Update tox setup for AWS Lambda integration

.github/PULL_REQUEST_TEMPLATE.md

@@ -4,4 +4,4 @@
 
 Thank you for contributing to `sentry-python`! Please add tests to validate your changes, and lint your code using `tox -e linters`.
 
-Running the test suite on your PR might require maintainer approval. The AWS Lambda tests additionally require a maintainer to add a special label, and they will fail until this label is added.
+Running the test suite on your PR might require maintainer approval.

.github/workflows/test-integrations-cloud.yml

@@ -35,6 +35,10 @@ jobs:
         # ubuntu-20.04 is the last version that supported python3.6
         # see https://github.com/actions/setup-python/issues/544#issuecomment-1332535877
         os: [ubuntu-20.04]
+    services:
+      docker:
+        image: docker:dind  # Required for Docker network management
+        options: --privileged  # Required for Docker-in-Docker operations
     steps:
       - uses: actions/[email protected]
       - uses: actions/setup-python@v5
@@ -47,6 +51,10 @@ jobs:
       - name: Erase coverage
         run: |
           coverage erase
+      - name: Test aws_lambda latest
+        run: |
+          set -x # print commands that are executed
+          ./scripts/runtox.sh "py${{ matrix.python-version }}-aws_lambda-latest"
       - name: Test boto3 latest
         run: |
           set -x # print commands that are executed
@@ -97,12 +105,16 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.6","3.7","3.9","3.11","3.12","3.13"]
+        python-version: ["3.6","3.7","3.8","3.9","3.11","3.12","3.13"]
         # python3.6 reached EOL and is no longer being supported on
         # new versions of hosted runners on Github Actions
         # ubuntu-20.04 is the last version that supported python3.6
         # see https://github.com/actions/setup-python/issues/544#issuecomment-1332535877
         os: [ubuntu-20.04]
+    services:
+      docker:
+        image: docker:dind  # Required for Docker network management
+        options: --privileged  # Required for Docker-in-Docker operations
     steps:
       - uses: actions/[email protected]
       - uses: actions/setup-python@v5
@@ -115,6 +127,10 @@ jobs:
       - name: Erase coverage
         run: |
           coverage erase
+      - name: Test aws_lambda pinned
+        run: |
+          set -x # print commands that are executed
+          ./scripts/runtox.sh --exclude-latest "py${{ matrix.python-version }}-aws_lambda"
       - name: Test boto3 pinned
         run: |
           set -x # print commands that are executed

scripts/populate_tox/tox.jinja

@@ -57,9 +57,6 @@ envlist =
     {py3.8,py3.11,py3.12}-asyncpg-latest
 
     # AWS Lambda
-    # The aws_lambda tests deploy to the real AWS and have their own
-    # matrix of Python versions to run the test lambda function in.
-    # see `lambda_runtime` fixture in tests/integrations/aws_lambda.py
     {py3.8,py3.9,py3.11,py3.13}-aws_lambda
 
     # Beam
@@ -533,8 +530,6 @@ setenv =
     socket: TESTPATH=tests/integrations/socket
 
 passenv =
-    SENTRY_PYTHON_TEST_AWS_ACCESS_KEY_ID
-    SENTRY_PYTHON_TEST_AWS_SECRET_ACCESS_KEY
     SENTRY_PYTHON_TEST_POSTGRES_HOST
     SENTRY_PYTHON_TEST_POSTGRES_USER
     SENTRY_PYTHON_TEST_POSTGRES_PASSWORD

scripts/split_tox_gh_actions/split_tox_gh_actions.py

@@ -43,11 +43,7 @@
     "clickhouse_driver",
 }
 
-FRAMEWORKS_NEEDING_AWS = {
-    "aws_lambda",
-}
-
-FRAMEWORKS_NEEDING_GITHUB_SECRETS = {
+FRAMEWORKS_NEEDING_DOCKER = {
     "aws_lambda",
 }
 
@@ -65,12 +61,8 @@
         "openai",
         "huggingface_hub",
     ],
-    "AWS": [
-        # this is separate from Cloud Computing because only this one test suite
-        # needs to run with access to GitHub secrets
-        "aws_lambda",
-    ],
     "Cloud": [
+        "aws_lambda",
         "boto3",
         "chalice",
         "cloud_resource_context",
@@ -292,13 +284,10 @@ def render_template(group, frameworks, py_versions_pinned, py_versions_latest):
         "group": group,
         "frameworks": frameworks,
         "categories": sorted(categories),
-        "needs_aws_credentials": bool(set(frameworks) & FRAMEWORKS_NEEDING_AWS),
         "needs_clickhouse": bool(set(frameworks) & FRAMEWORKS_NEEDING_CLICKHOUSE),
+        "needs_docker": bool(set(frameworks) & FRAMEWORKS_NEEDING_DOCKER),
         "needs_postgres": bool(set(frameworks) & FRAMEWORKS_NEEDING_POSTGRES),
         "needs_redis": bool(set(frameworks) & FRAMEWORKS_NEEDING_REDIS),
-        "needs_github_secrets": bool(
-            set(frameworks) & FRAMEWORKS_NEEDING_GITHUB_SECRETS
-        ),
         "py_versions": {
             category: [f'"{version}"' for version in _normalize_py_versions(versions)]
             for category, versions in py_versions.items()

scripts/split_tox_gh_actions/templates/base.jinja

@@ -13,15 +13,7 @@ on:
       - release/**
       - potel-base
 
-  {% if needs_github_secrets %}
-  # XXX: We are using `pull_request_target` instead of `pull_request` because we want
-  # this to run on forks with access to the secrets necessary to run the test suite.
-  # Prefer to use `pull_request` when possible.
-  pull_request_target:
-    types: [labeled, opened, reopened, synchronize]
-  {% else %}
   pull_request:
-  {% endif %}
 
 # Cancel in progress workflows on pull_requests.
 # https://docs.github.com/en/actions/using-jobs/using-concurrency#example-using-a-fallback-value
@@ -31,27 +23,13 @@ concurrency:
 
 permissions:
   contents: read
-  {% if needs_github_secrets %}
-  # `write` is needed to remove the `Trigger: tests using secrets` label
-  pull-requests: write
-  {% endif %}
 
 env:
-{% if needs_aws_credentials %}
-{% raw %}
-  SENTRY_PYTHON_TEST_AWS_ACCESS_KEY_ID: ${{ secrets.SENTRY_PYTHON_TEST_AWS_ACCESS_KEY_ID }}
-  SENTRY_PYTHON_TEST_AWS_SECRET_ACCESS_KEY: ${{ secrets.SENTRY_PYTHON_TEST_AWS_SECRET_ACCESS_KEY }}
-{% endraw %}
-{% endif %}
   BUILD_CACHE_KEY: {% raw %}${{ github.sha }}{% endraw %}
   CACHED_BUILD_PATHS: |
     {% raw %}${{ github.workspace }}/dist-serverless{% endraw %}
 
 jobs:
-{% if needs_github_secrets %}
-{% include "check_permissions.jinja" %}
-{% endif %}
-
 {% for category in categories %}
 {% include "test_group.jinja" %}
 {% endfor %}