chore(ci): parallelize checks and cache CDK Docker images

[axonstone]

Pull requests now validate every configured AWS environment in separate cloud assembly directories outside the checkout while pytest runs alongside them. CDK validation performs synthesis, so tests overlap synthesis without adding a redundant synthesis job. A wait barrier requires every check to succeed before saving Docker images.

AWS authentication starts in the background while frozen dependency installation and CDK CLI setup run, with an explicit wait before deployment validation. Existing dev/test push triggers and the manual production trigger remain unchanged.

Docker bundling images use a weekly, platform-specific cache with the full checked-out Git tree as the source key and same-week fallback. Tracked Dockerfiles and build-context inputs anywhere in the repository affect the key. Any tracked file change creates a new entry; same-week fallback still restores existing images. CDK's content fingerprint decides whether to reuse an image. Apps without Docker images skip archive creation and upload. The cache covers bundling images created during synthesis/tests, not image assets published by deployment.

The generated workflows use named background steps and explicit wait barriers, as verified on GitHub in aws-cdk-ttc PR #25. A temporary path-scoped actionlint exception suppresses only unsupported background/wait diagnostics while native lint support is pending. Ordinary script and action validation remains enabled.

flowchart TD
  Setup["Install dependencies and restore Docker images"] --> Dev["Validate dev and synthesize"]
  Setup --> Test["Validate test and synthesize"]
  Setup --> Pytest["Run pytest"]
  Dev --> Wait["Wait for all checks"]
  Test --> Wait
  Pytest --> Wait
  Wait --> Cache["Save Docker images when present"]

Loading

Validation on macOS ARM64 with Python 3.13 and CDK CLI 2.1139.0:

• agent-validate check --pr passed the workflow checks.
• uv run ty check and all 4 pytest tests passed. Changed Python files pass Ruff lint and formatting.
• Workflow tests first failed before the environment isolation and authentication barriers were implemented.
• The generated dev/test validation and pytest commands ran concurrently; both expected OIDC/BaseStack assemblies were produced.
• Real Docker export/load/reuse/source-invalidation smoke test passed; export/load shell behavior matches the TypeScript starter kit.

Repository-wide Ruff checks report existing import/formatting issues in unchanged application/helper files and documentation examples. The changed files are clean. The current starter app has no Docker bundling assets, so cache speed gains are unmeasured. Local scripts/logs are in the chat scratchpad; Local validation passed on 3409801, including 4 tests. GitHub validation passed for 3409801, including all 4 tests and both concurrent environment validations. Codex review completed without findings on that commit. No AWS deployment was run locally.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-07T14:02:49.197630Z	3409801	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.