feat(lambda-python-alpha): support uv (#33880)

### Issue # (if applicable)

Closes #31238
Closes #32413

### Description of changes
- `LambdaFunction` support `uv.lock`
- When `uv.lock` detected, install dependencies with `uv pip sync` instead of `pip install` for better performance. But we can further use uv for all locks since export output is always `requirements.txt`.
- Dockerfile install uv
- Update deprecated runtime in some integs

### Description of how you validated changes
Unit + Integ

### Checklist
- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Author: phuhung273

packages/@aws-cdk/aws-lambda-python-alpha/README.md

@@ -65,22 +65,23 @@ new python.PythonFunction(this, 'MyFunction', {
 
 ## Packaging
 
-If `requirements.txt`, `Pipfile` or `poetry.lock` exists at the entry path, the construct will handle installing all required modules in a [Lambda compatible Docker container](https://gallery.ecr.aws/sam/build-python3.7) according to the `runtime` and with the Docker platform based on the target architecture of the Lambda function.
+If `requirements.txt`, `Pipfile`, `uv.lock` or `poetry.lock` exists at the entry path, the construct will handle installing all required modules in a [Lambda compatible Docker container](https://gallery.ecr.aws/sam/build-python3.13) according to the `runtime` and with the Docker platform based on the target architecture of the Lambda function.
 
 Python bundles are only recreated and published when a file in a source directory has changed.
 Therefore (and as a general best-practice), it is highly recommended to commit a lockfile with a
 list of all transitive dependencies and their exact versions. This will ensure that when any dependency version is updated, the bundle asset is recreated and uploaded.
 
-To that end, we recommend using [`pipenv`] or [`poetry`] which have lockfile support.
+To that end, we recommend using [`pipenv`], [`uv`] or [`poetry`] which have lockfile support.
 
 - [`pipenv`](https://pipenv-fork.readthedocs.io/en/latest/basics.html#example-pipfile-lock)
 - [`poetry`](https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control)
+- [`uv`](https://docs.astral.sh/uv/concepts/projects/sync/#exporting-the-lockfile)
 
 Packaging is executed using the `Packaging` class, which:
 
 1. Infers the packaging type based on the files present.
-2. If it sees a `Pipfile` or a `poetry.lock` file, it exports it to a compatible `requirements.txt` file with credentials (if they're available in the source files or in the bundling container).
-3. Installs dependencies using `pip`.
+2. If it sees a `Pipfile`, `uv.lock` or a `poetry.lock` file, it exports it to a compatible `requirements.txt` file with credentials (if they're available in the source files or in the bundling container).
+3. Installs dependencies using `pip` or `uv`.
 4. Copies the dependencies into an asset that is bundled for the Lambda package.
 
 **Lambda with a requirements.txt**
@@ -109,6 +110,18 @@ Packaging is executed using the `Packaging` class, which:
 ├── poetry.lock # your poetry lock file has to be present at the entry path
 ```
 
+**Lambda with a uv.lock**
+
+Reference: https://docs.astral.sh/uv/concepts/projects/layout/
+
+```plaintext
+.
+├── lambda_function.py # exports a function named 'handler'
+├── pyproject.toml # your poetry project definition
+├── uv.lock # your uv lock file has to be present at the entry path
+├── .python-version # this file is ignored, python version is configured via Runtime
+```
+
 **Excluding source files**
 
 You can exclude files from being copied using the optional bundling string array parameter `assetExcludes`:

packages/@aws-cdk/aws-lambda-python-alpha/lib/Dockerfile

@@ -9,6 +9,7 @@ ARG HTTPS_PROXY
 # pipenv 2022.4.8 is the last version with Python 3.6 support
 ARG PIPENV_VERSION=2022.4.8
 ARG POETRY_VERSION=1.5.1
+ARG UV_VERSION=0.6.9
 
 # Add virtualenv path
 ENV PATH="/usr/app/venv/bin:$PATH"
@@ -19,6 +20,9 @@ ENV PIP_CACHE_DIR=/tmp/pip-cache
 # set the poetry cache
 ENV POETRY_CACHE_DIR=/tmp/poetry-cache
 
+# set the uv cache
+ENV UV_CACHE_DIR=/tmp/uv-cache
+
 RUN \
 # create a new virtualenv for python to use
 # so that it isn't using root
@@ -33,10 +37,14 @@ RUN \
     mkdir /tmp/poetry-cache && \
 # Ensure all users can write to poetry cache
     chmod -R 777 /tmp/poetry-cache && \
-# Install pipenv and poetry
-    pip install pipenv==$PIPENV_VERSION poetry==$POETRY_VERSION && \
+# Create a new location for the uv cache
+    mkdir /tmp/uv-cache && \
+# Ensure all users can write to uv cache
+    chmod -R 777 /tmp/uv-cache && \
+# Install pipenv, poetry and uv
+    pip install pipenv==$PIPENV_VERSION poetry==$POETRY_VERSION uv==${UV_VERSION} && \
 # Ensure no temporary files remain in the caches
-    rm -rf /tmp/pip-cache/* /tmp/poetry-cache/*
+    rm -rf /tmp/pip-cache/* /tmp/poetry-cache/* /tmp/uv-cache/*
 
 # Setting a non-root user to run default command, 
 # This will be overridden later when the Docker container is running, using either the local OS user or props.user.

packages/@aws-cdk/aws-lambda-python-alpha/lib/bundling.ts

@@ -122,15 +122,25 @@ export class Bundling implements CdkBundlingOptions {
     const packaging = Packaging.fromEntry(options.entry, options.poetryIncludeHashes, options.poetryWithoutUrls);
     let bundlingCommands: string[] = [];
     bundlingCommands.push(...options.commandHooks?.beforeBundling(options.inputDir, options.outputDir) ?? []);
-    const exclusionStr = options.assetExcludes?.map(item => `--exclude='${item}'`).join(' ');
+
+    const excludes = options.assetExcludes ?? [];
+    if (packaging.dependenciesFile == DependenciesFile.UV && !excludes.includes('.python-version')) {
+      excludes.push('.python-version');
+    }
+
+    const exclusionStr = excludes.map(item => `--exclude='${item}'`).join(' ');
     bundlingCommands.push([
       'rsync', '-rLv', exclusionStr ?? '', `${options.inputDir}/`, options.outputDir,
     ].filter(item => item).join(' '));
     bundlingCommands.push(`cd ${options.outputDir}`);
     bundlingCommands.push(packaging.exportCommand ?? '');
-    if (packaging.dependenciesFile) {
+
+    if (packaging.dependenciesFile == DependenciesFile.UV) {
+      bundlingCommands.push(`uv pip install -r ${DependenciesFile.PIP} --target ${options.outputDir}`);
+    } else if (packaging.dependenciesFile) {
       bundlingCommands.push(`python -m pip install -r ${DependenciesFile.PIP} -t ${options.outputDir}`);
     }
+
     bundlingCommands.push(...options.commandHooks?.afterBundling(options.inputDir, options.outputDir) ?? []);
     return bundlingCommands;
   }

packages/@aws-cdk/aws-lambda-python-alpha/lib/packaging.ts

@@ -5,6 +5,7 @@ export enum DependenciesFile {
   PIP = 'requirements.txt',
   POETRY = 'poetry.lock',
   PIPENV = 'Pipfile.lock',
+  UV = 'uv.lock',
   NONE = '',
 }
 
@@ -79,6 +80,16 @@ export class Packaging {
     });
   }
 
+  /**
+   * Packaging with `uv`.
+   */
+  public static withUv() {
+    return new Packaging({
+      dependenciesFile: DependenciesFile.UV,
+      exportCommand: `uv export --frozen --no-emit-workspace --no-dev --no-editable -o ${DependenciesFile.PIP}`,
+    });
+  }
+
   /**
    * No dependencies or packaging.
    */
@@ -93,6 +104,8 @@ export class Packaging {
       return this.withPoetry({ poetryIncludeHashes, poetryWithoutUrls });
     } else if (fs.existsSync(path.join(entry, DependenciesFile.PIP))) {
       return this.withPip();
+    } else if (fs.existsSync(path.join(entry, DependenciesFile.UV))) {
+      return this.withUv();
     } else {
       return this.withNoPackaging();
     }

packages/@aws-cdk/aws-lambda-python-alpha/test/bundling.test.ts

@@ -582,3 +582,29 @@ test('with command hooks', () => {
     }),
   }));
 });
+
+test('Bundling a function with uv dependencies', () => {
+  const entry = path.join(__dirname, 'lambda-handler-uv');
+
+  const assetCode = Bundling.bundle({
+    entry: path.join(entry, '.'),
+    runtime: Runtime.PYTHON_3_13,
+    outputPathSuffix: 'python',
+  });
+
+  expect(Code.fromAsset).toHaveBeenCalledWith(entry, expect.objectContaining({
+    bundling: expect.objectContaining({
+      command: [
+        'bash', '-c',
+        "rsync -rLv --exclude='.python-version' /asset-input/ /asset-output/python && cd /asset-output/python && uv export --frozen --no-emit-workspace --no-dev --no-editable -o requirements.txt && uv pip install -r requirements.txt --target /asset-output/python",
+      ],
+    }),
+  }));
+
+  const files = fs.readdirSync(assetCode.path);
+  expect(files).toContain('index.py');
+  expect(files).toContain('pyproject.toml');
+  expect(files).toContain('uv.lock');
+  // Contains hidden files.
+  expect(files).toContain('.ignorefile');
+});