Fold greenlight lambda into the shared lambda release

**Impact:** CI/release tooling only — greenlight deployment flow and its docs
**Risk:** low

## What
Retires the standalone `greenlight-lambda-release.yml` workflow and moves the greenlight zip build into the shared lambda release (`_lambda-do-release-runners.yml`) as a new `build-greenlight-lambda` job, so `greenlight-scan.zip` is published alongside every other lambda under a single `v<timestamp>` tag. Also adds `greenlight/**` to the paths that trigger the release-tag workflow.

## Why
Greenlight had its own manual `workflow_dispatch` release cutting `greenlight-lambda-v<timestamp>` tags, separate from the shared lambda release. Consolidating means one tag, one Release carrying all lambda zips, and an automatic cut on any push to `main` that touches `greenlight/**` — no more remembering to run a dedicated workflow.

# Notes
- The greenlight leg keeps its own mise/uv/just (cp313) toolchain and smoke test rather than the `make deployment.zip` convention, so it's a dedicated job instead of a matrix entry.
- It runs `continue-on-error: true` (same rationale as the advisor-coverage leg): a broken greenlight build omits its zip from the Release instead of blocking the other lambdas. Operators should confirm `greenlight-scan.zip` is present before pinning a tag in the `pytorch-gha-infra-2` Terrafile.
- README and CHEATSHEET updated to describe the new flow.

Signed-off-by: Jean Schmidt <contato@jschmidt.me>

Author: jeanschmidt

.github/workflows/_lambda-do-release-runners.yml

@@ -131,11 +131,64 @@ jobs:
           if-no-files-found: error
           retention-days: 1
 
+  build-greenlight-lambda:
+    name: Build greenlight lambda
+    runs-on: ubuntu-latest
+    # greenlight builds on its own mise/uv/just toolchain (cp313) rather than the
+    # `make deployment.zip` convention, so it gets its own job. Non-blocking for the
+    # same reason as the advisor-coverage leg: a greenlight build failure must not
+    # block publishing the shared lambda release (pytorch-auto-revert et al.). A
+    # failed continue-on-error job reports success to `release`'s `needs`, and simply
+    # omits its zip.
+    continue-on-error: true
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ inputs.tag }}
+
+      - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
+        with:
+          working_directory: greenlight
+
+      - name: Sync dependencies
+        working-directory: greenlight
+        run: just setup
+
+      - name: Package lambda zip
+        working-directory: greenlight
+        run: just package
+
+      - name: Smoke-test the built zip imports on Python 3.13
+        # -S drops site-packages so imports resolve only from the extracted zip, not the
+        # project .venv that mise puts on sys.path; the test exercises the artifact itself.
+        working-directory: greenlight
+        run: |
+          set -euo pipefail
+          smoke_dir="$(mktemp -d)"
+          unzip -q dist/greenlight-scan.zip -d "${smoke_dir}"
+          PYTHONPATH="${smoke_dir}" mise exec -- python -S -c \
+            "import greenlight.lambda_handler, greenlight.cli, boto3, github, clickhouse_connect, yaml"
+
+      - name: Copy greenlight-scan.zip to root
+        run: cp greenlight/dist/greenlight-scan.zip greenlight-scan.zip
+
+      - name: Stage greenlight-scan zip
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: lambda-greenlight-scan
+          path: greenlight-scan.zip
+          if-no-files-found: error
+          retention-days: 1
+
   release:
     name: Publish release
     needs:
       - build-runner-lambdas
       - build-python-lambdas
+      - build-greenlight-lambda
     runs-on: ubuntu-latest
     permissions:
       contents: write

.github/workflows/greenlight-lambda-release.yml

@@ -8,6 +8,7 @@ on:
     paths:
       - 'terraform-aws-github-runner/**'
       - 'aws/lambda/**'
+      - 'greenlight/**'
   pull_request: # Generate tag when PR modifies this workflow file
     paths:
       - '.github/workflows/lambda-release-tag-runners.yml'

.github/workflows/lambda-release-tag-runners.yml

@@ -121,10 +121,10 @@ just package   # build dist/greenlight-scan.zip (linux x86_64 / cp313 wheels) fo
 
 In production the scheduled scan runs as the `greenlight-scan` AWS Lambda
 (`pytorch-gha-infra-2`, `us-east-1`, EventBridge `rate(5 minutes)`), not via the CLI or a GHA
-workflow. Ship a new build with `just package` -> run the `greenlight-lambda-release.yml`
-workflow (publishes a `greenlight-lambda-v<timestamp>` Release with the zip) -> pin that tag in
-the `pytorch-gha-infra-2` `runners/common/Terrafile` -> `terraform apply` in
-`runners/regions/us-east-1`.
+workflow. The zip ships in test-infra's shared lambda release: a push to `main` touching
+`greenlight/**` cuts a `v<timestamp>` tag whose Release carries `greenlight-scan.zip` alongside
+the other lambda zips -> pin that tag in the `pytorch-gha-infra-2` `runners/common/Terrafile`
+-> `terraform apply` in `runners/regions/us-east-1`.
 
 ## Simulate a run
 

greenlight/CHEATSHEET.md

@@ -164,15 +164,21 @@ hang-guard layers off (the SIGALRM soft timeout and the `os._exit` hard watchdog
 under the Lambda runtime); single-instance and hang-bounding come from
 `reserved_concurrent_executions = 1` and the Lambda function timeout instead.
 
-Shipping a new version is a manual four-step flow:
+The zip ships in test-infra's shared lambda release alongside every other lambda:
 
-1. `just package` builds `dist/greenlight-scan.zip` (linux x86_64 / cp313 wheels).
-2. The `greenlight-lambda-release.yml` workflow (test-infra, manual `workflow_dispatch`) builds
-   the zip and publishes a `greenlight-lambda-v<timestamp>` GitHub Release with it.
+1. `just package` builds `dist/greenlight-scan.zip` (linux x86_64 / cp313 wheels); the
+   `build-greenlight-lambda` job in `_lambda-do-release-runners.yml` runs the same recipe.
+2. Any push to `main` touching `greenlight/**` makes `lambda-release-tag-runners.yml` cut a
+   `v<timestamp>` tag, which publishes one GitHub Release carrying `greenlight-scan.zip` next to
+   the other lambda zips. `workflow_dispatch` on that workflow cuts a release on demand.
 3. An operator pins that release tag in `pytorch-gha-infra-2`'s `runners/common/Terrafile` (the
    `greenlight-scan` entry).
 4. `terraform apply` in `runners/regions/us-east-1` rolls it out.
 
+The greenlight build leg is `continue-on-error`, so a broken package step omits
+`greenlight-scan.zip` from the release rather than blocking the other lambdas — check that the
+asset is present before pinning a tag.
+
 ## Reviewer checkout sanitizing
 
 The reviewer workflow (`greenlight-pr-review.yml`) checks the PR's `pytorch/pytorch` tree