ci: make check + cdk synth (sem deploy)

.github/workflows/ci.yml

@@ -29,3 +29,25 @@ jobs:
       - name: Run pytest
         # moto mocks DynamoDB — no AWS credentials required
         run: PYTHONPATH=. pytest tests/test_exclusao.py -v
+
+  synth:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: cdk/requirements.txt
+
+      - name: Install CDK Python deps
+        run: pip install -r cdk/requirements.txt
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+
+      - name: CDK synth
+        # No AWS credentials — synth only, never deploy
+        run: npx --yes aws-cdk@2 synth

Makefile

@@ -0,0 +1,12 @@
+# Agent-friendly check: shortest path = correct path (pytest + cdk synth).
+# No deploy. Requires: pip install -r requirements.txt and -r cdk/requirements.txt; Node for npx.
+
+.PHONY: check test synth
+
+test:
+	PYTHONPATH=. pytest tests/test_exclusao.py -v
+
+synth:
+	npx --yes aws-cdk@2 synth
+
+check: test synth

README.md

@@ -36,16 +36,19 @@ Cada solicitação grava **dois** itens (histórico depois ponteiro):
 - **Confirmar pagamento** atualiza histórico e depois `LATEST` (condition em `active_request_id`).
 - Writes ordenados (`put`/`update`) de propósito neste PR — TransactWrite fica pra um follow-up se precisar atomicidade forte.
 
-### Testes
+### Testes / check local
 
 ```bash
 pip install -r requirements.txt
+pip install -r cdk/requirements.txt   # só se for rodar synth
 PYTHONPATH=. pytest tests/test_exclusao.py -v
+# ou o caminho curto (pytest + cdk synth, sem deploy):
+make check
 ```
 
 Usa **moto** (sem AWS real). O pacote `lambda/` importa via `importlib` (nome reservado).
 
-CI (GitHub Actions): mesmo comando em Python 3.12 em todo PR/`push` na `main` — sem credenciais AWS no runner.
+CI (GitHub Actions): em todo PR/`push` na `main` — job **`test`** (pytest/moto, Python 3.12) e job **`synth`** (`npx aws-cdk@2 synth`, sem credenciais AWS / sem deploy).
 
 ---