ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.event_name }}-${{ github.event_name == 'pull_request' && github.ref || github.sha }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  action-policy:
    name: Central action policy preflight
    if: ${{ github.server_url == 'https://github.com' }}
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Check out candidate source
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
        with:
          persist-credentials: false
      - name: Check out central action policy
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
        with:
          repository: durable-workflow/.github
          ref: main
          path: .central-action-policy
          persist-credentials: false
      - name: Set up Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: "3.13"
      - name: Install policy dependencies
        run: python -m pip install PyYAML==6.0.2
      - name: Require centrally approved immutable action commits
        run: >-
          python .central-action-policy/scripts/qualification_policy.py validate
          --policy .central-action-policy/qualification/policy.json
          --target sdk-python
          --workflow-directory .github/workflows

  regression-corpus:
    name: Regression corpus
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: "3.12"
      - name: Install the SDK
        run: pip install -e .
      - name: Require durable replay and codec evidence
        env:
          CORPUS_BASE_REF: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
        run: |
          arguments=()
          if [[ "$CORPUS_BASE_REF" =~ ^[0-9a-f]{40}$ ]] && [[ ! "$CORPUS_BASE_REF" =~ ^0+$ ]]; then
            arguments+=(--base-ref "$CORPUS_BASE_REF")
          fi
          python scripts/ci/validate-regression-corpus.py "${arguments[@]}"
      - name: Test regression corpus policy guards
        run: python scripts/ci/test-validate-regression-corpus.py

  lint:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: "3.12"
      - run: pip install -e '.[dev]'
      - run: ruff check src/ tests/
      - run: mypy src/durable_workflow/
      - name: Enforce load-calibrated Avro Value regression budget
        run: python benchmarks/avro_value.py --enforce

  avro-benchmark:
    name: Avro Value absolute throughput (advisory)
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: "3.12"
      - run: pip install -e .
      - name: Measure the bounded absolute throughput signal
        continue-on-error: true
        run: >-
          python benchmarks/avro_value.py --enforce-absolute
          --output avro-value-benchmark.json
      - name: Publish the measured sample summary
        if: ${{ always() && github.server_url == 'https://github.com' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
        with:
          name: avro-value-benchmark-${{ github.sha }}
          path: avro-value-benchmark.json
          if-no-files-found: error

  test:
    name: Python ${{ matrix.python-version }}
    runs-on: ubuntu-latest
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.11", "3.12"]
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: ${{ matrix.python-version }}
      - run: pip install -e '.[dev]'
      - run: pytest tests/ -m "not integration" -q

  package:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
        with:
          fetch-depth: 0
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: "3.12"
      - run: pip install build twine
      - run: python -m build
      - name: Compare built release metadata with the exact source commit
        run: python scripts/check_release_metadata.py --source-ref "$(git rev-parse HEAD)" --dist dist
      - run: twine check dist/*
      - run: python scripts/smoke-built-package.py

  integration:
    runs-on: ubuntu-latest
    timeout-minutes: 25
    needs: [lint, test]
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
        with:
          path: sdk-python
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: "3.12"
      - name: Check out public Server integration source
        run: python sdk-python/scripts/ci/checkout-public-repository.py server server
      - run: pip install -e '.[dev]'
        working-directory: sdk-python
      - name: Configure isolated Docker project
        working-directory: sdk-python
        run: python scripts/ci/configure-compose-project.py
      - name: Start Server stack
        working-directory: sdk-python
        run: |
          docker compose --project-name "$COMPOSE_PROJECT_NAME" -f docker-compose.test.yml \
            up -d --build --wait --timeout 300
      - name: Select and probe integration endpoint
        working-directory: sdk-python
        run: python scripts/ci/configure-integration-endpoint.py
      - name: Run integration tests
        working-directory: sdk-python
        env:
          DURABLE_WORKFLOW_AUTH_TOKEN: test-token
        run: pytest tests/integration/ -v
      - name: Emit integration diagnostics
        if: failure()
        working-directory: sdk-python
        run: |
          for service in bootstrap server worker; do
            echo "::group::$service logs"
            docker compose --project-name "$COMPOSE_PROJECT_NAME" -f docker-compose.test.yml \
              logs --no-color --tail 200 "$service" || true
            echo "::endgroup::"
          done
      - name: Teardown
        if: always()
        working-directory: sdk-python
        run: |
          docker compose --project-name "$COMPOSE_PROJECT_NAME" -f docker-compose.test.yml \
            down -v --rmi local

  target-branch-qualification:
    name: Target branch qualification
    if: ${{ always() }}
    needs:
      - action-policy
      - regression-corpus
      - lint
      - avro-benchmark
      - test
      - package
      - integration
    runs-on: ubuntu-latest
    timeout-minutes: 2
    steps:
      - name: Require central action policy preflight
        if: ${{ github.server_url == 'https://github.com' }}
        env:
          ACTION_POLICY_RESULT: ${{ needs.action-policy.result }}
        run: test "$ACTION_POLICY_RESULT" = success
      - name: Require every supported Python and integration cell
        env:
          AVRO_BENCHMARK_RESULT: ${{ needs.avro-benchmark.result }}
          CORPUS_RESULT: ${{ needs.regression-corpus.result }}
          INTEGRATION_RESULT: ${{ needs.integration.result }}
          LINT_RESULT: ${{ needs.lint.result }}
          PACKAGE_RESULT: ${{ needs.package.result }}
          TEST_RESULT: ${{ needs.test.result }}
        run: |
          test "$AVRO_BENCHMARK_RESULT" = success
          test "$CORPUS_RESULT" = success
          test "$INTEGRATION_RESULT" = success
          test "$LINT_RESULT" = success
          test "$PACKAGE_RESULT" = success
          test "$TEST_RESULT" = success