refactor: optionally create acme account, tests, expiration from cert

.github/labeler.yml

@@ -4,8 +4,7 @@ Workflows:
 
 Documentation:
 - changed-files:
-  - any-glob-to-any-file: images/**
-  - any-glob-to-any-file: '**/*.md'
+  - any-glob-to-any-file: ['images/**', '**/*.md']
 
 Terraform:
 - changed-files:
@@ -21,4 +20,4 @@ Pytest:
 
 Python:
 - changed-files:
-  - - any-glob-to-any-file: '**/*.py'
+  - any-glob-to-any-file: '**/*.py'

.github/workflows/main.yml

@@ -17,7 +17,7 @@ on:
 env:
   PYTHON_VERSION: '3.11'
   PYTHON_DIR: 'lambda'
-  RUFF_VERSION: '0.14.8'
+  RUFF_VERSION: '0.14.9'
   TF_VERSION: '1.12.1'
   TF_LINT_VERSION: 'latest'
   TF_DOCS_VERSION: 'latest'
@@ -38,12 +38,11 @@ jobs:
           python-version: ${{ env.PYTHON_VERSION }}
           cache: 'pip'
 
-      - name: Install dependencies
+      - name: Install dependencies (requirements.txt)
+        working-directory: ${{ env.PYTHON_DIR }}
         run: |
           python -m pip install --upgrade pip
           pip install -r requirements.txt
-          pip install -r requirements-dev.txt
-        working-directory: ${{ env.PYTHON_DIR }}
 
       - name: Ruff check (linter)
         uses: astral-sh/ruff-action@v3
@@ -81,13 +80,12 @@ jobs:
           python-version: ${{ env.PYTHON_VERSION }}
           cache: 'pip'
 
-      - name: Install dependencies
+      # Test dependencies are declared in pyproject.toml
+      - name: Install dependencies (pyproject.toml)
         if: steps.check-tests.outputs.exists == 'true'
         run: |
           python -m pip install --upgrade pip
-          pip install -r requirements.txt
-          pip install -r requirements-dev.txt
-        working-directory: ${{ env.PYTHON_DIR }}
+          pip install -e ".[test]"
 
       - name: Run tests with pytest
         if: steps.check-tests.outputs.exists == 'true'

.github/workflows/pr-validation.yml

@@ -1,16 +1,20 @@
 name: PR Validation
 
 on:
-  pull_request_target:
+  pull_request:
     types:
       - opened
       - edited
       - reopened
+      - synchronize
 
 jobs:
   validate-pr:
     name: Validate Pull Request
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
 
     steps:
       - uses: actions/checkout@v6
@@ -22,18 +26,24 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Label PR
-        uses: actions/labeler@v4
-        with:
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
-
       - name: Check file sizes
         run: |
-          # Check for large files
-          find . -type f -size +1M -exec ls -lh {} \; | awk '{print $9 ": " $5}'
+          # Check for large files (excluding .git)
+          find . -path ./.git -prune -o -type f -size +1M -exec ls -lh {} \; | awk '{print $9 ": " $5}'
 
-          # Fail if files larger than 10MB
-          if find . -type f -size +10M | grep -q .; then
+          # Fail if files larger than 10MB (excluding .git)
+          if find . -path ./.git -prune -o -type f -size +10M -print | grep -q .; then
             echo "Error: Files larger than 10MB found"
             exit 1
           fi
+
+  labeler:
+    name: Label PR
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/labeler@v6

.gitignore

@@ -11,6 +11,11 @@ venv/
 .ruff_cache/
 python/
 
+# Pytest
+.coverage
+.pytest_cache/
+htmlcov/
+
 # Terraform
 .terraform/
 *.tfstate

.pre-commit-config.yaml

@@ -12,8 +12,9 @@ repos:
       args:
         - --allow-missing-credentials
     - id: detect-private-key
+      exclude: ^tests/
 - repo: https://github.com/astral-sh/ruff-pre-commit
-  rev: v0.14.8
+  rev: v0.14.9
   hooks:
     # Run the linter.
     - id: ruff-check