Validate ClickHouse env in greenlight Lambda

- Require CLICKHOUSE_USERNAME and CLICKHOUSE_HOST/ENDPOINT before the scan
- Fail fast in handler() instead of deep inside review.run()
- Gate greenlight-lambda-release.yml to run only on refs/heads/main
- Add tests for the missing-username and missing-host/endpoint cases

The handler already mints the App token and injects CLICKHOUSE_PASSWORD
from Secrets Manager, but the ClickHouse connection settings that come
from plain env vars were unchecked — a missing host or username surfaced
only as an opaque failure once the scan tried to query. Validating them
up front turns a misconfigured Lambda into a clear error at entry. The
release-workflow branch guard keeps feature branches from publishing a
release artifact.

Signed-off-by: Jean Schmidt <contato@jschmidt.me>

Author: jeanschmidt

.github/workflows/greenlight-lambda-release.yml

@@ -13,6 +13,7 @@ defaults:
 jobs:
   release:
     name: Build and publish greenlight lambda release
+    if: ${{ github.ref == 'refs/heads/main' }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

greenlight/src/greenlight/lambda_handler.py

@@ -46,6 +46,11 @@ def _require_key(mapping: dict[str, str], key: str, source: str) -> str:
     return mapping[key]
 
 
+def _require_clickhouse_host() -> None:
+    if not (os.environ.get("CLICKHOUSE_HOST") or os.environ.get("CLICKHOUSE_ENDPOINT")):
+        raise ValueError("CLICKHOUSE_HOST or CLICKHOUSE_ENDPOINT is required for the greenlight Lambda handler")
+
+
 def _load_secret(secret_store_name: str) -> dict[str, str]:
     import boto3  # lazy: keeps this module importable without the AWS SDK
 
@@ -74,6 +79,8 @@ def handler(event: dict[str, object], context: object) -> dict[str, str]:  # noq
     secret_store_name = _require_env("SECRET_STORE_NAME")
     app_id = _require_env("GITHUB_APP_ID")
     installation_id = int(_require_env("GITHUB_INSTALLATION_ID"))
+    _require_env("CLICKHOUSE_USERNAME")
+    _require_clickhouse_host()
 
     secret = _load_secret(secret_store_name)
     secret_source = f"secret {secret_store_name!r}"
@@ -86,6 +93,9 @@ def handler(event: dict[str, object], context: object) -> dict[str, str]:  # noq
     # SIGALRM soft timeout and the hard watchdog (whose os._exit would abort the runtime uncleanly).
     os.environ["PYTORCH_GREENLIGHT_MAX_RUNTIME_SECONDS"] = "0"
 
+    # No PYTORCH_GREENLIGHT_LOCK_PATH is set: Lambda's reserved_concurrent_executions = 1 already
+    # guarantees single-flight, so the in-process fcntl lock is intentionally absent and the
+    # EXIT_ALREADY_RUNNING branch below is only defensive/forward-compat.
     rc = cli.main(["review", "--ref", "main"])
     if rc == EXIT_OK:
         return {"status": "ok"}

greenlight/tests/test_lambda_handler.py

@@ -13,6 +13,8 @@
 _PEM = "-----BEGIN RSA PRIVATE KEY-----\nline-one\nline-two\n-----END RSA PRIVATE KEY-----\n"
 _PEM_B64 = base64.b64encode(_PEM.encode("utf-8")).decode("ascii")
 _CH_PASSWORD = "clickhouse-secret-pw"
+_CH_USERNAME = "greenlight-ro"
+_CH_HOST = "greenlight.clickhouse.cloud"
 _TOKEN = "ghs_minted_installation_token"
 _SECRET_STORE = "greenlight/prod"
 _APP_ID = "123456"
@@ -41,6 +43,9 @@ def fakes(monkeypatch):
     monkeypatch.setenv("SECRET_STORE_NAME", _SECRET_STORE)
     monkeypatch.setenv("GITHUB_APP_ID", _APP_ID)
     monkeypatch.setenv("GITHUB_INSTALLATION_ID", str(_INSTALLATION_ID))
+    monkeypatch.setenv("CLICKHOUSE_USERNAME", _CH_USERNAME)
+    monkeypatch.setenv("CLICKHOUSE_HOST", _CH_HOST)
+    monkeypatch.delenv("CLICKHOUSE_ENDPOINT", raising=False)
 
     secret_json = json.dumps({"GITHUB_APP_SECRET": _PEM_B64, "CLICKHOUSE_PASSWORD": _CH_PASSWORD})
     fake_boto3 = MagicMock()
@@ -125,6 +130,33 @@ def test_handler_missing_env_raises(monkeypatch, fakes, missing):
     main_mock.assert_not_called()
 
 
+def test_handler_missing_clickhouse_username_raises(monkeypatch, fakes):
+    _fake_boto3, fake_github = fakes
+    monkeypatch.delenv("CLICKHOUSE_USERNAME", raising=False)
+    main_mock = Mock()
+    monkeypatch.setattr(cli, "main", main_mock)
+
+    with pytest.raises(ValueError, match="CLICKHOUSE_USERNAME"):
+        lambda_handler.handler({}, object())
+
+    fake_github.GithubIntegration.assert_not_called()
+    main_mock.assert_not_called()
+
+
+def test_handler_missing_clickhouse_host_and_endpoint_raises(monkeypatch, fakes):
+    _fake_boto3, fake_github = fakes
+    monkeypatch.delenv("CLICKHOUSE_HOST", raising=False)
+    monkeypatch.delenv("CLICKHOUSE_ENDPOINT", raising=False)
+    main_mock = Mock()
+    monkeypatch.setattr(cli, "main", main_mock)
+
+    with pytest.raises(ValueError, match="CLICKHOUSE_HOST or CLICKHOUSE_ENDPOINT"):
+        lambda_handler.handler({}, object())
+
+    fake_github.GithubIntegration.assert_not_called()
+    main_mock.assert_not_called()
+
+
 def test_handler_non_numeric_installation_id_raises(monkeypatch, fakes):
     monkeypatch.setenv("GITHUB_INSTALLATION_ID", "not-a-number")
     main_mock = Mock()