python.yml

# Copyright 2026 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# SPDX-License-Identifier: Apache-2.0

name: Python Checks

on:
  pull_request:
    paths:
      - "**"
      - "genkit-tools/**"
      - ".github/workflows/python.yml"

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  lint-and-format:
    name: Lint and Format
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5

      - name: Install uv and setup Python
        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
        with:
          enable-cache: true
          python-version: "3.12"

      - name: Install dependencies
        run: |
          cd .
          uv sync --group lint

      - name: Check lockfile is up to date
        run: uv lock --check --directory .

      - name: Format check
        run: uv run --directory . ruff format --check --preview .

      - name: Lint with ruff
        run: uv run --directory . ruff check --preview .

      - name: Run consistency checks
        run: python3 ./scripts/check_consistency.py

  type-check:
    name: Type Check (${{ matrix.checker }})
    runs-on: ubuntu-latest
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        checker: [ty, pyrefly, pyright]
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends build-essential libffi-dev cmake libjpeg-dev zlib1g-dev

      - name: Install uv and setup Python
        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
        with:
          enable-cache: true
          python-version: "3.12"

      - name: Install dependencies
        run: |
          cd .
          uv sync --group lint

      - name: Generate schema typing
        run: ./bin/generate_schema_typing --ci

      - name: Type check with Ty
        if: matrix.checker == 'ty'
        run: uv run --directory . ty check .

      - name: Type check with Pyrefly
        if: matrix.checker == 'pyrefly'
        run: uv run --directory . pyrefly check

      - name: Type check with Pyright
        if: matrix.checker == 'pyright'
        run: cd . && uv run pyright packages/*/src

  security-and-compliance:
    name: Security and Compliance
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5

      - name: Install uv and setup Python
        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
        with:
          enable-cache: true
          python-version: "3.12"

      - name: Install dependencies
        run: |
          cd .
          uv sync --group lint

      - name: Check source file license headers
        run: ./bin/check_license

      - name: Check Python dependency licenses
        run: uv run --directory . liccheck -s pyproject.toml

      - name: Check for hardcoded secrets
        run: |
          cd .
          if grep -rE "(sk-[a-zA-Z0-9]{20,}|AIza[a-zA-Z0-9_-]{35}|AKIA[0-9A-Z]{16})" \
              packages/ plugins/ --include="*.py" | grep -vE "test|mock|fake|example|#"; then
            echo "Error: Potential hardcoded secrets found"
            exit 1
          fi
          echo "No hardcoded secrets detected"

  tests:
    name: Tests (Python ${{ matrix.python-version }})
    runs-on: ubuntu-latest
    permissions:
      contents: read
    strategy:
      matrix:
        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
      fail-fast: false
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y build-essential libffi-dev cmake libjpeg-dev zlib1g-dev

      - name: Install uv and setup Python
        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
        with:
          enable-cache: true
          python-version: ${{ matrix.python-version }}

      - name: Install dependencies
        run: |
          cd .
          uv sync

      - name: Generate schema typing
        run: ./bin/generate_schema_typing --ci

      - name: Run tests
        env:
          PYTHON_VERSION: ${{ matrix.python-version }}
        run: |
          uv run --python "$PYTHON_VERSION" --active --isolated --directory . \
            pytest -xvs --log-level=DEBUG .

  build:
    name: Build Distributions
    runs-on: ubuntu-latest
    permissions:
      contents: read
    if: ${{ always() && !failure() && !cancelled() }}
    needs: [lint-and-format, type-check, security-and-compliance, tests]
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5

      - name: Install uv
        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
        with:
          enable-cache: true
          python-version: "3.12"

      - name: Build and verify distributions
        run: ./bin/build_dists

      - name: Verify wheel contents
        run: |
          cd .
          for wheel in dist/*.whl; do
            if [[ -f "$wheel" ]]; then
              wheel_name=$(basename "$wheel" | sed 's/-[0-9].*//')
              if [[ "$wheel_name" == "genkit" ]] || [[ "$wheel_name" == genkit_plugin_* ]]; then
                echo "Checking $wheel_name..."
                if ! unzip -l "$wheel" 2>/dev/null | grep -qE "py\.typed$"; then
                  echo "Warning: $wheel_name missing py.typed"
                fi
                if ! unzip -l "$wheel" 2>/dev/null | grep -qE "(LICENSE|licenses/LICENSE)"; then
                  echo "Warning: $wheel_name missing LICENSE"
                fi
              fi
            fi
          done

      - name: Upload distributions
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: python-distributions
          path: dist/
          retention-days: 7