Core SDK Files (openfaas_sdk/*.py)

• Major: Inconsistent error handling in token sources (ClientCredentialsTokenSource vs. TokenAuth)
  openfaas_sdk/auth.py (lines 272-277, 140-143): ClientCredentialsTokenSource raises a generic RuntimeError for non-2xx responses, while TokenAuth (via exchange) parses OAuth errors for 400s. This inconsistency could confuse users expecting uniform OAuth error handling. In OpenFaaS, client_credentials responses are often OAuth-compliant—consider parsing OAuthError here for consistency with Golang SDK patterns.

• Minor: Potential timezone ambiguity in log filtering
  openfaas_sdk/client.py (lines 367-368): since.isoformat() assumes the datetime is UTC-aware; if naive, it omits timezone info, which may not match OpenFaaS expectations (logs are typically UTC). This could cause silent filtering failures. Align with K8s patterns by ensuring UTC or documenting the requirement.

• Minor: Redundant dict copy in invocation headers
  openfaas_sdk/client.py (lines 498-499, 472-473): In _invoke, merged_headers = dict(headers) is redundant since headers is already a dict. In invoke_function_async, merged_headers is passed correctly, but the copy adds unnecessary overhead for large header sets.

• Info: Thread safety in client instance
  openfaas_sdk/client.py: The Client class uses instance variables like _token_cache without locks, but since clients are typically single-threaded per session (like Go's http.Client), this is acceptable. No races observed.

Authentication & Token Files (openfaas_sdk/auth.py, openfaas_sdk/token*.py, openfaas_sdk/exchange.py)

• Info: Secure token handling
  No issues—tokens are cached in memory only, redacted in logs, and re-read from disk for service account rotation. Aligns well with K8s projected volume patterns.

• Minor: Session lifecycle in ClientCredentialsTokenSource
  openfaas_sdk/auth.py (lines 266-272): If _http_client is provided, it's reused without ownership checks, which is fine but could lead to leaks if callers forget to close. Consistent with requests.Session usage in Go clients.

Builder Files (openfaas_sdk/builder/*.py)

• Info: HMAC signing is secure
  openfaas_sdk/builder/client.py (lines 125-130): SHA256 digest on full tar body prevents tampering, matching OpenFaaS Pro security patterns.

• Major: Potential memory issue for large builds
  openfaas_sdk/builder/client.py (lines 116-117): Reads entire tar file into memory (body = fh.read()) before POSTing. For large builds (e.g., multi-GB images), this could OOM. Consider streaming or chunking for performance, though acceptable for typical OpenFaaS use.

• Minor: Unhandled JSON parsing in streaming
  openfaas_sdk/builder/client.py (lines 105-106): json.loads(line) in build_stream raises if invalid JSON, unlike log parsing which skips failures. Could crash on malformed builder output—add try/except for robustness.

Models & Exceptions (openfaas_sdk/models.py, openfaas_sdk/exceptions.py)

• Info: Good alignment with OpenFaaS APIs
  CamelCase aliases match OpenFaaS JSON schemas. to_api_dict correctly excludes None values.

• Minor: Exception response storage
  openfaas_sdk/exceptions.py (lines 37-38): APIStatusError stores the full requests.Response, which is memory-efficient but could be large. Consistent with Go error patterns.

Configuration & Docs (pyproject.toml, README.md, .github/, etc.)

• Info: Dependency versions
  pyproject.toml: Pins pydantic>=2.0.0, requests>=2.20.0—good for stability, but consider upper bounds to avoid breaking changes in future.

• Minor: README example inconsistency
  README.md (line 110): Mentions token_mount_path env var, but code defaults to /var/secrets/tokens. Clarify in docs to avoid confusion.

• Info: CI coverage
  .github/workflows/ci.yml: Tests across Python 3.10-3.13, good. No integration tests for real OpenFaaS endpoints—consider adding for regression prevention.

Tests (tests/*.py)

• Info: Comprehensive coverage
  Tests cover auth, models, client, builder, and IAM flows. Mocks are thorough, but no concurrency tests for token caching—add to catch race regressions.

• Minor: Test for log parsing edge cases
  tests/test_client.py (lines 250-257): Tests log streaming but not invalid JSON lines. Add cases to ensure skips work as expected.

Overall Patterns & Regressions

• Consistency with OpenFaaS: Code mirrors Go SDK in API fidelity (e.g., function invocation URLs, namespace labels). Error hierarchy (OpenFaaSError) is Pythonic but analogous to Go's error wrapping.
• Potential Regressions: No breaking changes, but the builder's memory usage could regress for large builds. IAM auth flows are solid, unlikely to break existing K8s integrations.
• Performance: Efficient—streams logs, caches tokens, uses requests.Session pooling. No wasteful operations.
• Security: Strong—auth headers redacted, HMAC for builder, path traversal checks in tar creation.

No issues require blocking the PR, but addressing the majors/minors would improve robustness. The SDK is production-ready and consistent with OpenFaaS principles.