python-package.yml

# Build verification + unit tests for the msal Python package.
#
# This workflow runs on every PR (against any target branch) to give contributors
# fast feedback that the package still builds and that the unit tests pass across
# all supported Python versions.
#
# Post-merge validation on dev, E2E tests, benchmarks, SDL scans, and PyPI
# publishing are NOT run here. Those run in the ADO pipelines:
#   - azure-pipelines.yml             (PRs + pushes to dev: unit + E2E + SDL)
#   - .Pipelines/pipeline-publish.yml (manual release to TestPyPI / PyPI)

name: Build and Unit Tests

on:
  pull_request:
    # No `branches` filter — run on PRs against any target branch.

jobs:
  build:
    name: Build package (sdist + wheel)
    permissions:
      contents: read
    runs-on: ubuntu-22.04
    steps:
    - uses: actions/checkout@v4
    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: '3.12'
        cache: 'pip'
    - name: Install build tooling
      run: |
        python -m pip install --upgrade pip
        python -m pip install build twine
    - name: Build sdist and wheel
      run: python -m build --sdist --wheel --outdir dist/ .
    - name: Verify built artifacts
      # `twine check` catches broken long_description / metadata that would fail PyPI upload.
      run: twine check dist/*
    - name: Upload built artifacts
      uses: actions/upload-artifact@v4
      with:
        name: dist
        path: dist/
        retention-days: 7

  ci:
    name: Unit tests Python ${{ matrix.python-version }}
    permissions:
      contents: read

    runs-on: ubuntu-22.04
    strategy:
      fail-fast: false
      matrix:
        python-version: ['3.9', '3.10', '3.11', '3.12', '3.13', '3.14']

    steps:
    - uses: actions/checkout@v4
    - name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@v5
      # It automatically takes care of pip cache, according to
      # https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#about-caching-workflow-dependencies
      with:
        python-version: ${{ matrix.python-version }}
        cache: 'pip'

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        python -m pip install pytest
        if [ -f requirements.txt ]; then pip install -r requirements.txt; fi

    - name: Run unit tests
      # Skip benchmarks and E2E tests — those require lab credentials and run in ADO.
      run: |
        pytest tests/ \
          --benchmark-skip \
          --ignore=tests/test_e2e.py \
          --ignore=tests/test_e2e_manual.py \
          --ignore=tests/test_fmi_e2e.py