fix(validate): pin cfn-lint below the release that drops the SAM transform

[roger-zhangg]

Which issue(s) does this change fix?

Regression in 1.166.0, from #9156. Reported upstream as aws-cloudformation/cfn-lint#4678.

Why is this change necessary?

cfn-lint 1.54.0 dropped its aws-sam-translator dependency and started validating AWS::Serverless resources against schemas it bundles itself (cfn-lint#4491). Its providers/sam.json covers 9 of the 13 resource types aws-sam-translator supports, so sam validate --lint now fails valid templates:

E3006 Resource type 'AWS::Serverless::CapacityProvider' does not exist in 'us-east-1'

Affected: CapacityProvider, MicrovmImage, NetworkConnector, WebSocketApi. All four are documented SAM resource types with their own translator schema modules. Bisected to cfn-lint 1.54.0 (1.53.3 clean), still present in 1.56.0 and on cfn-lint main. Reproduces with plain cfn-lint, so it is not specific to SAM CLI.

This broke CI for templates using these types, for example aws-lambda-web-adapter, which went from passing on SAM CLI 1.165.0 to failing on 1.166.0 with no template change.

How does it address the issue?

Pins cfn-lint>=1.52.0,<1.54 until upstream ships the missing schemas.

The upper bound excludes the releases described above. The lower bound moves up from 1.51.3 because 1.51.x has no schema for the AWS::Lambda::MicrovmImage and AWS::Lambda::NetworkConnector resources the transform generates, so it cannot lint those templates either — the pin now brackets exactly the versions that handle every SAM resource type.

Adds a unit test that lints one of every SAM resource type, in tests/unit/commands/validate/test_lint_sam_resource_types.py. It runs on every PR, so a dependency bump that reintroduces this fails before merge, and it reaches cfn-lint through cfnlint.api.lint — the same entry point validate._lint uses.

The covered types are asserted equal to what aws-sam-translator exposes, so the test fails if SAM gains a resource type the template does not cover. All 13 are covered today: Api, Application, CapacityProvider, Connector, Function, GraphQLApi, HttpApi, LayerVersion, MicrovmImage, NetworkConnector, SimpleTable, StateMachine, WebSocketApi.

Verified it passes on cfn-lint 1.52.0, 1.52.1, 1.53.0 and 1.53.3, and fails on 1.54.0, 1.55.0, 1.55.1 and 1.56.0 naming all four broken types.

What side effects does this change have?

cfn-lint stays on 1.53.x until cfn-lint#4678 is resolved, so Dependabot bumps in the cfn-lint group will fail the new unit test until then. That is the intended signal.

Mandatory Checklist

PRs will only be reviewed after checklist is complete

• Review the generative AI contribution guidelines
• Add input/output type hints to new functions/methods
• Write design document if needed (Do I need to write a design document?)
• Write/update unit tests
• Write/update integration tests
• Write/update functional tests if needed
• make pr passes
• make update-reproducible-reqs if dependencies were changed
• Write documentation

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[aws-sam-tooling-bot]

Code Review Results

Reviewed: 4dd0cbf..e891fea
Files: 5
Comments: 1

[aws-sam-tooling-bot]

Code Review Results

Reviewed: 4dd0cbf..ea55725
Files: 7
Comments: 1

[aws-sam-tooling-bot]

Code Review Results

Reviewed: 4dd0cbf..2930633
Files: 5
Comments: 1