python-sdk.yml

name: Python SDK

# PR-time compile + test coverage for the Rust-backed `auths` wheel. The wheel
# path-depends on the workspace crates but lives in its own Cargo workspace, so
# main-workspace CI does not compile it — this gate is what catches crate API
# changes breaking the Python glue before a release tag does.

on:
  push:
    branches: [main]
    paths:
      - 'packages/auths-python/**'
      - 'crates/**'
  pull_request:
    branches: [main]
    paths:
      - 'packages/auths-python/**'
      - 'crates/**'

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always

jobs:
  build-and-test:
    name: Build wheel & pytest
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # cache: false — this build's target dir is packages/auths-python/target, not
      # the workspace target, so keep the package-scoped cache below and take only
      # the toolchain + shared sccache from the composite.
      - uses: ./.github/actions/setup-rust
        with:
          toolchain: stable
          cache: "false"

      - uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            packages/auths-python/target
          key: ${{ runner.os }}-python-sdk-${{ hashFiles('packages/auths-python/Cargo.lock') }}
          restore-keys: ${{ runner.os }}-python-sdk-

      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Build and install the wheel
        run: |
          python -m pip install --upgrade pip
          pip install packages/auths-python

      - name: Run the Python SDK tests
        run: |
          pip install pytest
          git config --global user.name "CI"
          git config --global user.email "ci@auths.dev"
          pytest packages/auths-python/tests -x -q
        env:
          AUTHS_KEYCHAIN_BACKEND: file
          AUTHS_PASSPHRASE: 'Ci-ephemeral-pass1!'