ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  # A run that claims conformance must not skip the corpus.
  VERIFIED_CONFORMANCE_REQUIRED: "1"

jobs:
  lint:
    name: Lint and types
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: true
      # The toolchain is the one rust/rust-toolchain.toml pins. rustup,
      # preinstalled on the runners, installs it; it is made the default
      # because the extension is built from the repository root.
      - name: Install the pinned Rust toolchain
        working-directory: rust
        shell: bash
        run: |
          rustup show active-toolchain || rustup toolchain install
          rustup default "$(rustup show active-toolchain | cut -d' ' -f1)"
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          workspaces: rust
      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
      - run: uv sync --python 3.11 --group adapters
      - run: uv run ruff format --check .
      - run: uv run ruff check .
      - run: uv run mypy
      - run: cargo fmt --check
        working-directory: rust
      - run: cargo clippy --locked -- -D warnings
        working-directory: rust

  test:
    name: Tests (${{ matrix.os }}, Python ${{ matrix.python }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        python: ["3.11", "3.14"]
        include:
          - os: ubuntu-latest
            python: "3.12"
          - os: ubuntu-latest
            python: "3.13"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: true
      # The toolchain is the one rust/rust-toolchain.toml pins. rustup,
      # preinstalled on the runners, installs it; it is made the default
      # because the extension is built from the repository root.
      - name: Install the pinned Rust toolchain
        working-directory: rust
        shell: bash
        run: |
          rustup show active-toolchain || rustup toolchain install
          rustup default "$(rustup show active-toolchain | cut -d' ' -f1)"
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          workspaces: rust
      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
      - run: uv sync --python ${{ matrix.python }}
      # The core suite, with no optional framework installed.
      - run: uv run pytest

  adapters:
    name: Framework adapters
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: true
      # The toolchain is the one rust/rust-toolchain.toml pins. rustup,
      # preinstalled on the runners, installs it; it is made the default
      # because the extension is built from the repository root.
      - name: Install the pinned Rust toolchain
        working-directory: rust
        shell: bash
        run: |
          rustup show active-toolchain || rustup toolchain install
          rustup default "$(rustup show active-toolchain | cut -d' ' -f1)"
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          workspaces: rust
      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
      - run: uv sync --python 3.12 --group adapters
      - run: uv run pytest tests/integration -m "openai_agents or langgraph"

  dependencies:
    name: Dependency and license policy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1
        with:
          manifest-path: rust/Cargo.toml
          command: check
          rust-version: "1.99.0"

  notices:
    name: Third-party notices match Cargo.lock
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install the pinned Rust toolchain
        working-directory: rust
        run: rustup show active-toolchain || rustup toolchain install
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          workspaces: rust
      - run: cargo install cargo-about --version 0.9.2 --features cli --locked
      # Every wheel carries these texts. The file is generated, offline, from
      # the crates rust/Cargo.lock names; a change of dependencies
      # regenerates it in the same pull request.
      - run: cargo fetch --locked
        working-directory: rust
      - run: cargo about generate --frozen --fail about.hbs -o "$RUNNER_TEMP/notices.md"
        working-directory: rust
      - name: The committed file is current
        run: |
          diff -u THIRD-PARTY-LICENSES.md "$RUNNER_TEMP/notices.md" || {
            echo "::error::THIRD-PARTY-LICENSES.md is out of date: in rust/, run cargo about generate --frozen --fail about.hbs -o ../THIRD-PARTY-LICENSES.md"
            exit 1
          }

  wheels:
    name: Wheel (${{ matrix.target }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - { os: ubuntu-latest, target: x86_64, manylinux: auto }
          - { os: ubuntu-latest, target: aarch64, manylinux: auto }
          - { os: ubuntu-latest, target: x86_64, manylinux: musllinux_1_2 }
          - { os: macos-latest, target: aarch64 }
          # Cross-built on the arm64 runner: the Intel runner images are retired.
          - { os: macos-latest, target: x86_64 }
          - { os: windows-latest, target: x64 }
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.11"
      - uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          target: ${{ matrix.target }}
          manylinux: ${{ matrix.manylinux || 'auto' }}
          rust-toolchain: "1.99.0"
          args: --release --locked --out dist
      - name: The wheel carries the third-party notices
        shell: bash
        run: python -m zipfile -l dist/*.whl | grep -q "licenses/THIRD-PARTY-LICENSES.md"
      - name: Install the wheel and verify a package with it
        # Only where the wheel matches the runner: cross-built wheels cannot be installed here.
        if: runner.os == 'Windows' || (runner.os == 'macOS' && matrix.target == 'aarch64') || (runner.os == 'Linux' && matrix.target == 'x86_64' && matrix.manylinux == 'auto')
        shell: bash
        run: |
          python -m venv smoke
          if [ -x smoke/bin/python ]; then PY=smoke/bin/python; else PY=smoke/Scripts/python.exe; fi
          $PY -m pip install --no-index --find-links dist verified-python
          $PY examples/standalone-verification/verify_packages.py
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: wheel-${{ matrix.os }}-${{ matrix.target }}-${{ matrix.manylinux || 'native' }}
          path: dist

  sdist:
    name: Source distribution
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          command: sdist
          args: --out dist
      # The toolchain is the one rust/rust-toolchain.toml pins. rustup,
      # preinstalled on the runners, installs it; it is made the default
      # because the extension is built from the repository root.
      - name: Install the pinned Rust toolchain
        working-directory: rust
        shell: bash
        run: |
          rustup show active-toolchain || rustup toolchain install
          rustup default "$(rustup show active-toolchain | cut -d' ' -f1)"
      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
      - name: Build and import from the sdist
        run: |
          uv venv --python 3.11 from-sdist
          uv pip install --python from-sdist/bin/python dist/*.tar.gz
          from-sdist/bin/python examples/standalone-verification/verify_packages.py
      - run: uvx twine check dist/*
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: sdist
          path: dist