Align with spec-python-projects

.github/workflows/ci.yml

@@ -1,7 +1,11 @@
 name: CI
-on: push
+permissions: read-all
+on:
+  pull_request:
+    paths-ignore:
+      - '.github/**'
 jobs:
   test:
-    uses: mitlibraries/.github/.github/workflows/python-shared-test.yml@main
+    uses: mitlibraries/.github/.github/workflows/python-uv-shared-test.yml@main
   lint:
-    uses: mitlibraries/.github/.github/workflows/python-shared-lint.yml@main
+    uses: mitlibraries/.github/.github/workflows/python-uv-shared-lint.yml@main

.github/workflows/dev-build.yml

@@ -3,10 +3,6 @@
 ### uncomment the FUNCTION line at the end of the document.                 ###
 name: Dev Container Build and Deploy
 
-# checkov:skip=CKV2_GHA_1:The shared workflow contains the permissions constraints
-# NOTE: The above checkov skip command doesn't actually work and this workflow
-#       will always show a checkov warning.
-
 on:
   workflow_dispatch:
   pull_request:
@@ -15,10 +11,14 @@ on:
     paths-ignore:
       - '.github/**'
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   deploy-east:
     name: Dev Container Deploy (US East 1)
-    uses: mitlibraries/.github/.github/workflows/ecr-shared-deploy-dev.yml@INFRA-526
+    uses: mitlibraries/.github/.github/workflows/ecr-multi-arch-deploy-dev.yml@main
     secrets: inherit
     with:
       AWS_REGION: "us-east-1"
@@ -27,10 +27,10 @@ jobs:
       FUNCTION: "s3-bagit-validator-dev"
   deploy-west:
     name: Dev Container Deploy (US West 2)
-    uses: mitlibraries/.github/.github/workflows/ecr-shared-deploy-dev.yml@INFRA-526
+    uses: mitlibraries/.github/.github/workflows/ecr-multi-arch-deploy-dev.yml@main
     secrets: inherit
     with:
-        AWS_REGION: "us-west-2"
-        GHA_ROLE: "s3-bagit-validator-gha-dev"
-        ECR: "s3-bagit-validator-dev"
-        FUNCTION: "s3-bagit-validator-dev"
+      AWS_REGION: "us-west-2"
+      GHA_ROLE: "s3-bagit-validator-gha-dev"
+      ECR: "s3-bagit-validator-dev"
+      FUNCTION: "s3-bagit-validator-dev"

.github/workflows/prod-promote.yml

@@ -3,19 +3,19 @@
 ### uncomment the FUNCTION line at the end of the document.                ###
 name: Prod Container Promote
 
-# checkov:skip=CKV2_GHA_1:The shared workflow contains the permissions constraints
-# NOTE: The above checkov skip command doesn't actually work and this workflow
-#       will always show a checkov warning.
-
 on:
   workflow_dispatch:
   release:
     types: [published]
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   deploy-us-east-1:
     name: Prod Container Promote
-    uses: mitlibraries/.github/.github/workflows/ecr-shared-promote-prod.yml@main
+    uses: mitlibraries/.github/.github/workflows/ecr-multi-arch-promote-prod.yml@main
     secrets: inherit
     with:
       AWS_REGION: "us-east-1"
@@ -26,7 +26,7 @@ jobs:
       FUNCTION: "s3-bagit-validator-prod"
   deploy-us-west-2:
     name: Prod Container Promote us-west-2
-    uses: mitlibraries/.github/.github/workflows/ecr-shared-promote-prod.yml@main
+    uses: mitlibraries/.github/.github/workflows/ecr-multi-arch-promote-prod.yml@main
     secrets: inherit
     with:
       AWS_REGION: "us-west-2"
@@ -35,4 +35,3 @@ jobs:
       ECR_STAGE: "s3-bagit-validator-stage"
       ECR_PROD: "s3-bagit-validator-prod"
       FUNCTION: "s3-bagit-validator-prod"
-

.github/workflows/stage-build.yml

@@ -5,10 +5,6 @@
 ### the PREBUILD line at the end of the document.                          ###
 name: Stage Container Build and Deploy
 
-# checkov:skip=CKV2_GHA_1:The shared workflow contains the permissions constraints
-# NOTE: The above checkov skip command doesn't actually work and this workflow
-#       will always show a checkov warning.
-
 on:
   workflow_dispatch:
   push:
@@ -17,25 +13,30 @@ on:
     paths-ignore:
       - '.github/**'
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   deploy-us-east-1:
     name: Stage Container Deploy
-    uses: mitlibraries/.github/.github/workflows/ecr-shared-deploy-stage.yml@main
+    uses: mitlibraries/.github/.github/workflows/ecr-multi-arch-deploy-stage.yml@main
     secrets: inherit
     with:
       AWS_REGION: "us-east-1"
       GHA_ROLE: "s3-bagit-validator-gha-stage"
       ECR: "s3-bagit-validator-stage"
       FUNCTION: "s3-bagit-validator-stage"
-      # PREBUILD: 
+      # PREBUILD:
 
   deploy-us-west-2:
     name: Stage Container Deploy us-west-2
-    uses: mitlibraries/.github/.github/workflows/ecr-shared-deploy-stage.yml@main
+    uses: mitlibraries/.github/.github/workflows/ecr-multi-arch-deploy-stage.yml@main
     secrets: inherit
     with:
       AWS_REGION: "us-west-2"
       GHA_ROLE: "s3-bagit-validator-gha-stage"
       ECR: "s3-bagit-validator-stage"
       FUNCTION: "s3-bagit-validator-stage"
-      # PREBUILD: 
+      # PREBUILD:
+

.gitignore

@@ -143,4 +143,8 @@ output/
 # SAM
 # https://docs.aws.amazon.com/serverless-application-model/
 tests/sam/env.json
-.aws-sam/
+.aws-sam/
+
+# Architecture-aware build artifacts
+.arch_tag
+.tool-versions

.pre-commit-config.yaml

@@ -1,29 +1,30 @@
 default_language_version:
-  python: python3.12 # set for project python version
+  python: python3.13
+
+default_stages:
+  - pre-push
+
 repos:
   - repo: local
     hooks:
-      - id: black-apply
-        name: black-apply
-        entry: pipenv run black
+      - id: ruff-format
+        name: ruff-format
+        entry: uv run ruff format --diff
         language: system
         pass_filenames: true
         types: ["python"]
+
       - id: mypy
         name: mypy
-        entry: pipenv run mypy
+        entry: uv run mypy
         language: system
         pass_filenames: true
         types: ["python"]
-        exclude: "tests/"
-      - id: ruff-apply
-        name: ruff-apply
-        entry: pipenv run ruff check --fix
+        exclude: "(tests/|output/|migrations/)"
+
+      - id: ruff-check
+        name: ruff-check
+        entry: uv run ruff check
         language: system
         pass_filenames: true
         types: ["python"]
-      - id: pip-audit
-        name: pip-audit
-        entry: pipenv run pip-audit
-        language: system
-        pass_filenames: false

.python-version

@@ -1 +1 @@
-3.12
+3.13

Dockerfile

@@ -1,15 +1,17 @@
-FROM public.ecr.aws/lambda/python:3.12
+FROM public.ecr.aws/lambda/python:3.13
 
-# Copy function code
-COPY . ${LAMBDA_TASK_ROOT}/
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
+
+COPY pyproject.toml uv.lock* ./
 
-# Install dependencies
-RUN pip3 install pipenv
-RUN pipenv requirements > requirements.txt
-RUN pip3 install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
+RUN cd ${LAMBDA_TASK_ROOT} && \
+    uv export --format requirements-txt --no-hashes --no-dev > requirements.txt && \
+    uv pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}" --system
+
+COPY . ${LAMBDA_TASK_ROOT}/
 
 # Set environment variables required by DuckDB
 ENV HOME=/tmp
 ENV TZ=UTC
 
-CMD [ "lambdas.validator.lambda_handler" ]
+CMD ["lambdas.validator.lambda_handler"]