Validate Lambda deploy config by rissrice2105-agent · Pull Request #645 · profullstack/sh1pt

rissrice2105-agent · 2026-06-05T23:13:00Z

Fixes #644.

Changes:

validate optional handler/runtime/role/zipFile/region/description text
validate Lambda memorySize and timeout ranges
validate environment variable keys and values
reject blank layer ARN entries
normalize config before plan generation and AWS CLI command building
add regression tests for invalid optional config

Validation:

vitest run packages/targets/deploy-lambda/src/index.test.ts
tsc -p packages/targets/deploy-lambda/tsconfig.json --noEmit

greptile-apps · 2026-06-05T23:15:17Z

Greptile Summary

This PR adds input validation for optional Lambda deploy config fields (handler, runtime, role, zipFile, region, description, memorySize, timeout, layers, environment) by introducing a normalizedConfig helper applied at each public entry point before plan generation or AWS CLI command building.

A new normalizedConfig function centralises all validation and whitespace-trimming, wired into build, ship, renderPlan, updateArgs, createArgs, and applyOptionalCreateArgs.
Environment variable key validation uses a regex that incorrectly rejects single-character names (X, A, etc.) due to + instead of * in the character class.
The region() helper now wraps ctx.secret('AWS_REGION') in optionalText, which throws on a blank secret value instead of falling back to 'us-east-1'.

Confidence Score: 3/5

The core validation logic is correct and well-structured, but a regex bug in the environment variable validator will reject valid single-character key names, which is a functional defect that could surface in real deployments.

The env var key regex (+ instead of *) actively rejects valid single-character names like X or A, so any Lambda that uses such keys will fail at the new validation step rather than deploying. The blank-secret-throws behaviour in region() is an unintended behaviour change that could break existing setups where AWS_REGION is stored as an empty string.

Pay close attention to the environmentVariables function and the region helper in packages/targets/deploy-lambda/src/index.ts.

Important Files Changed

Filename	Overview
packages/targets/deploy-lambda/src/index.ts	Adds input validation via normalizedConfig; contains a regex bug that rejects valid single-character env var keys, and wraps ctx.secret in optionalText which breaks the blank-secret fallback path.
packages/targets/deploy-lambda/src/index.test.ts	Adds regression tests for invalid optional config; coverage is correct but does not catch the single-character env var key regression introduced by the `+` vs `*` regex issue.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[build / ship called] --> B[normalizedConfig]
    B --> C{Validation}
    C -->|functionName blank| ERR1[throw: functionName is required]
    C -->|text field blank| ERR2[throw: deploy-lambda requires field]
    C -->|memorySize out of range| ERR3[throw: must be integer 128-10240]
    C -->|timeout out of range| ERR4[throw: must be integer 1-900]
    C -->|env key fails regex| ERR5[throw: must start with a letter]
    C -->|layer ARN blank| ERR6[throw: deploy-lambda requires layers idx]
    C -->|all valid| D[normalized Config]
    D --> E[renderPlan / updateArgs / createArgs]
    E --> F[region helper]
    F -->|config.region set| G[use config.region]
    F -->|config.region unset| H{ctx.secret AWS_REGION}
    H -->|defined and non-blank| I[use secret value]
    H -->|blank string| ERR7[throw: deploy-lambda requires AWS_REGION]
    H -->|undefined| J[fallback us-east-1]

_{Reviews (1): Last reviewed commit: "Validate Lambda deploy config" | Re-trigger Greptile}

greptile-apps · 2026-06-05T23:15:21Z

+  if (value === undefined) return undefined;
+  const entries = Object.entries(value);
+  for (const [key, entryValue] of entries) {
+    if (!/^[A-Za-z][A-Za-z0-9_]+$/.test(key)) {


The environment variable key regex uses + (one-or-more) for the character class after the first letter, which means single-character names like X, A, or Z are always rejected even though they are fully valid POSIX and AWS Lambda environment variable names. Any caller passing { X: '1' } or a similar single-letter key gets an error that doesn't match the stated rule.

Suggested change

if (!/^[A-Za-z][A-Za-z0-9_]+$/.test(key)) {

if (!/^[A-Za-z][A-Za-z0-9_]*$/.test(key)) {

greptile-apps · 2026-06-05T23:15:22Z

 function region(ctx: { secret(key: string): string | undefined }, config: Config): string {
-  return config.region ?? ctx.secret('AWS_REGION') ?? 'us-east-1';
+  return optionalText(config.region, 'region') ?? optionalText(ctx.secret('AWS_REGION'), 'AWS_REGION') ?? 'us-east-1';
 }


optionalText wrapping ctx.secret('AWS_REGION') silently changes error behaviour: if the vault returns a blank string (""), the call throws "deploy-lambda requires AWS_REGION" instead of falling back to 'us-east-1'. An environment where the secret was stored as an empty string would now hard-error at every build / ship call rather than using the default region.

greptile-apps · 2026-06-05T23:15:23Z

 function applyOptionalCreateArgs(args: string[], config: Config): string[] {
+  config = normalizedConfig(config);


normalizedConfig is now called multiple times on the same execution path. All validators are idempotent so this causes no incorrect behaviour today, but each call redundantly re-validates every field. If a heavier side-effect is ever added to a validator, this chain would multiply its impact unexpectedly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

github-actions · 2026-06-06T07:07:53Z