Fix/sustainability content updates

.github/workflows/ai_lead_engineer_app_test.yml

@@ -0,0 +1,98 @@
+name: AI Lead Engineer App Test
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ai-lead-engineer-app-${{ github.ref_name }}
+  cancel-in-progress: true
+
+jobs:
+  ai-lead-engineer-app-test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      TF_CPP_MIN_LOG_LEVEL: "2"
+      AIMODELSHARE_SUPPRESS_OPTIONAL_WARNINGS: "1"
+      CUDA_VISIBLE_DEVICES: "-1"                # Force CPU-only for TensorFlow
+      # Safely expose secrets as env (empty if unavailable, e.g., fork PRs)
+      AIMODELSHARE_USERNAME: ${{ secrets.AIMODELSHARE_USERNAME }}
+      AIMODELSHARE_PASSWORD: ${{ secrets.AIMODELSHARE_PASSWORD }}
+      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      AWS_REGION: ${{ secrets.AWS_REGION }}
+
+    strategy:
+      matrix:
+        python-version: ["3.11"]
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: "pip"
+
+      - name: Upgrade pip
+        run: |
+          python -m pip install --upgrade pip
+
+      - name: Install dependencies
+        run: |
+          # Core dependencies
+          pip install boto3 onnx onnxmltools onnxruntime Pympler scikeras shortuuid skl2onnx tf2onnx wget
+          # Package in editable mode
+          pip install -e .
+          # Test and ML dependencies
+          pip install pytest scikit-learn pandas numpy opencv-python-headless pydot regex psutil IPython matplotlib seaborn importlib_resources onnxscript
+          # TensorFlow (CPU-only)
+          pip install tensorflow-cpu
+          # PyTorch (CPU-only)
+          pip install --index-url https://download.pytorch.org/whl/cpu torch torchvision
+          # Gradio UI
+          pip install gradio
+
+      - name: Verify CPU-only TensorFlow
+        run: |
+          python -c "import tensorflow as tf, os; os.environ['CUDA_VISIBLE_DEVICES']='-1'; print('TensorFlow GPUs:', len(tf.config.list_physical_devices('GPU'))); print('CPU-only mode verified');"
+
+      - name: Set up test environment (if credentials available)
+        if: ${{ env.AIMODELSHARE_USERNAME != '' && env.AIMODELSHARE_PASSWORD != '' }}
+        run: |
+          echo "username=${AIMODELSHARE_USERNAME}" >> "$GITHUB_ENV"
+          echo "password=${AIMODELSHARE_PASSWORD}" >> "$GITHUB_ENV"
+          echo "AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}" >> "$GITHUB_ENV"
+          echo "AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}" >> "$GITHUB_ENV"
+          echo "AWS_REGION=${AWS_REGION}" >> "$GITHUB_ENV"
+
+      - name: Run AI Lead Engineer app tests
+        run: |
+          pytest tests/test_playground_ai_lead_engineer_app.py -v -s --tb=short
+
+      - name: Test app import from moral_compass module
+        run: |
+          python - <<'PY'
+          from aimodelshare.moral_compass import create_ai_lead_engineer_app, launch_ai_lead_engineer_app
+          print('✓ Import from moral_compass module successful')
+
+          from aimodelshare.moral_compass.apps import create_ai_lead_engineer_app as create2, launch_ai_lead_engineer_app as launch2
+          print('✓ Import from apps module successful')
+
+          app = create_ai_lead_engineer_app()
+          assert app is not None
+          print('✓ App instantiation successful')
+          PY
+
+      - name: Summary
+        if: always()
+        run: |
+          echo "AI Lead Engineer App Test Summary"
+          echo "=================================="
+          echo "Python version: ${{ matrix.python-version }}"
+          echo "Status: Test completed"

.github/workflows/aimodelshare-tests.yml

@@ -0,0 +1,84 @@
+name: Test latest master branch aimodelshare
+
+on:
+  workflow_dispatch: # Manual trigger only
+
+permissions:
+  contents: read
+
+concurrency:
+  group: master-aimodelshare-tests
+  cancel-in-progress: true
+
+jobs:
+  run-tests:
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+
+    env:
+      USERNAME: ${{ secrets.AIMODELSHARE_USERNAME }}
+      PASSWORD: ${{ secrets.AIMODELSHARE_PASSWORD }}
+      AWS_ACCESS_KEY_ID: ${{ secrets.DATA_AWS_ACCESS_KEY_ID }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.DATA_AWS_SECRET_ACCESS_KEY }}
+      AWS_REGION: us-east-1
+
+    steps:
+      - name: Checkout repository (master)
+        uses: actions/checkout@v4
+        with:
+          # Uncomment the next line if you want to ALWAYS test master even when dispatching from another ref
+          # ref: master
+          fetch-depth: 0
+
+      - name: Show commit being tested
+        run: |
+          echo "Testing commit:"
+          git --no-pager log -1 --oneline
+          echo "Current branch (if detached this may be a commit SHA):"
+          git branch --show-current || true
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.10"
+          cache: "pip"
+
+      - name: Upgrade pip
+        run: |
+          python -m pip install --upgrade pip
+
+      - name: Install local aimodelshare (editable) + test dependencies
+        run: |
+          pip install boto3 onnx onnxmltools onnxruntime Pympler scikeras shortuuid skl2onnx tf2onnx wget
+          pip install -e .
+          pip install pytest scikit-learn pandas numpy opencv-python-headless tensorflow pydot regex psutil IPython "PyJWT<2.0" matplotlib seaborn importlib_resources onnxscript
+          pip install --index-url https://download.pytorch.org/whl/cpu torch torchvision
+          python -c "import aimodelshare, os; print('aimodelshare imported from:', aimodelshare.__file__)"
+
+      - name: Verify import now points to repository source (not PyPI)
+        run: |
+          python - <<'PYCODE'
+          import aimodelshare, os
+          path = aimodelshare.__file__
+          print("Resolved aimodelshare.__file__:", path)
+          repo_root = os.getcwd()
+          assert repo_root in os.path.abspath(path), f"aimodelshare does not appear to come from the checked-out repository root: {repo_root}"
+          assert "site-packages" not in path, "aimodelshare should NOT be the PyPI site-packages build."
+          print("Verification passed: using local master branch source.")
+          PYCODE
+
+      - name: Run targeted tests against local master branch
+        run: |
+          echo "Starting pytest for tests/test_playgrounds_nodataimport.py"
+          pytest -vv tests/test_aimsonnx.py
+          pytest -vv tests/test_playgrounds_nodataimport.py
+
+      - name: Post-run diagnostics (always runs)
+        if: always()
+        run: |
+          echo "Job conclusion: ${{ job.status }}"
+          python - <<'PYCODE'
+          import aimodelshare
+          print("aimodelshare version attribute (may reflect local dev state):", getattr(aimodelshare, "__version__", "unknown"))
+          print("Module file path:", aimodelshare.__file__)
+          PYCODE

.github/workflows/bootstrap-terraform.yml

@@ -0,0 +1,149 @@
+name: Bootstrap Terraform State Resources
+
+on:
+  workflow_dispatch:
+  workflow_call:
+    outputs:
+      s3_bucket_name:
+        description: "Name of the created S3 bucket"
+        value: ${{ jobs.bootstrap.outputs.s3_bucket_name }}
+      dynamodb_table_name:
+        description: "Name of the created DynamoDB table"
+        value: ${{ jobs.bootstrap.outputs.dynamodb_table_name }}
+      github_actions_role_arn:
+        description: "ARN of the created GitHub Actions IAM role"
+        value: ${{ jobs.bootstrap.outputs.github_actions_role_arn }}
+
+jobs:
+  bootstrap:
+    runs-on: ubuntu-latest
+
+    outputs:
+      s3_bucket_name: ${{ steps.terraform_output.outputs.s3_bucket_name }}
+      dynamodb_table_name: ${{ steps.terraform_output.outputs.dynamodb_table_name }}
+      github_actions_role_arn: ${{ steps.terraform_output.outputs.github_actions_role_arn }}
+
+    permissions:
+      contents: read
+
+    env:
+      AWS_REGION: ${{ vars.AWS_REGION || 'us-east-1' }}
+      TF_IN_AUTOMATION: "true"
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: 1.9.5
+          terraform_wrapper: false
+
+      # Configure AWS credentials using access keys per company policy
+      # Note: Requires AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY repository secrets
+      # Security: Ensure access keys follow principle of least privilege and key rotation policies
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.DATA_AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.DATA_AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Check if resources already exist
+        id: check_resources
+        working-directory: infra/bootstrap
+        run: |
+          # Check if S3 bucket exists
+          if aws s3api head-bucket --bucket "aimodelshare-tfstate-prod-copilot-2024" 2>/dev/null; then
+            echo "s3_exists=true" >> $GITHUB_OUTPUT
+          else
+            echo "s3_exists=false" >> $GITHUB_OUTPUT
+          fi
+
+          # Check if DynamoDB table exists
+          if aws dynamodb describe-table --table-name "aimodelshare-tf-locks" 2>/dev/null; then
+            echo "dynamodb_exists=true" >> $GITHUB_OUTPUT
+          else
+            echo "dynamodb_exists=false" >> $GITHUB_OUTPUT
+          fi
+
+          # Check if GitHub OIDC provider exists
+          ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
+          if aws iam get-open-id-connect-provider --open-id-connect-provider-arn "arn:aws:iam::${ACCOUNT_ID}:oidc-provider/token.actions.githubusercontent.com" 2>/dev/null; then
+            echo "oidc_provider_exists=true" >> $GITHUB_OUTPUT
+          else
+            echo "oidc_provider_exists=false" >> $GITHUB_OUTPUT
+          fi
+
+          # Check if GitHub Actions IAM role exists
+          if aws iam get-role --role-name "aimodelshare-github-oidc-deployer" 2>/dev/null; then
+            echo "github_role_exists=true" >> $GITHUB_OUTPUT
+          else
+            echo "github_role_exists=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Terraform Init
+        working-directory: infra/bootstrap
+        run: terraform init -input=false
+
+      - name: Terraform Validate
+        working-directory: infra/bootstrap
+        run: terraform validate
+
+      - name: Import existing resources (if they exist)
+        working-directory: infra/bootstrap
+        if: steps.check_resources.outputs.s3_exists == 'true' || steps.check_resources.outputs.dynamodb_exists == 'true' || steps.check_resources.outputs.oidc_provider_exists == 'true' || steps.check_resources.outputs.github_role_exists == 'true'
+        run: |
+          ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
+
+          if [ "${{ steps.check_resources.outputs.s3_exists }}" = "true" ]; then
+            echo "Importing existing S3 bucket..."
+            terraform import aws_s3_bucket.terraform_state aimodelshare-tfstate-prod-copilot-2024 || true
+            terraform import aws_s3_bucket_versioning.terraform_state aimodelshare-tfstate-prod-copilot-2024 || true
+            terraform import aws_s3_bucket_server_side_encryption_configuration.terraform_state aimodelshare-tfstate-prod-copilot-2024 || true
+            terraform import aws_s3_bucket_public_access_block.terraform_state aimodelshare-tfstate-prod-copilot-2024 || true
+          fi
+
+          if [ "${{ steps.check_resources.outputs.dynamodb_exists }}" = "true" ]; then
+            echo "Importing existing DynamoDB table..."
+            terraform import aws_dynamodb_table.terraform_locks aimodelshare-tf-locks || true
+          fi
+
+          if [ "${{ steps.check_resources.outputs.oidc_provider_exists }}" = "true" ]; then
+            echo "Importing existing GitHub OIDC provider..."
+            terraform import aws_iam_openid_connect_provider.github "arn:aws:iam::${ACCOUNT_ID}:oidc-provider/token.actions.githubusercontent.com" || true
+          fi
+
+          if [ "${{ steps.check_resources.outputs.github_role_exists }}" = "true" ]; then
+            echo "Importing existing GitHub Actions IAM role..."
+            terraform import aws_iam_role.github_actions aimodelshare-github-oidc-deployer || true
+            # Also try to import the policy and attachment if they exist
+            terraform import aws_iam_policy.github_actions_deployment "arn:aws:iam::${ACCOUNT_ID}:policy/aimodelshare-github-actions-deployment" || true
+            terraform import aws_iam_role_policy_attachment.github_actions_deployment aimodelshare-github-oidc-deployer/arn:aws:iam::${ACCOUNT_ID}:policy/aimodelshare-github-actions-deployment || true
+          fi
+
+      - name: Terraform Plan
+        id: plan
+        working-directory: infra/bootstrap
+        run: |
+          terraform plan -input=false -out=tfplan
+
+      - name: Terraform Apply
+        working-directory: infra/bootstrap
+        run: terraform apply -input=false -auto-approve tfplan
+
+      - name: Get Terraform Outputs
+        id: terraform_output
+        working-directory: infra/bootstrap
+        run: |
+          S3_BUCKET=$(terraform output -raw s3_bucket_name)
+          DYNAMODB_TABLE=$(terraform output -raw dynamodb_table_name)
+          GITHUB_ROLE_ARN=$(terraform output -raw github_actions_role_arn)
+          echo "s3_bucket_name=$S3_BUCKET" >> $GITHUB_OUTPUT
+          echo "dynamodb_table_name=$DYNAMODB_TABLE" >> $GITHUB_OUTPUT
+          echo "github_actions_role_arn=$GITHUB_ROLE_ARN" >> $GITHUB_OUTPUT
+          echo "✅ Bootstrap completed successfully!"
+          echo "  S3 Bucket: $S3_BUCKET"
+          echo "  DynamoDB Table: $DYNAMODB_TABLE"
+          echo "  GitHub Actions Role ARN: $GITHUB_ROLE_ARN"