feat(runtime): add Python 3.13 support (#5527)

* Initial commit for Python 3.13

* Initial commit for Python 3.13

* Initial commit for Python 3.13

* Make mypy happy

* Constructor initial changes

* Constructor initial changes

* Docker folder

* More changes

* More changes

* More changes

* Merging from develop

* CDK 2.167.0

* Should not run CDK tests with all python version

* Should not run CDK tests with all python version - Python 3.12

Author: leandrodamascena

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -63,6 +63,7 @@ body:
         - "3.10"
         - "3.11"
         - "3.12"
+        - "3.13"
     validations:
       required: true
   - type: dropdown

.github/ISSUE_TEMPLATE/static_typing.yml

@@ -30,6 +30,7 @@ body:
         - "3.10"
         - "3.11"
         - "3.12"
+        - "3.13"
     validations:
       required: true
   - type: input

.github/workflows/layer_govcloud.yml

@@ -49,6 +49,7 @@ jobs:
           - AWSLambdaPowertoolsPythonV3-python310
           - AWSLambdaPowertoolsPythonV3-python311
           - AWSLambdaPowertoolsPythonV3-python312
+          - AWSLambdaPowertoolsPythonV3-python313
         arch:
           - arm64
           - x86_64
@@ -94,6 +95,7 @@ jobs:
           - AWSLambdaPowertoolsPythonV3-python310
           - AWSLambdaPowertoolsPythonV3-python311
           - AWSLambdaPowertoolsPythonV3-python312
+          - AWSLambdaPowertoolsPythonV3-python313
         arch:
           - arm64
           - x86_64
@@ -110,7 +112,7 @@ jobs:
       - name: Verify Layer Signature
         run: |
           SHA=$(jq -r '.Content.CodeSha256' '${{ matrix.layer }}_${{ matrix.arch }}.json')
-          test "$(openssl dgst -sha256 -binary ${{ matrix.layer }}_${{ matrix.arch }}.zip | openssl enc -base64)" == "$SHA" && echo "SHA OK: ${SHA}" || exit 1 
+          test "$(openssl dgst -sha256 -binary ${{ matrix.layer }}_${{ matrix.arch }}.zip | openssl enc -base64)" == "$SHA" && echo "SHA OK: ${SHA}" || exit 1
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
         with:
@@ -144,7 +146,7 @@ jobs:
         run: |
           REMOTE_SHA=$(aws --region us-gov-east-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-east-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ env.LAYER_VERSION }}' --query 'Content.CodeSha256' --output text)
           SHA=$(jq -r '.Content.CodeSha256' '${{ matrix.layer }}_${{ matrix.arch }}.json')
-          test "$REMOTE_SHA" == "$SHA" && echo "SHA OK: ${SHA}" || exit 1 
+          test "$REMOTE_SHA" == "$SHA" && echo "SHA OK: ${SHA}" || exit 1
           aws --region us-gov-east-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-east-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ env.LAYER_VERSION }}' --output table
 
   copy_west:
@@ -162,6 +164,7 @@ jobs:
           - AWSLambdaPowertoolsPythonV3-python310
           - AWSLambdaPowertoolsPythonV3-python311
           - AWSLambdaPowertoolsPythonV3-python312
+          - AWSLambdaPowertoolsPythonV3-python313
         arch:
           - arm64
           - x86_64
@@ -179,7 +182,7 @@ jobs:
       - name: Verify Layer Signature
         run: |
           SHA=$(jq -r '.Content.CodeSha256' '${{ matrix.layer }}_${{ matrix.arch }}.json')
-          test "$(openssl dgst -sha256 -binary ${{ matrix.layer }}_${{ matrix.arch }}.zip | openssl enc -base64)" == "$SHA" && echo "SHA OK: ${SHA}" || exit 1 
+          test "$(openssl dgst -sha256 -binary ${{ matrix.layer }}_${{ matrix.arch }}.zip | openssl enc -base64)" == "$SHA" && echo "SHA OK: ${SHA}" || exit 1
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
         with:
@@ -213,5 +216,5 @@ jobs:
         run: |
           REMOTE_SHA=$(aws --region us-gov-west-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-west-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ env.LAYER_VERSION }}' --query 'Content.CodeSha256' --output text)
           SHA=$(jq -r '.Content.CodeSha256' '${{ matrix.layer }}_${{ matrix.arch }}.json')
-          test "$REMOTE_SHA" == "$SHA" && echo "SHA OK: ${SHA}" || exit 1 
-          aws --region us-gov-west-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-west-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ env.LAYER_VERSION }}' --output table
+          test "$REMOTE_SHA" == "$SHA" && echo "SHA OK: ${SHA}" || exit 1
+          aws --region us-gov-west-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-west-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ env.LAYER_VERSION }}' --output table

.github/workflows/layer_govcloud_verify.yml

@@ -33,6 +33,7 @@ jobs:
           - AWSLambdaPowertoolsPythonV3-python310
           - AWSLambdaPowertoolsPythonV3-python311
           - AWSLambdaPowertoolsPythonV3-python312
+          - AWSLambdaPowertoolsPythonV3-python313
         arch:
           - arm64
           - x86_64
@@ -63,6 +64,7 @@ jobs:
           - AWSLambdaPowertoolsPythonV3-python310
           - AWSLambdaPowertoolsPythonV3-python311
           - AWSLambdaPowertoolsPythonV3-python312
+          - AWSLambdaPowertoolsPythonV3-python313
         arch:
           - arm64
           - x86_64
@@ -94,6 +96,7 @@ jobs:
           - AWSLambdaPowertoolsPythonV3-python310
           - AWSLambdaPowertoolsPythonV3-python311
           - AWSLambdaPowertoolsPythonV3-python312
+          - AWSLambdaPowertoolsPythonV3-python313
         arch:
           - arm64
           - x86_64

.github/workflows/publish_v3_layer.yml

@@ -85,7 +85,7 @@ jobs:
     strategy:
       max-parallel: 5
       matrix:
-        python-version: ["3.8","3.9","3.10","3.11","3.12"]
+        python-version: ["3.8","3.9","3.10","3.11","3.12","3.13"]
     defaults:
       run:
         working-directory: ./layer_v3

.github/workflows/quality_check.yml

@@ -46,7 +46,7 @@ jobs:
     strategy:
       max-parallel: 4
       matrix:
-        python-version: ["3.8", "3.9", "3.10", "3.11", "3.12"]
+        python-version: ["3.8","3.9","3.10","3.11","3.12","3.13"]
     env:
       PYTHON: "${{ matrix.python-version }}"
     permissions:

.github/workflows/quality_code_cdk_constructor.yml

@@ -15,25 +15,25 @@ name: Code quality - CDK constructor
 on:
   pull_request:
     paths:
-      - "layer/layer_constructors/**"
+      - "layer_v3/layer_constructors/**"
     branches:
       - develop
   push:
     paths:
-        - "layer/layer_constructors/**"
+        - "layer_v3/layer_constructors/**"
     branches:
       - develop
 
 permissions:
   contents: read
 
 jobs:
-  quality_check:
+  quality_check_cdk:
     runs-on: ubuntu-latest
     strategy:
       max-parallel: 4
       matrix:
-        python-version: ["3.8", "3.9", "3.10", "3.11", "3.12"]
+        python-version: ["3.12"]
     env:
       PYTHON: "${{ matrix.python-version }}"
     permissions:

.github/workflows/reusable_deploy_v3_layer_stack.yml

@@ -78,7 +78,7 @@ jobs:
                  "eu-north-1", "eu-south-1", "eu-south-2", "eu-west-1", "eu-west-2", "eu-west-3",
                  "il-central-1", "me-central-1", "me-south-1", "sa-east-1", "us-east-1",
                  "us-east-2", "us-west-1", "us-west-2"]
-        python-version: ["3.8","3.9","3.10","3.11","3.12"]
+        python-version: ["3.8","3.9","3.10","3.11","3.12","3.13"]
         include:
           - region: "af-south-1"
             has_arm64_support: "true"

.github/workflows/reusable_deploy_v3_sar.yml

@@ -4,7 +4,7 @@ name: Deploy V3 SAR
 #
 # 1. This workflow starts after the layer artifact is produced on `publish_v3_layer`
 # 2. We use the same layer artifact to ensure the SAR app is consistent with the published Lambda Layer
-# 3. We publish the SAR for 3.8 to 3.12 Python runtime and both x86_64 and arm64 (see `matrix` section)
+# 3. We publish the SAR for 3.8 to 3.13 Python runtime and both x86_64 and arm64 (see `matrix` section)
 # 4. We use `sam package` and `sam publish` to publish the SAR app
 # 5. We remove the previous Canary stack (if present) and deploy a new one to test the SAR App. We retain the Canary in the account for debugging purposes
 # 6. Finally the published SAR app is made public on the PROD environment
@@ -72,7 +72,7 @@ jobs:
     strategy:
       matrix:
         architecture: ["x86_64", "arm64"]
-        python-version: ["3.8","3.9","3.10","3.11","3.12"]
+        python-version: ["3.8","3.9","3.10","3.11","3.12","3.13"]
     steps:
       - name: checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2

.github/workflows/run-e2e-tests.yml

@@ -48,7 +48,7 @@ jobs:
     strategy:
       fail-fast: false # needed so if a version fails, the others will still be able to complete and cleanup
       matrix:
-        version: ["3.8", "3.9", "3.10", "3.11", "3.12"]
+        version: ["3.8", "3.9", "3.10", "3.11", "3.12","3.13"]
     if: ${{ github.actor != 'dependabot[bot]' && github.repository == 'aws-powertools/powertools-lambda-python' }}
     steps:
       - name: "Checkout"