Skip to content
Clean Lambda Function
Lean Mean Clean Apps

Five templates, one search box. Everything in the docs is in here, including the bits we hoped you'd skim.

Try one of these

Results say which template they came from, so you won't end up reading about Lambda when you wanted GraphQL. Again.

How it's built

These are templates we build for fun, but the pipeline doesn’t know that. Every pull request goes through the same checks, and some of them are allowed to say no.

Gatekeepers fail the build and block the merge. Tattletales report what they find and leave the decision to a human.

The checks

Section titled “The checks”

BuildGatekeeper

Builds the solution and the image, checks formatting with dotnet format, and packs the template, failing if the package is over 1 MB. Warnings fail the build.

TestGatekeeper

Runs every test inside the Dockerfile and fails under 95% line coverage across the whole solution. Then it installs the packed template, creates a new solution and tests that too.

CodeQLGatekeeper

Static analysis of the C# and of the GitHub Actions workflows themselves, with the security-and-quality queries.

Dependency reviewGatekeeper

Fails a pull request that adds a package with a high or critical vulnerability, or one under a licence outside MIT, Apache 2.0 and BSD.

Smoke testGatekeeper

Starts the image in the Lambda emulator and asks the function for a page of movies. A scan proves nothing about whether the thing actually runs.

TrivyGatekeeper

Scans the Lambda image and the Dockerfile for high and critical problems that have a fix available, and reports them to GitHub code scanning.

SummaryTattletale

Sums every check up in one comment on the pull request, so you know exactly who to blame. It needs no accounts, tokens or secrets, so a copy of the template gets it too.

DependabotTattletale

One grouped pull request on the 15th of each month for NuGet packages, the Docker Compose images and GitHub Actions.

The rules on main

Section titled “The rules on main”
  • Every change goes through a pull request, and every check above must pass.
  • Only the maintainer can merge. Pull requests from anyone are welcome, but the green button has one owner.
  • Commits must be signed, and merges are squashed so the history stays readable.
  • Release tags can’t be moved or deleted once they exist, so a version always means the same code.
  • Third-party GitHub Actions are pinned to a commit, not a tag, so nobody can swap them out from under us.

Releases

Section titled “Releases”

New versions go to NuGet on the 1st of each month, but only when something outside the .github folder has changed. Publishing uses NuGet trusted publishing, so there’s no long-lived API key sitting in the repository waiting to leak. Each release gets a GitHub release with generated notes and an SPDX bill of materials.

The docs

Section titled “The docs”

These docs live on the Lean Mean Clean Apps site, next to the other four templates, and they’re built with Starlight from the site repository. Spotted a mistake? The Edit page link at the bottom of every page takes you straight to the file. The site also publishes an llms.txt, so your AI assistant can read the docs too. It still won’t write the tests for you. Well, it might.

Part of Lean Mean Clean Apps

Made by the Lean Mean Clean Apps team with Clean Architecture, strong coffee and a healthy disregard for pomp and ceremony. Not affiliated with Microsoft, AWS, Uncle Bob or anyone with a marketing budget.