python-ai-sdk/.github/workflows/ci.yml at main · launchdarkly/python-ai-sdk · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
name: CI

on:
  push:
    branches: [main]
  pull_request:
  # Weekly, so an advisory published against an unchanged uv.lock still gets reported.
  schedule:
    - cron: "0 13 * * 1"

permissions:
  contents: read

jobs:
  # ─── Lint & format ──────────────────────────────────────────────────────────
  lint:
    name: Lint & format
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: astral-sh/setup-uv@v7
        with:
          python-version: "3.12"
      - run: uv lock
      - run: uv sync --all-packages
      - run: uv run ruff check .
      - run: uv run ruff format --check .

  # ─── Dependency audit ───────────────────────────────────────────────────────
  audit:
    name: Dependency audit
    runs-on: ubuntu-latest
    # A new advisory must not block unrelated PRs; push and the weekly schedule still fail on it.
    continue-on-error: ${{ github.event_name == 'pull_request' }}
    steps:
      - uses: actions/checkout@v7
      - uses: astral-sh/setup-uv@v7
        with:
          python-version: "3.12"
      # Audits the committed uv.lock as-is (no `uv lock` first), so a vulnerable pin fails here.
      - run: make audit

  # ─── Setup ──────────────────────────────────────────────────────────────────
  setup:
    name: Install & sync
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: astral-sh/setup-uv@v7
        with:
          python-version: "3.12"
      - run: uv lock
      - run: uv sync --all-packages

  # ─── Type check ─────────────────────────────────────────────────────────────
  typecheck:
    name: Type check
    needs: setup
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: astral-sh/setup-uv@v7
        with:
          python-version: "3.12"
      - run: uv lock
      - run: uv sync --all-packages
      # Not bare `mypy .`: the per-package `tests/conftest.py` files collide under mypy's module
      # resolution, which aborts the run before anything is checked. `make typecheck` runs this
      # same command.
      - run: uv run mypy packages/*/src

  # ─── Test ───────────────────────────────────────────────────────────────────
  test:
    name: Tests
    needs: setup
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: astral-sh/setup-uv@v7
        with:
          python-version: "3.12"
      - run: uv lock
      - run: uv sync --all-packages
      # Not `packages/*/tests`: that glob silently skips the repo-root `tests/` directory, which
      # holds the invariants no single package can own. `make test` runs this same bare command.
      - run: uv run pytest

  # The lock pins the lowest anthropic the Claude packages allow, so `test` never sees a newer
  # one. anthropic 1.0 removed keyword arguments the handler used to pass (AIC-3735); this runs
  # the full suite, whose Claude Messages drift tests read the SDK's own signatures, on the
  # newest anthropic claude-messages allows. `uv pip install anthropic` alone ignores that
  # package's cap, so the requirement is read from its pyproject.toml, and --upgrade-package
  # upgrades anthropic only, not its dependencies.
  test-latest-anthropic:
    name: Tests (newest anthropic)
    needs: setup
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: astral-sh/setup-uv@v7
        with:
          python-version: "3.12"
      - run: uv lock
      - run: uv sync --all-packages
      - run: uv pip install --upgrade-package anthropic -r packages/claude-messages/pyproject.toml
      - run: uv run --no-sync python -c "import anthropic; print('anthropic', anthropic.__version__)"
      - run: uv run --no-sync pytest

  # ─── Build ────────────────────────────────────────────────────────────────
  build:
    name: Build all packages
    needs: [lint, typecheck, test]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: astral-sh/setup-uv@v7
        with:
          python-version: "3.12"
      - run: uv lock
      - run: uv sync --all-packages
      - name: Build all packages
        run: |
          for pkg in packages/*/; do
            echo "Building $pkg..."
            (cd "$pkg" && uv build --out-dir dist)
          done

  # ─── Packaging ──────────────────────────────────────────────────────────────
  # Installs each wheel into an empty virtualenv with its documented install
  # command, then imports its public modules and every module its source
  # imports, lazy ones included. The workspace test run cannot catch an
  # undeclared dependency, because it installs every package's at once.
  packaging:
    name: Packaging check
    needs: [lint, typecheck, test]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: astral-sh/setup-uv@v7
        with:
          python-version: "3.12"
      - run: uv lock
      - run: uv sync --all-packages
      - run: make check-packaging