Validate test CloudFormation templates in main lint

Author: laughingman7743

.github/workflows/scripts.yaml

@@ -4,6 +4,7 @@ on:
   pull_request:
     paths:
       - 'scripts/**'
+      - 'cloudformation/**'
       - 'justfile'
       - '.mise.toml'
       - 'pyproject.toml'

benchmarks/uv.lock

@@ -8,6 +8,12 @@ See the [testing guide](../docs/testing.md#github-actions) for initial stack cre
 
 The benchmark-specific template is maintained separately in [benchmarks/cloudformation/](../benchmarks/cloudformation/).
 
+## Validation
+
+Run `just lint` from the repository root to check the templates in this directory with cfn-lint alongside the Python checks.
+This validation requires no AWS credentials.
+The benchmark template is checked separately by `just benchmark lint`.
+
 ## Update an existing stack
 
 Use the AWS CLI locally with credentials that can update the stack and its resources.

cloudformation/README.md

@@ -130,7 +130,7 @@ Resources:
                   "s3:ListAllMyBuckets"
                 ]
                 Resource: [
-                  !Sub "arn:aws:s3:::*"
+                  "arn:aws:s3:::*"
                 ]
         - PolicyName: s3tables-access
           PolicyDocument:

cloudformation/github_actions_oidc.yaml

@@ -15,11 +15,12 @@ format:
     uvx ruff@{{RUFF_VERSION}} check --select I --fix .
     uvx ruff@{{RUFF_VERSION}} format .
 
-# Lint + format check + mypy
+# Lint, format check, mypy, and CloudFormation validation
 lint:
     uvx ruff@{{RUFF_VERSION}} check .
     uvx ruff@{{RUFF_VERSION}} format --check .
     uv run mypy .
+    uv run cfn-lint cloudformation/*.yaml
 
 # Run tests: just test (pyathena|sqla|sqla-async)
 test target="help":

justfile

@@ -89,6 +89,7 @@ dev = [
     "myst-parser",
     "sphinx-design",
     "types-python-dateutil",
+    "cfn-lint>=1",
 ]
 
 [build-system]

pyproject.toml

@@ -6,7 +6,7 @@ AWS test infrastructure templates are in [cloudformation/](../cloudformation/).
 
 ## Validation
 
-Run the Python checks, ShellCheck, actionlint, and offline script tests from the repository root:
+Run the Python and CloudFormation checks, ShellCheck, actionlint, and offline script tests from the repository root:
 
 ```bash
 mise install shellcheck actionlint