[jariy17]

Summary

Move the CI/CD Pipeline to ephemeral AWS CodeBuild runners and fix test assumptions exposed by the runner environment and the actual Python 3.10–3.13 matrix. This covers lint, unit tests, distribution builds, and package installation checks.

Changes

• Runner configuration (.github/workflows/ci.yml): route all ten expanded jobs to agentcore-sdk-python-ci. Include the workflow run ID and attempt in the runner label, plus a distinct label for each job and Python version to prevent cross-job runner assignment.
• Python matrix selection: set UV_PYTHON at test-job scope so every uv command uses the requested matrix version. Previously, the repository's .python-version pin could select Python 3.10 even in jobs labeled 3.11–3.13.
• Batch evaluation region test: assert the imported DEFAULT_REGION when neither an explicit region nor a session region is available, replacing the hardcoded us-west-2 expectation. This supports environments that configure a different AWS region.
• Localhost runtime test: explicitly clear DOCKER_CONTAINER and mock the Docker-file check so the test consistently exercises non-container binding, including when CI itself runs inside a container.
• Memory-store static typing tests: pass the executing interpreter's version to mypy. This aligns type checking with installed dependency stubs, including newer NumPy syntax; the Python 3.10 matrix entry continues checking 3.10 compatibility.
• Memory-store runtime type tests: use get_type_hints(..., include_extras=True) when inspecting NotRequired[boto3.Session], preserving the wrapper across supported Python versions.
• Concurrent event sender tests: compare batches and retry-token lists independently of worker-thread call order. Preserve checks for within-event ordering, batch boundaries, and duplicate batches; verify the complete token list on both sends and validate metadata on every emitted event.

SDK runtime code is unchanged. Existing workflow triggers, job dependencies, and Python-version coverage are preserved.

Runner setup

The CodeBuild project and GitHub workflow-job webhook have been provisioned separately, and runner authentication is configured. These infrastructure resources are prerequisites for the workflow labels and are not added as files in this PR.

Validation

• All ten CodeBuild CI jobs passed on e14e1e201c7b7dd64e0805b1ce12f6f36fd390d5: lint, full tests on Python 3.10–3.13, distribution build, and installation checks on all four versions.
• All 163 memory-store tests passed locally on Python 3.10, 3.12, and 3.13.
• Full local suite: 3,656 passed, 10 skipped, 4 xpassed.
• All eight affected region/localhost cases passed with the CodeBuild region environment.
• Pre-commit formatting/lint checks, Bandit, and git diff --check passed.
• Actionlint passed with custom runner labels configured and the pre-existing Codecov file input warning excluded.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)