ms-agent-framework-mongodb/.github/workflows/python-quality.yml at main · mongodb-developer/ms-agent-framework-mongodb · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
name: Python quality

on:
  pull_request:
    paths:
      - "python/**"
      - "scripts/scan_credentials.py"
      - ".github/workflows/python-quality.yml"
      - ".github/workflows/release-python.yml"
      - ".github/workflows/python-agent-framework-compatibility.yml"
  push:
    paths:
      - "python/**"
      - "scripts/scan_credentials.py"
      - ".github/workflows/python-quality.yml"
      - ".github/workflows/release-python.yml"
      - ".github/workflows/python-agent-framework-compatibility.yml"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: python-quality-${{ github.ref }}
  cancel-in-progress: true

jobs:
  version-readiness:
    if: >-
      ${{
        (github.event_name == 'pull_request' &&
         github.base_ref == 'build/python-packaging-release') ||
        (github.event_name == 'push' &&
         github.ref == 'refs/heads/build/python-packaging-release') ||
        github.event_name == 'workflow_dispatch'
      }}
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # actions/checkout v4.4.0
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # actions/setup-python v5
        with:
          python-version: "3.10"
          cache: pip
          cache-dependency-path: python/pyproject.toml
      - name: Validate canonical manifest version and tag
        id: version
        working-directory: python
        run: |
          python -m pip install --disable-pip-version-check "packaging>=24,<26"
          python scripts/validate_version_readiness.py \
            --pyproject pyproject.toml --baseline api-baseline.json
      - name: Reject a conflicting remote release tag
        env:
          RELEASE_TAG: ${{ steps.version.outputs.tag }}
        run: |
          remote_sha="$(git ls-remote --tags origin "refs/tags/$RELEASE_TAG^{}" | cut -f1)"
          if [ -z "$remote_sha" ]; then
            remote_sha="$(git ls-remote --tags origin "refs/tags/$RELEASE_TAG" | cut -f1)"
          fi
          test -z "$remote_sha" || test "$remote_sha" = "$GITHUB_SHA"
      - name: Build and validate manifest metadata
        working-directory: python
        run: |
          python -m pip install --disable-pip-version-check "build>=1.2,<2" "twine>=6.1,<7"
          python -m build --outdir dist/readiness
          python -m twine check dist/readiness/*.whl dist/readiness/*.tar.gz
          python scripts/verify_artifacts.py \
            dist/readiness/*.whl dist/readiness/*.tar.gz

  quality:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    defaults:
      run:
        working-directory: python
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # actions/checkout v4.4.0
        with:
          persist-credentials: false
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # actions/setup-python v5
        with:
          python-version: "3.10"
          cache: pip
          cache-dependency-path: python/pyproject.toml
      - name: Install package and quality tools
        run: python -m pip install --disable-pip-version-check -e ".[dev]"
      - name: Run tests with coverage
        run: python -m pytest --cov=agent_framework_mongodb --cov-report=term -q
      - name: Run Ruff
        run: |
          python -m ruff check src tests samples scripts ../scripts/scan_credentials.py
          python -m ruff format --check src tests samples scripts ../scripts/scan_credentials.py
      - name: Run MyPy
        run: python -m mypy
      - name: Run Pyright
        run: python -m pyright
      - name: Build and validate distributions
        run: |
          rm -rf build dist
          python -m build
          python -m twine check dist/*.whl dist/*.tar.gz
          python scripts/verify_artifacts.py dist/*.whl dist/*.tar.gz
          python scripts/check_api_baseline.py api-baseline.json
      - name: Smoke test exact wheel
        run: |
          python -m venv .artifact-smoke-wheel
          .artifact-smoke-wheel/bin/python -m pip install --disable-pip-version-check --no-cache-dir dist/*.whl
          .artifact-smoke-wheel/bin/python scripts/smoke_public_api.py
          .artifact-smoke-wheel/bin/python -m pydoc agent_framework_mongodb > /dev/null
      - name: Smoke test exact source distribution
        run: |
          python -m venv .artifact-smoke-sdist
          .artifact-smoke-sdist/bin/python -m pip install --disable-pip-version-check --no-cache-dir dist/*.tar.gz
          .artifact-smoke-sdist/bin/python scripts/smoke_public_api.py
      - name: Resolve minimum supported dependencies
        run: |
          python -m venv .dependency-minimum
          .dependency-minimum/bin/python -m pip install --disable-pip-version-check \
            "agent-framework-core==1.13.0" \
            "opentelemetry-api==1.39.0" \
            "pymongo==4.13.0"
          .dependency-minimum/bin/python -m pip install --disable-pip-version-check --no-deps dist/*.whl
          .dependency-minimum/bin/python scripts/smoke_public_api.py
          .dependency-minimum/bin/python -m pip freeze
      - name: Resolve newest allowed dependencies
        run: |
          python -m venv .dependency-latest
          .dependency-latest/bin/python -m pip install --disable-pip-version-check \
            --upgrade --upgrade-strategy eager dist/*.whl
          .dependency-latest/bin/python scripts/smoke_public_api.py
          .dependency-latest/bin/python -m pip freeze
      - name: Generate CycloneDX SBOM
        run: |
          python -m pip install --disable-pip-version-check "pip-audit==2.10.1"
          .artifact-smoke-wheel/bin/python -m pip install --disable-pip-version-check \
            --upgrade pip setuptools
          pip-audit --path .artifact-smoke-wheel/lib/python3.10/site-packages \
            --format cyclonedx-json \
            --output dist/agent-framework-mongodb.sbom.cdx.json
      - name: Record artifact checksums
        run: |
          sha256sum dist/* > dist/SHA256SUMS
          python scripts/verify_artifacts.py --supplemental dist/*.sbom.cdx.json dist/SHA256SUMS
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # actions/upload-artifact v4.6.2
        with:
          name: python-package-${{ github.sha }}
          path: python/dist/
          if-no-files-found: error
          retention-days: 14