
-        uses: actions/setup-python@v4
+      - uses: actions/checkout@v4
+      - name: Setup Python
+        uses: actions/setup-python@v5
         with:
-          python-version: ${{ matrix.python }}
+          python-version: "3.12"
       - name: Install Dependencies and Package Project
         id: installing
         run: |
           python -m pip install --upgrade pip setuptools wheel
           python3 setup.py sdist bdist_wheel
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         with:
-          name: dist-py${{ matrix.python }}
+          name: dist-python
           path: dist
 
   delivery-github:
     name: Delivery to GitHub
     needs: [delivery-nodejs, delivery-python]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Download NPM Artifacts
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: package-npm
-      - name: Download Python 3.8 Artifacts
-        uses: actions/download-artifact@v3
+      - name: Download Python Artifacts
+        uses: actions/download-artifact@v4
         with:
-          name: dist-py3.8
+          name: dist-python
           path: dist/
       - name: List Artifacts
         run: |
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -1,4 +1,3 @@
----
 # Continous Integration
 name: ci
 
@@ -8,17 +7,33 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
+    - uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
     - uses: actions/setup-python@v5
       with:
         python-version: 3.9
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 20
+        cache: 'npm'
+    - name: Install Dependencies
+      run: |
+        pip install --upgrade pip setuptools
+        pip install pre-commit
+        npm ci --include=optional
+        npm run build
+    - name: Run Linting
+      run: |
+        pre-commit run --all-files --verbose
   os_build:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
         os:
          - ubuntu-latest
-         - macos-12 # Later versions of ARM-based macOS runners fail because the hypervisor framework required for Docker is not supported
-        python: [ "3.8", "3.9", "3.10", "3.11"]
+         - macos-13
+        python: [ "3.10", "3.11", "3.12"]
         node: [ 20 ]
     env:
       SAM_CLI_TELEMETRY: "0"
@@ -30,14 +45,14 @@ jobs:
       PIP_LOG_FILE: /tmp/pip.log
       HOMEBREW_NO_AUTO_UPDATE: 1
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Update Homebrew and save docker version
         if: runner.os == 'macOS'
         run: |
           brew tap homebrew/core
           cat "$(brew --repository)/Library/Taps/homebrew/homebrew-core/Formula/d/docker.rb" > .github/brew-formulae
       - name: Configure Homebrew docker cache files
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         if: runner.os == 'macOS'
         with:
           path: |
@@ -51,18 +66,12 @@ jobs:
         run: |
           brew install docker --cask
           brew install colima
-          # Docker engine is no longer available because of licensing
-          # Alternative Colima is part of the github macOS runner
-          # SAM v1.47.0+ needed for colima support, unable to use Python 3.6
           colima start
-          # Ensure colima is configured for later user
           echo "DOCKER_HOST=unix://$HOME/.colima/default/docker.sock" >> $GITHUB_ENV
-          # Verify Docker
           docker ps
           docker --version
-          # Verify colima
           colima status
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python }}
           cache: 'pip'
@@ -73,18 +82,17 @@ jobs:
           pip install --upgrade pip
           pip install --upgrade setuptools wheel aws-sam-cli -r https://raw.githubusercontent.com/aws-cloudformation/cloudformation-cli/master/requirements.txt
           pip install .
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node }}
           cache: 'npm'
       - name: Install Dependencies Node.js
         id: install_nodejs
-        # Touch needed because of https://github.com/aws/aws-cli/issues/2639
         run: |
           npm ci --include=optional
           find ./node_modules/* -mtime +10950 -exec touch {} \;
           npm run build
-      - uses: actions/cache@v3
+      - uses: actions/cache@v4
         with:
           path: ~/.cache/pre-commit/
           key: ${{ matrix.os }}-${{ env.pythonLocation }}${{ hashFiles('.pre-commit-config.yaml') }}
@@ -100,9 +108,9 @@ jobs:
           bash codecov.sh -f coverage/ts/coverage-final.json -F unittests -n codecov-typescript
       - name: Upload Coverage Artifacts
         id: upload_coverage
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
-          name: coverage
+          name: coverage-${{ matrix.os }}-py${{ matrix.python }}
           path: coverage/
       - name: Run Integration Tests
         id: integration_testing
@@ -140,7 +148,7 @@ jobs:
       - name: Upload Debug Artifacts
         id: upload_logs
         if: failure()
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
-          name: debug-logs
+          name: debug-logs-${{ matrix.os }}-py${{ matrix.python }}
           path: ${{ env.LOG_PATH }}
diff --git a/.gitignore b/.gitignore
@@ -141,3 +141,5 @@ node_modules/
 coverage/
 
 *.iml
+# Kiro IDE
+.kiro/
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -27,7 +27,7 @@ repos:
       - id: check-merge-conflict
       # - id: check-yaml  # have jinja yml templates so skipping this
   - repo: https://github.com/pycqa/flake8
-    rev: "5.0.4"
+    rev: "7.1.2"
     hooks:
     - id: flake8
       additional_dependencies:
@@ -45,19 +45,18 @@ repos:
       - id: python-check-mock-methods
       - id: python-no-log-warn
   - repo: https://github.com/PyCQA/bandit
-    rev: 1.7.1
+    rev: 1.8.3
     hooks:
       - id: bandit
         files: "^python/"
-  - repo: https://github.com/pre-commit/mirrors-eslint
-    rev: v8.26.0
+  - repo: local
     hooks:
       - id: eslint
-        args: [--fix]
-        types: []
-        files: (.*.js$|.*.ts$)
-        additional_dependencies:
-          - eslint@8.21.0
+        name: eslint
+        description: Run eslint from local node_modules
+        entry: npx eslint --fix
+        language: system
+        files: \.(js|ts)$
   - repo: local
     hooks:
       - id: pylint-local
diff --git a/setup.py b/setup.py
@@ -36,7 +36,7 @@ def find_version(*file_paths):
     # package_data -> use MANIFEST.in instead
     include_package_data=True,
     zip_safe=True,
-    python_requires=">=3.8",
+    python_requires=">=3.10",
     install_requires=[
         "cloudformation-cli>=0.1.14",
         "zipfile38>=0.0.3,<0.2",
diff --git a/src/interface.ts b/src/interface.ts
@@ -95,33 +95,40 @@ interface IntegerConstructor {
 /**
  * Wrapper with additional JSON serialization for bigint type
  */
-export const Integer: IntegerConstructor = new Proxy(BigInt as unknown as IntegerConstructor, {
-    apply(
-        target: IntegerConstructor,
-        _thisArg: unknown,
-        argArray: unknown[]
-    ): integer {
-        target.prototype.toJSON = function (): number {
-            return Number(this.valueOf());
-        };
-        const isSafeInteger = (value: bigint): boolean => {
-            if (
-                value &&
-                (value < BigInt(Number.MIN_SAFE_INTEGER) ||
-                    value > BigInt(Number.MAX_SAFE_INTEGER))
-            ) {
-                return false;
+export const Integer: IntegerConstructor = new Proxy(
+    BigInt as unknown as IntegerConstructor,
+    {
+        apply(
+            target: IntegerConstructor,
+            _thisArg: unknown,
+            argArray: unknown[]
+        ): integer {
+            target.prototype.toJSON = function (): number {
+                return Number(this.valueOf());
+            };
+            const isSafeInteger = (value: bigint): boolean => {
+                if (
+                    value &&
+                    (value < BigInt(Number.MIN_SAFE_INTEGER) ||
+                        value > BigInt(Number.MAX_SAFE_INTEGER))
+                ) {
+                    return false;
+                }
+                return true;
+            };
+            target.isSafeInteger = isSafeInteger;
+            const value = target(
+                ...(argArray as [bigint | integer | boolean | number | string])
+            );
+            if (value && !isSafeInteger(value)) {
+                throw new RangeError(
+                    `Value is not a safe integer: ${value.toString()}`
+                );
             }
-            return true;
-        };
-        target.isSafeInteger = isSafeInteger;
-        const value = target(...(argArray as [bigint | integer | boolean | number | string]));
-        if (value && !isSafeInteger(value)) {
-            throw new RangeError(`Value is not a safe integer: ${value.toString()}`);
-        }
-        return value;
-    },
-}) as IntegerConstructor;
+            return value;
+        },
+    }
+) as IntegerConstructor;
 
 export enum Action {
     Create = 'CREATE',
