fix(cicd): make the awslabs namespace check fail the build - #4605

Fixes

Summary

scripts/verify_awslabs_init.py is wired into the per-package gate at .github/workflows/python.yml:134 and is meant to fail the build when a server's awslabs/__init__.py is not the namespace shim this repo requires. It is a click command that signals failure with return 1. Click's standalone mode discards the return value, so the process prints the mismatch and exits 0.

Run against a deliberately corrupted package, the original script prints ✗ Mismatch: ... and then exits 0. The gate has never fired. scripts/verify_package_name.py in the same directory uses sys.exit() correctly, and this follows it.

Changes

Two changes are needed, because switching the gate on as written would fail servers that are not actually wrong.

1. Compare the parsed module, not the bytes. The check compared the file byte-for-byte against a single-quoted FILE_CONTENTS. But a server that declares [tool.ruff] in its own pyproject.toml replaces the root .ruff.toml rather than merging with it, so a server that does not declare quote-style inherits ruff's double-quote default. ecs-mcp-server is exactly that case — ruff format inside that directory rewrites 'pkgutil' to "pkgutil", so byte equality with a single-quoted constant is unreachable there, and its double quotes were correct all along rather than sloppy. well-architected-security-mcp-server declares quote-style = "double" explicitly. Comparing ast.dump(ast.parse(...)) accepts either quote style and any comment wording, while still rejecting a file that does anything other than extend the namespace path. The license header has its own check.

2. Fix the one server that was genuinely broken. aws-serverless-mcp-server's awslabs/__init__.py had no __path__ = __import__('pkgutil').extend_path(__path__, __name__) line at all — only a comment — which makes awslabs a regular package there rather than a namespace portion.

documentdb-mcp-server, mcp-lambda-handler and well-architected-security-mcp-server had no awslabs/__init__.py at all. These were verified to import correctly alongside pkgutil-style siblings in both sys.path orders, so nothing is broken today; they are brought into line with the other 58 servers because the shim is an idempotent no-op and their packaging config (packages = ["awslabs"]) is identical to their compliant peers. ecs-mcp-server and oracle-mcp-server are left untouched — the AST comparison accepts what they already have, and rewriting them would fight their own formatter.

User experience

Before: a server could ship a non-conforming awslabs/__init__.py and CI stayed green, because the check that existed to catch it could not fail.

After: it fails. Concretely, with real hatchling wheels built from aws-serverless-mcp-server's previous content and placed first on a multi-root sys.path — editable installs, PYTHONPATH dev setups, stacked Lambda layers — importing a sibling awslabs.* server's subpackage raises ModuleNotFoundError. Reversing the path order hides it, which is what makes it worth a gate: it is order-dependent and silent. Users routinely install several awslabs.* MCP servers into one environment.

Checklist

If your change doesn't seem to apply, please leave them unchecked.

• I have reviewed the contributing guidelines
• I have performed a self-review of this change
• Changes have been tested
• Changes are documented

Is this a breaking change? (N)

RFC issue number:

Checklist:

• Migration process documented
• Implement warnings (if it can live side by side)

How this was verified

• Original script against a corrupted fixture: prints ✗ Mismatch, exits 0. Fixed script, same fixture: exits 1.
• Fixed script still exits 1 for a file missing the extend_path call, and for an otherwise-compliant file with import os appended — so relaxing to an AST comparison did not relax what the gate actually enforces.
• All 62 servers pass after this change (6 failed before it).
• Each touched awslabs/__init__.py confirmed already-formatted under its own server's ruff configuration, so this does not trade one red gate for another.
• The ModuleNotFoundError was reproduced with wheels built by the same backend and packages = ["awslabs"] config the real servers use, not inferred. What is not independently reproduced: installing two actual published awslabs.* distributions from PyPI together.
• pre-commit run over the diff: no failures. gitleaks could not be installed here (Go module download failed) and check-license-header, pyright and pytest were skipped — the last two are pre-push-staged and do not run in CI.

Acknowledgment

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of the project license.

🤖 Generated with Claude Code