Deploy greenlight scan as AWS Lambda; move to py3.13

- Add lambda_handler.py: loads secrets from Secrets Manager, mints a
  least-privilege App token, and runs one review scan via cli.main
- Add greenlight-lambda-release.yml and `just package` to build/publish
  the dist/greenlight-scan.zip (linux x86_64 / cp313 wheels)
- Downgrade Python 3.14 -> 3.13 across mise, pyproject, workflows,
  uv.lock, and docs
- Fix guards.py except tuple syntax (parenthesized) now that py3.14's
  PEP 758 bare-tuple form is no longer valid on 3.13
- Repoint greenlight-review.yml to the manual / recheck entry point and
  document the Lambda deployment flow (CLAUDE.md, README, CHEATSHEET)

The periodic pytorch/pytorch PR scan now runs as the greenlight-scan
Lambda (pytorch-gha-infra-2, us-east-1, EventBridge rate(5 minutes))
instead of a scheduled GHA workflow. The handler sets
PYTORCH_GREENLIGHT_MAX_RUNTIME_SECONDS=0 to disable the single-instance
lock and both hang guards (the watchdog's os._exit is wrong under
Lambda), relying on reserved_concurrent_executions=1 and the Lambda
function timeout instead. The 3.13 move dodges a fleet-wide AWS provider
6.x bump that rejects 3.14; scan logic is unchanged.

Signed-off-by: Jean Schmidt <contato@jschmidt.me>

Author: jeanschmidt

.github/workflows/greenlight-lambda-release.yml

@@ -0,0 +1,56 @@
+name: greenlight-lambda-release
+
+on:
+  workflow_dispatch: {}
+
+permissions:
+  contents: write
+
+defaults:
+  run:
+    working-directory: greenlight
+
+jobs:
+  release:
+    name: Build and publish greenlight lambda release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
+        with:
+          working_directory: greenlight
+      - name: Sync dependencies
+        run: just setup
+      - name: Package lambda zip
+        run: just package
+      - name: Smoke-test the built zip imports on Python 3.13
+        # -S drops site-packages so imports resolve only from the extracted zip, not the
+        # project .venv that mise puts on sys.path; the test exercises the artifact itself.
+        run: |
+          set -euo pipefail
+          smoke_dir="$(mktemp -d)"
+          unzip -q dist/greenlight-scan.zip -d "${smoke_dir}"
+          PYTHONPATH="${smoke_dir}" mise exec -- python -S -c \
+            "import greenlight.lambda_handler, greenlight.cli, boto3, github, clickhouse_connect, yaml"
+      - name: Compute release tag
+        id: tag
+        run: |
+          echo "tag=greenlight-lambda-v$(date -u +'%Y%m%d-%H%M%S')" >> "${GITHUB_OUTPUT}"
+      - name: Publish GitHub Release
+        uses: ncipollo/release-action@440c8c1cb0ed28b9f43e4d1d670870f059653174 # v1.16.0
+        with:
+          artifacts: greenlight/dist/greenlight-scan.zip
+          tag: ${{ steps.tag.outputs.tag }}
+          name: ${{ steps.tag.outputs.tag }}
+      - name: Report release tag
+        env:
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: |
+          echo "Published greenlight lambda release: ${TAG}"
+          {
+            echo "## Greenlight lambda release published"
+            echo ""
+            echo "Release tag: \`${TAG}\`"
+            echo ""
+            echo "Copy this tag into the pytorch-gha-infra-2 Terrafile to deploy."
+          } >> "${GITHUB_STEP_SUMMARY}"

.github/workflows/greenlight-pr-review.yml

@@ -57,10 +57,10 @@ jobs:
         with:
           fetch-depth: 1
 
-      - name: Set up Python 3.14
+      - name: Set up Python 3.13
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
         with:
-          python-version: "3.14"
+          python-version: "3.13"
 
       - name: Install uv
         uses: ./.github/actions/setup-uv
@@ -357,12 +357,12 @@ jobs:
         with:
           fetch-depth: 1
 
-      - name: Set up Python 3.14
-        # greenlight pins requires-python >=3.14 with uv python-preference=only-system,
-        # so uv will not download an interpreter; CI must supply a system 3.14.
+      - name: Set up Python 3.13
+        # greenlight pins requires-python >=3.13 with uv python-preference=only-system,
+        # so uv will not download an interpreter; CI must supply a system 3.13.
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
         with:
-          python-version: "3.14"
+          python-version: "3.13"
 
       - name: Install uv
         uses: ./.github/actions/setup-uv

.github/workflows/greenlight-review.yml

@@ -1,8 +1,11 @@
 name: Green Light Scan
 
-# Manually runs the greenlight scanner (`greenlight review`): lists open pytorch/pytorch PRs
-# from trusted authors and dispatches greenlight-pr-review.yml for each new or changed
-# PR. Read-only on ClickHouse; dispatches the reviewer workflow via the App token.
+# The periodic pytorch/pytorch PR scan runs as the `greenlight-scan` AWS Lambda
+# (pytorch-gha-infra-2, us-east-1, EventBridge rate(5 minutes)). This workflow is now the manual /
+# `@greenlight recheck` entry point: dispatched by filename from a pytorch/pytorch trigger (or run
+# by hand), it runs the same greenlight scanner (`greenlight review`) — lists open pytorch/pytorch
+# PRs from trusted authors and dispatches greenlight-pr-review.yml for each new or changed PR.
+# Read-only on ClickHouse; dispatches the reviewer workflow via the App token.
 
 on:
   workflow_dispatch:

greenlight/CHEATSHEET.md

@@ -5,7 +5,9 @@ directory. `just` is the front-end for every workflow — run `just` or
 `just --list` to see all recipes.
 
 PyTorch Green Light runs one iteration of its `review` phase and exits (cron-like), or
-loops as a daemon with `--loop`. It also has a one-shot `verdict` subcommand:
+loops as a daemon with `--loop`; in production the scheduled scan runs as the `greenlight-scan`
+AWS Lambda (EventBridge `rate(5 minutes)`), with the CLI modes kept for local use. It also has a
+one-shot `verdict` subcommand:
 
 - `review` — scan the open PRs from a fixed set of trusted authors in `pytorch/pytorch`;
   for each, compute its fingerprint (`eval_hash`), read its latest state from
@@ -32,11 +34,11 @@ everything else.
 
 ```bash
 mise trust     # trust greenlight/mise.toml (first use only)
-mise install   # install python 3.14, uv, just, and the non-Python linters
+mise install   # install python 3.13, uv, just, and the non-Python linters
 just setup     # uv sync -> create .venv with the Python deps
 ```
 
-`mise install` provides python 3.14, uv, just, node, shellcheck, shfmt, taplo,
+`mise install` provides python 3.13, uv, just, node, shellcheck, shfmt, taplo,
 and markdownlint-cli2. `just setup` then installs the Python tools (ruff, mypy,
 pytest, yamllint) into `.venv`.
 
@@ -111,6 +113,19 @@ and `--lock-path` override the matching env vars, and `review` adds the scan fla
 Raise verbosity with `--log-level DEBUG` (or `PYTORCH_GREENLIGHT_LOG_LEVEL=DEBUG`); DEBUG also
 logs the resolved `Config`.
 
+## Package and deploy
+
+```bash
+just package   # build dist/greenlight-scan.zip (linux x86_64 / cp313 wheels) for the Lambda
+```
+
+In production the scheduled scan runs as the `greenlight-scan` AWS Lambda
+(`pytorch-gha-infra-2`, `us-east-1`, EventBridge `rate(5 minutes)`), not via the CLI or a GHA
+workflow. Ship a new build with `just package` -> run the `greenlight-lambda-release.yml`
+workflow (publishes a `greenlight-lambda-v<timestamp>` Release with the zip) -> pin that tag in
+the `pytorch-gha-infra-2` `runners/common/Terrafile` -> `terraform apply` in
+`runners/regions/us-east-1`.
+
 ## Simulate a run
 
 The end-to-end flow, per trusted-author PR:

greenlight/CLAUDE.md

@@ -4,7 +4,7 @@ This file is the canonical project guidance for any coding agent operating in `g
 
 ## What This Is
 
-PyTorch Green Light is a Python 3.14 service invoked from the CLI. Its `review` phase
+PyTorch Green Light is a Python 3.13 service invoked from the CLI. Its `review` phase
 runs a single iteration and exits (cron-like), e.g. `just run review`. It can also run
 as a long-lived daemon with `--loop`, e.g. `just run review --loop`, which repeats the
 phase on an interval. The phase runs through the same one-shot and daemon execution
@@ -13,7 +13,7 @@ change to phase logic.
 
 ## Tooling
 
-- **mise** provisions every tool (python 3.14, uv, just, shellcheck, shfmt,
+- **mise** provisions every tool (python 3.13, uv, just, shellcheck, shfmt,
   taplo, markdownlint-cli2, node). `mise install` bootstraps everything.
 - **uv** owns the Python venv and dependencies, and runs the Python tools (ruff,
   mypy, pytest, yamllint).
@@ -89,6 +89,11 @@ interrupt blocking C calls (e.g. DNS) or off-main-thread work; and a hard watchd
 force-exits the process a grace period later, the real backstop for hangs the soft timeout
 cannot reach.
 
+In production the scheduled scan instead deploys as the `greenlight-scan` AWS Lambda: it runs
+the one-shot path with no single-instance lock and both hang-guard layers off
+(`PYTORCH_GREENLIGHT_MAX_RUNTIME_SECONDS=0`; the watchdog's `os._exit` is wrong under Lambda),
+relying on `reserved_concurrent_executions=1` and the Lambda function timeout instead.
+
 ## Comments
 
 Default is NO comment. Add one only for a genuinely non-obvious, durable WHY. No

greenlight/README.md

@@ -1,20 +1,22 @@
 # PyTorch Green Light
 
 A Python service that runs a periodic iteration from the CLI — a one-shot
-(cron-like) run by default, or a long-lived daemon with `--loop`.
+(cron-like) run by default, or a long-lived daemon with `--loop`. In production the
+scheduled scan runs as an AWS Lambda (`greenlight-scan`) on a 5-minute EventBridge
+schedule; the CLI one-shot and `--loop` daemon modes remain for local and other use.
 
 ## Requirements
 
 - **mise** — the only manual prerequisite. See <https://mise.jdx.dev>.
 
-Everything else (Python 3.14, uv, just, and the non-Python linters) is provided
+Everything else (Python 3.13, uv, just, and the non-Python linters) is provided
 by mise; `just setup` then installs the Python tools (ruff, mypy, pytest, yamllint).
 
 ## Setup
 
 ```bash
 mise trust      # trust greenlight/mise.toml on first use
-mise install    # install python 3.14, uv, just, and all tools
+mise install    # install python 3.13, uv, just, and all tools
 just setup      # uv sync -> create .venv with deps
 ```
 
@@ -147,6 +149,29 @@ iteration in both one-shot and `--loop` mode. In `--loop` mode, SIGTERM/SIGINT a
 observed only between iterations, so the per-iteration timeout is what interrupts a
 hung run.
 
+## Deployment
+
+In production the scheduled scan runs as an AWS Lambda, `greenlight-scan`, in the
+`pytorch-gha-infra-2` account (`us-east-1`), triggered by an EventBridge `rate(5 minutes)`
+schedule. The function runs `python3.13` with handler `greenlight.lambda_handler.handler`, a
+300 s timeout, and `reserved_concurrent_executions = 1`. It runs the same one-shot
+`execute_once` / `review.run` path as `greenlight review` — no scan-logic change — after minting a
+least-privilege GitHub App installation token in-process and reading the App PEM and ClickHouse
+password from AWS Secrets Manager (`pytorch-greenlight-secrets`) at runtime. The handler sets
+`PYTORCH_GREENLIGHT_MAX_RUNTIME_SECONDS=0`, so it runs with no single-instance lock and both
+hang-guard layers off (the SIGALRM soft timeout and the `os._exit` hard watchdog, which is wrong
+under the Lambda runtime); single-instance and hang-bounding come from
+`reserved_concurrent_executions = 1` and the Lambda function timeout instead.
+
+Shipping a new version is a manual four-step flow:
+
+1. `just package` builds `dist/greenlight-scan.zip` (linux x86_64 / cp313 wheels).
+2. The `greenlight-lambda-release.yml` workflow (test-infra, manual `workflow_dispatch`) builds
+   the zip and publishes a `greenlight-lambda-v<timestamp>` GitHub Release with it.
+3. An operator pins that release tag in `pytorch-gha-infra-2`'s `runners/common/Terrafile` (the
+   `greenlight-scan` entry).
+4. `terraform apply` in `runners/regions/us-east-1` rolls it out.
+
 ## Reviewer checkout sanitizing
 
 The reviewer workflow (`greenlight-pr-review.yml`) checks the PR's `pytorch/pytorch` tree
@@ -266,6 +291,7 @@ src/greenlight/
   __init__.py      # package exports (Config, __version__)
   __main__.py      # `python -m greenlight` entry point
   cli.py           # CLI parsing (review + verdict subcommands), dispatch, exit codes
+  lambda_handler.py # AWS Lambda entry point: load secrets, mint App token, run one review scan via cli.main
   runner.py        # run_forever(): resilient daemon loop; execute_once(): one-shot phase run
   review.py        # scan trusted-author PRs: fingerprint, read state, dispatch reviewer workflow for new/changed; raises on failure
   state.py         # read a PR's latest recorded state from misc.greenlight_pr_state

greenlight/justfile

@@ -54,7 +54,7 @@ lint:
     _run "taplo check" taplo check
     _run "shellcheck" shellcheck --rcfile .shellcheckrc scripts/*.sh ../.claude/hooks/greenlight/*.sh
     _run "shfmt" shfmt -d -i 2 -ci scripts
-    _run "markdownlint" markdownlint-cli2 "**/*.md" "#.venv"
+    _run "markdownlint" markdownlint-cli2 "**/*.md" "#.venv" "#build" "#dist"
 
     echo ""
     if [[ ${#FAILED[@]} -gt 0 ]]; then
@@ -73,7 +73,39 @@ lint-fix:
     ruff format .
     shfmt -w -i 2 -ci scripts
     taplo fmt
-    markdownlint-cli2 --fix "**/*.md" "#.venv" || true
+    markdownlint-cli2 --fix "**/*.md" "#.venv" "#build" "#dist" || true
+
+# Build the AWS Lambda deployment zip (dist/greenlight-scan.zip) with linux x86_64 / cp313 wheels
+package:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    source scripts/mise-activate.sh
+
+    repo="$(pwd)"
+    build_dir="${repo}/build/lambda"
+    reqs="${repo}/build/requirements-lambda.txt"
+    zip_path="${repo}/dist/greenlight-scan.zip"
+
+    rm -rf "${build_dir}" "${zip_path}"
+    mkdir -p "${build_dir}" "${repo}/dist"
+
+    uv export --no-dev --no-emit-project --no-hashes --frozen --format requirements.txt -o "${reqs}"
+
+    uv run --with pip -- python -m pip install \
+        -r "${reqs}" \
+        -t "${build_dir}" \
+        --platform manylinux2014_x86_64 \
+        --platform manylinux_2_28_x86_64 \
+        --only-binary=:all: \
+        --python-version 3.13 \
+        --implementation cp
+
+    cp -a "${repo}/src/greenlight" "${build_dir}/greenlight"
+    find "${build_dir}" -name __pycache__ -type d -prune -exec rm -rf {} +
+
+    (cd "${build_dir}" && zip -q -r "${zip_path}" .)
+
+    echo "Built ${zip_path} ($(du -h "${zip_path}" | cut -f1))"
 
 # Remove caches, build artifacts, and the venv
 clean:

greenlight/mise.toml

@@ -1,5 +1,5 @@
 [tools]
-python = "3.14"
+python = "3.13"
 uv = "latest"
 "aqua:casey/just" = "latest"
 "aqua:koalaman/shellcheck" = "latest"

greenlight/pyproject.toml

@@ -2,7 +2,7 @@
 name = "greenlight"
 version = "0.0.0"
 description = "CLI-invoked periodic iteration service, daemon-capable."
-requires-python = ">=3.14,<3.15"
+requires-python = ">=3.13,<3.14"
 dependencies = ["pygithub>=2.6.1", "clickhouse-connect>=0.10", "pyyaml>=6", "boto3>=1.34"]
 
 [project.scripts]
@@ -23,7 +23,7 @@ python-preference = "only-system"
 
 [tool.ruff]
 line-length = 120
-target-version = "py314"
+target-version = "py313"
 src = ["src", "tests"]
 
 [tool.ruff.lint]
@@ -82,7 +82,7 @@ exclude_lines = [
 ]
 
 [tool.mypy]
-python_version = "3.14"
+python_version = "3.13"
 files = ["src", "tests"]
 mypy_path = "src"
 explicit_package_bases = true

greenlight/src/greenlight/guards.py

@@ -77,7 +77,7 @@ def _on_alarm(*_args: object) -> None:
         try:
             signal.setitimer(signal.ITIMER_REAL, seconds)
             armed = True
-        except OverflowError, signal.ItimerError:
+        except (OverflowError, signal.ItimerError):
             logger.warning("cannot arm iteration timeout for %s seconds; running without it", seconds)
         yield
     finally: