continuous-integration.yml

# Copyright 2026 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: Continuous Integration

# Release branches are listed alongside the development branches because a
# release is cut to its own branch and published from there, so a branch left
# out here ships without its tests ever having run.
on:
  push:
    branches: [main, v1, 'release/**']
    paths:
      - '**.py'
      - '.pre-commit-config.yaml'
      - 'pyproject.toml'
      - 'tests/**'
  pull_request:
    branches: [main, v1, 'release/**']
    paths:
      - '**.py'
      - '.pre-commit-config.yaml'
      - 'pyproject.toml'
      - 'tests/**'

permissions:
  contents: read

env:
  # Packages with no installable wheel for the runner; leaving one in fails
  # the whole sync. Nothing these jobs import reaches them, and lancedb only
  # arrives transitively through crewai[tools], whose 0.38.0 release shipped
  # no Linux x86_64 wheel. Add another as a further --no-install-package.
  SKIP_PACKAGE_FLAGS: --no-install-package lancedb

jobs:
  # 1. Code format and linting (Linter)
  lint:
    name: Pre-commit Linter
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Install the latest version of uv
        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
        with:
          enable-cache: true

      - name: Run pre-commit checks
        uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1

  # 2. Static type analysis (Mypy Check with Matrix)
  # Compares new changes against the target base branch dynamically to support v1.
  type-check:
    name: Mypy Check (Python ${{ matrix.python-version }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ['3.10', '3.11', '3.12', '3.13']
    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install uv
        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
        with:
          enable-cache: true

      - name: Set the dependency resolution cutoff
        # PyPI uploads a release's wheels one platform at a time, so resolving
        # mid-upload can select a version whose wheel for this interpreter does
        # not exist yet and fail the install. Skip the last hour of releases.
        run: echo "UV_EXCLUDE_NEWER=$(date -u -d '1 hour ago' +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_ENV"

      - name: Generate Baseline
        env:
          TARGET_BRANCH: ${{ github.base_ref || github.ref_name }}
        run: |
          # Switch to target base branch to generate baseline
          git checkout origin/$TARGET_BRANCH

          git checkout ${{ github.sha }} -- pyproject.toml

          # Install dependencies for target branch
          uv venv .venv
          source .venv/bin/activate
          uv sync --all-extras $SKIP_PACKAGE_FLAGS

          # Run mypy, filter for errors only, remove line numbers, and sort
          # We ignore exit code (|| true) because we expect errors on baseline
          uv run mypy . | grep "error:" | sed 's/:\([0-9]\+\):/::/g' | sort > baseline_errors.txt || true
          echo "Found $(wc -l < baseline_errors.txt) errors on $TARGET_BRANCH."

      - name: Check PR Branch
        run: |
          # Switch back to the PR commit
          git checkout ${{ github.sha }}

          # Re-sync dependencies in case the PR changed them
          source .venv/bin/activate
          uv sync --all-extras $SKIP_PACKAGE_FLAGS

          # Run mypy on PR code, apply same processing
          uv run mypy . | grep "error:" | sed 's/:\([0-9]\+\):/::/g' | sort > pr_errors.txt || true
          echo "Found $(wc -l < pr_errors.txt) errors on PR branch."

      - name: Compare and Fail on New Errors
        run: |
          # 'comm -13' suppresses unique lines in file1 (baseline) and common lines,
          # leaving only lines unique to file2 (PR) -> The new errors.
          comm -13 baseline_errors.txt pr_errors.txt > new_errors.txt

          if [ -s new_errors.txt ]; then
            echo "::error::The following NEW mypy errors were introduced:"
            cat new_errors.txt
            exit 1
          else
            echo "Great job! No new mypy errors introduced."
          fi

  # 3a. Unit testing (Unit Tests with Matrix)
  unit-test:
    name: Unit Tests (Python ${{ matrix.python-version }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
    timeout-minutes: 10
    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install the latest version of uv
        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
        with:
          enable-cache: true

      - name: Set the dependency resolution cutoff
        # PyPI uploads a release's wheels one platform at a time, so resolving
        # mid-upload can select a version whose wheel for this interpreter does
        # not exist yet and fail the install. Skip the last hour of releases.
        run: echo "UV_EXCLUDE_NEWER=$(date -u -d '1 hour ago' +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_ENV"

      - name: Install dependencies
        run: |
          uv venv .venv
          source .venv/bin/activate
          uv sync --extra test $SKIP_PACKAGE_FLAGS

      - name: List installed packages
        run: uv pip list

      - name: Run unit tests with pytest
        run: |
          uv run pytest tests/unittests -n auto

  # 3b. Dual-version A2A coverage: This job pins a2a-sdk to 0.3.x and
  # runs only the A2A-related tests, so the a2a/_compat.py shim stays
  # verified against both SDK majors.
  # TODO: Remove this 0.3.x re-run once a2a-sdk 0.3.x support is dropped.
  unit-test-a2a-v0-3:
    name: A2A v0.3 Tests (Python ${{ matrix.python-version }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
    timeout-minutes: 10
    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install the latest version of uv
        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
        with:
          enable-cache: true

      - name: Set the dependency resolution cutoff
        # PyPI uploads a release's wheels one platform at a time, so resolving
        # mid-upload can select a version whose wheel for this interpreter does
        # not exist yet and fail the install. Skip the last hour of releases.
        run: echo "UV_EXCLUDE_NEWER=$(date -u -d '1 hour ago' +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_ENV"

      - name: Install dependencies
        run: |
          uv venv .venv
          source .venv/bin/activate
          uv sync --extra test $SKIP_PACKAGE_FLAGS

      - name: List installed packages (before reinstall)
        run: uv pip list

      - name: Run A2A tests against a2a-sdk v0.3
        run: |
          uv pip install --reinstall-package a2a-sdk 'a2a-sdk>=0.3.4,<0.4'
          uv pip list
          uv run pytest tests/unittests/a2a \
            tests/unittests/agents/test_remote_a2a_agent.py \
            tests/unittests/integrations/agent_registry/test_agent_registry.py

  # 3c. Dual-version MCP coverage: the pin admits both SDK majors, but the lock
  # resolves 1.x, so nothing else here ever exercises 2.x. This job reinstalls
  # mcp 2.x and re-runs the MCP tests, keeping the dependencies seam verified
  # against the major it is not resolved against by default.
  # TODO: Remove this 2.x re-run once mcp 1.x support is dropped.
  unit-test-mcp-v2:
    name: MCP v2 Tests (Python ${{ matrix.python-version }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
    timeout-minutes: 10
    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install the latest version of uv
        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
        with:
          enable-cache: true

      - name: Set the dependency resolution cutoff
        # PyPI uploads a release's wheels one platform at a time, so resolving
        # mid-upload can select a version whose wheel for this interpreter does
        # not exist yet and fail the install. Skip the last hour of releases.
        run: echo "UV_EXCLUDE_NEWER=$(date -u -d '1 hour ago' +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_ENV"

      - name: Install dependencies
        run: |
          uv venv .venv
          source .venv/bin/activate
          uv sync --extra test $SKIP_PACKAGE_FLAGS

      - name: List installed packages (before reinstall)
        run: uv pip list

      - name: Run MCP tests against mcp v2
        # --no-sync, or uv re-syncs the environment to uv.lock first and puts
        # the locked 1.x back, leaving this job re-testing the major the job
        # above already covers. The version assert makes that failure loud
        # instead of a green run that proved nothing.
        run: |
          uv pip install --reinstall-package mcp 'mcp>=2,<3'
          uv pip list
          uv run --no-sync python -c "
          import importlib.metadata as m
          version = m.version('mcp')
          assert version.startswith('2.'), f'expected mcp 2.x, got {version}'
          print('testing against mcp', version)
          "
          uv run --no-sync pytest tests/unittests/tools/mcp_tool \
            tests/unittests/tools/test_load_mcp_resource_tool.py \
            tests/unittests/telemetry/test_spans.py