ci.yml

name: Continuous Integration
permissions:
  contents: read
  actions: write
on: # rebuild any PRs and main branch changes
  pull_request:
  push:
    branches:
      - main
      - "releases/*"

jobs:
  detect-standalone-changes:
    name: Detect standalone sample changes
    runs-on: ubuntu-latest
    outputs:
      projects: ${{ steps.changes.outputs.projects }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
      - name: Build standalone project matrix
        id: changes
        shell: bash
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
        run: |
          if [[ -n "$BASE_SHA" ]] && git cat-file -e "$BASE_SHA^{commit}"; then
            changed_files="$(git diff --name-only "$BASE_SHA" "$GITHUB_SHA")"
          else
            changed_files="$(git ls-files)"
          fi

          projects_json="$({
            for project in \
              bedrock_agentcore/strands_agent \
              lambda_worker \
              openai_agents/mcp_v2
            do
              if grep -q "^${project}/" <<< "$changed_files"; then
                printf '%s\n' "$project"
              fi
            done
          } | jq -Rsc 'split("\n") | map(select(length > 0))')"

          echo "projects=$projects_json" >> "$GITHUB_OUTPUT"

  standalone-lint-test:
    name: Standalone (${{ matrix.project }}, Python ${{ matrix.python }})
    needs: detect-standalone-changes
    if: needs.detect-standalone-changes.outputs.projects != '[]'
    strategy:
      fail-fast: false
      matrix:
        python: ["3.10", "3.14"]
        project: ${{ fromJSON(needs.detect-standalone-changes.outputs.projects) }}
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
          python-version: ${{ matrix.python }}
      - run: uv sync --locked --all-groups
        working-directory: ${{ matrix.project }}
      - run: uv run poe lint
        working-directory: ${{ matrix.project }}
      - run: uv run poe test
        working-directory: ${{ matrix.project }}

  # Build and test the project
  build-lint-test:
    strategy:
      fail-fast: true
      matrix:
        python: ["3.10", "3.14"]
        os: [ubuntu-latest, macos-intel, macos-arm, windows-latest]
        include:
          - os: macos-intel
            runsOn: macos-15-intel
          - os: macos-arm
            runsOn: macos-latest
    runs-on: ${{ matrix.runsOn || matrix.os }}
    # Normal matrix jobs finish in 7-14 minutes; without an explicit limit a
    # hung test run burns GitHub's 6-hour default before failing.
    timeout-minutes: 30
    steps:
      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8
      - name: Print build information
        run: "echo head_ref: ${{ github.head_ref }}, ref: ${{ github.ref }}, os: ${{ matrix.os }}, python: ${{ matrix.python }}"
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          submodules: recursive
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
          python-version: ${{ matrix.python }}
      # protoc is needed whenever uv builds temporalio from a git source
      # (e.g. when [tool.uv.sources] pins a branch while a feature is in
      # development). Kept on by default so we don't have to add and remove
      # this step every time we iterate on a new plugin.
      - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3
        with:
          version: "23.x"
          repo-token: ${{ secrets.GITHUB_TOKEN }}
      - run: uv tool install poethepoet
      - run: uv sync --group=dsl --group=encryption --group=trio-async
      - run: poe lint
      - run: mkdir junit-xml
      - run: poe test -s --junit-xml=junit-xml/${{ matrix.python }}--${{ matrix.os }}.xml
      - run: poe test -s --workflow-environment time-skipping --junit-xml=junit-xml/${{ matrix.python }}--${{ matrix.os }}--time-skipping.xml
      # This must remain the last step since it downgrades pydantic
      - name: Uninstall pydantic
        shell: bash
        run: |
          echo y | uv run pip uninstall pydantic
          echo y | uv run pip uninstall pydantic-core
          uv run pip install pydantic==1.10
          poe test -s --junit-xml=junit-xml/${{ matrix.python }}--${{ matrix.os }}--pydantic-v1.xml tests/pydantic_converter_v1/workflow_test.py

      # On latest, run gevent test
      - name: Gevent test
        if: ${{ matrix.python == '3.12' }}
        run: |
          uv sync --group gevent
          uv run gevent_async/test/run_combined.py

      - name: Upload junit-xml artifacts
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
        if: always()
        with:
          name: junit-xml--${{github.run_id}}--${{github.run_attempt}}--${{ matrix.python }}--${{ matrix.os }}
          path: junit-xml
          retention-days: 14