[ToreMerkely]

What changed

Adds build-lambda.yml and deploy-lambda.yml, the golden pipeline for Lambda zip packages: the repository that holds a function's source builds, attests and deploys it. Adds the #7913 handover.

Part of kosli-dev/server#7913

Why

apply.yml attests each Lambda's fingerprint to the Terraform apply's trail, whose pull request reviewed the Terraform and not necessarily the code. Building in the source repository puts the package on a trail with the PR, tests and dependencies that produced it, so the SDLC controls can be decided for it.

build-lambda.yml (inputs package_name, source_path, python_version, bundle_kosli_cli, bundled_kosli_cli_version, controls):

• installs uv.lock or requirements.txt as manylinux wheels for the runtime's Python, with no Docker, and runs pytest when there are test_*.py files;
• zips with fixed timestamps and sorted entries, so a re-run of the same commit produces the same fingerprint;
• uploads to lambda-packages-<hash> under <repo>/<package>/<sha>.zip as lambda-package-publisher (terraform-base-infra#1247), refusing to overwrite, and accepting an existing key whose checksum matches;
• attests the artifact, PR, junit, lockfile, SBOM (syft), SBOM components and runtime to flow <repo>-<package>, trail = commit;
• calls evaluate-policy.yml with variants: {"SDLC-CTRL-0004": "zip"} (kosli-dev/sdlc-policies#59, #60), passing SDLC-CTRL-0008's params only when it is evaluated.

deploy-lambda.yml (inputs s3_key, fingerprint, function_name, environments, github_environment, role_name): fetches the accounts from terraform-deploy-matrix, waits for one approval job when github_environment is set, then per account downloads the package, checks its SHA-256 and runs update-function-code --publish. Deploys pass the zip's bytes, so Lambda never reads the bucket.

Verification

• actionlint 1.7.7 on both workflows; make test passes (102 tests).
• The build's install, copy and zip steps, run twice locally on kosli-queue-sampler, produced byte-identical zips containing main.py and redis.
• The params filter, run locally, leaves out SDLC-CTRL-0008 when it is not in controls.
• Nothing has run in GitHub Actions yet: the first caller is the pilot.

Follow-ups

Recorded in the handover's Next Steps:

• The pilot, kosli-queue-sampler in terraform-server: boto3 declared, a deploy role per account, ignore_changes on the function's code, and a check of the version-qualified EventBridge permission.
• lambda-package-publisher's trust on job_workflow_ref is verified only by the first build run.
• README documentation of the two workflows.

🤖 Generated with Claude Code