ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:
    inputs:
      server_commit:
        description: Exact public Server candidate SHA, or empty for its default branch
        type: string
        default: ""
      cooperative_qualification:
        description: Qualify the candidate cooperative protocol 1.20
        type: boolean
        default: false
      native_commit:
        description: Optional exact public Native source overlay SHA for candidate qualification
        type: string
        default: ""

permissions:
  contents: read

concurrency:
  group: ci-${{ github.event_name }}-${{ github.event_name == 'pull_request' && github.ref || github.sha }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  action-policy:
    name: Central action policy preflight
    if: ${{ github.server_url == 'https://github.com' }}
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Check out candidate source
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
        with:
          persist-credentials: false
      - name: Check out central action policy
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
        with:
          repository: durable-workflow/.github
          ref: main
          path: .central-action-policy
          persist-credentials: false
      - name: Set up Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: "3.13"
      - name: Install policy dependencies
        run: python -m pip install PyYAML==6.0.2
      - name: Require centrally approved immutable action commits
        run: >-
          python .central-action-policy/scripts/qualification_policy.py validate
          --policy .central-action-policy/qualification/policy.json
          --target sdk-python
          --workflow-directory .github/workflows

  regression-corpus:
    name: Regression corpus
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: "3.12"
      - name: Install the SDK
        run: pip install -e .
      - name: Require durable replay and codec evidence
        env:
          CORPUS_BASE_REF: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
        run: |
          arguments=()
          if [[ "$CORPUS_BASE_REF" =~ ^[0-9a-f]{40}$ ]] && [[ ! "$CORPUS_BASE_REF" =~ ^0+$ ]]; then
            arguments+=(--base-ref "$CORPUS_BASE_REF")
          fi
          python scripts/ci/validate-regression-corpus.py "${arguments[@]}"
      - name: Test regression corpus policy guards
        run: python scripts/ci/test-validate-regression-corpus.py

  lint:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: "3.12"
      - run: pip install -e '.[dev]'
      - run: ruff check src/ tests/
      - run: mypy src/durable_workflow/
      - name: Enforce load-calibrated Avro Value regression budget
        run: python benchmarks/avro_value.py --enforce

  avro-benchmark:
    name: Avro Value absolute throughput (advisory)
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: "3.12"
      - run: pip install -e .
      - name: Measure the bounded absolute throughput signal
        continue-on-error: true
        run: >-
          python benchmarks/avro_value.py --enforce-absolute
          --output avro-value-benchmark.json
      - name: Publish the measured sample summary
        if: ${{ always() && github.server_url == 'https://github.com' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
        with:
          name: avro-value-benchmark-${{ github.sha }}
          path: avro-value-benchmark.json
          if-no-files-found: error

  test:
    name: Python ${{ matrix.python-version }}
    runs-on: ubuntu-latest
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.11", "3.12"]
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: ${{ matrix.python-version }}
      - run: pip install -e '.[dev]'
      - run: pytest tests/ -m "not integration" -q

  package:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
        with:
          fetch-depth: 0
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: "3.12"
      - run: pip install build twine
      - run: python -m build
      - name: Compare built release metadata with the exact source commit
        run: python scripts/check_release_metadata.py --source-ref "$(git rev-parse HEAD)" --dist dist
      - run: twine check dist/*
      - run: python scripts/smoke-built-package.py

  integration:
    runs-on: ubuntu-latest
    timeout-minutes: 25
    needs: [lint, test]
    env:
      DURABLE_WORKFLOW_WORKER_PROTOCOL_VERSION: ${{ inputs.cooperative_qualification && '1.20' || '1.19' }}
      DURABLE_WORKFLOW_COOPERATIVE_QUALIFICATION: ${{ inputs.cooperative_qualification && '1' || '0' }}
      DURABLE_WORKFLOW_NATIVE_SOURCE: ${{ github.workspace }}/native
      COMPOSE_FILE: docker-compose.test.yml
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
        with:
          path: sdk-python
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: "3.12"
      - name: Check out public Server integration source
        env:
          SERVER_COMMIT: ${{ inputs.server_commit }}
        run: python sdk-python/scripts/ci/checkout-public-repository.py server server --commit "$SERVER_COMMIT"
      - name: Require exact cooperative candidate identities
        env:
          COOPERATIVE_REQUESTED: ${{ inputs.cooperative_qualification }}
          SERVER_COMMIT: ${{ inputs.server_commit }}
          NATIVE_COMMIT: ${{ inputs.native_commit }}
        run: |
          if [ "$COOPERATIVE_REQUESTED" = true ]; then
            [[ "$SERVER_COMMIT" =~ ^[0-9a-f]{40}$ ]]
          fi
          if [ -n "$NATIVE_COMMIT" ]; then
            test "$COOPERATIVE_REQUESTED" = true
            [[ "$NATIVE_COMMIT" =~ ^[0-9a-f]{40}$ ]]
          fi
      - name: Check out optional exact public Native source
        if: ${{ inputs.native_commit != '' }}
        env:
          NATIVE_COMMIT: ${{ inputs.native_commit }}
        run: python sdk-python/scripts/ci/checkout-public-repository.py workflow native --commit "$NATIVE_COMMIT"
      - name: Select readonly Native source qualification
        if: ${{ inputs.native_commit != '' }}
        run: |
          printf 'COMPOSE_FILE=docker-compose.test.yml:docker-compose.native-cancellation.yml\n' >> "$GITHUB_ENV"
          printf 'DURABLE_WORKFLOW_NATIVE_SOURCE_QUALIFICATION=1\n' >> "$GITHUB_ENV"
      - run: pip install -e '.[dev]'
        working-directory: sdk-python
      - name: Configure isolated Docker project
        working-directory: sdk-python
        run: python scripts/ci/configure-compose-project.py
      - name: Start Server stack
        working-directory: sdk-python
        run: |
          docker compose --project-name "$COMPOSE_PROJECT_NAME" \
            up -d --build --wait --timeout 300
      - name: Retain exact source and published image authority
        working-directory: sdk-python
        env:
          NATIVE_COMMIT: ${{ inputs.native_commit }}
        run: |
          docker compose exec -T server cat /app/.package-provenance > integration-package-provenance.txt
          docker compose images --format json > integration-images.json
          jq --null-input --arg sdk "$GITHUB_SHA" --arg server "$(git -C ../server rev-parse HEAD)" --arg native "$NATIVE_COMMIT" \
            '{qualification:"source",sdk_commit:$sdk,server_commit:$server,native_source_overlay:($native | if length > 0 then . else null end)}' \
            > integration-source-provenance.json
      - name: Select and probe integration endpoint
        working-directory: sdk-python
        run: python scripts/ci/configure-integration-endpoint.py
      - name: Run integration tests
        shell: bash
        working-directory: sdk-python
        env:
          DURABLE_WORKFLOW_AUTH_TOKEN: test-token
        run: pytest tests/integration/ -v --capture=tee-sys --junitxml=integration-results.xml 2>&1 | tee integration-scenarios.log
      - name: Retain connected scenario results
        if: ${{ always() && github.server_url == 'https://github.com' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
        with:
          name: connected-integration-${{ github.sha }}
          path: |
            sdk-python/integration-results.xml
            sdk-python/integration-scenarios.log
            sdk-python/integration-source-provenance.json
            sdk-python/integration-package-provenance.txt
            sdk-python/integration-images.json
          if-no-files-found: warn
          retention-days: ${{ inputs.cooperative_qualification && 90 || 7 }}
      - name: Emit integration diagnostics
        if: failure()
        working-directory: sdk-python
        run: |
          for service in bootstrap server worker repair; do
            echo "::group::$service logs"
            docker compose --project-name "$COMPOSE_PROJECT_NAME" \
              logs --no-color --tail 200 "$service" || true
            echo "::endgroup::"
          done
      - name: Teardown
        if: always()
        working-directory: sdk-python
        run: |
          docker compose --project-name "$COMPOSE_PROJECT_NAME" \
            down -v --rmi local

  target-branch-qualification:
    name: Target branch qualification
    if: ${{ always() }}
    needs:
      - action-policy
      - regression-corpus
      - lint
      - avro-benchmark
      - test
      - package
      - integration
    runs-on: ubuntu-latest
    timeout-minutes: 2
    steps:
      - name: Require central action policy preflight
        if: ${{ github.server_url == 'https://github.com' }}
        env:
          ACTION_POLICY_RESULT: ${{ needs.action-policy.result }}
        run: test "$ACTION_POLICY_RESULT" = success
      - name: Require every supported Python and integration cell
        env:
          AVRO_BENCHMARK_RESULT: ${{ needs.avro-benchmark.result }}
          CORPUS_RESULT: ${{ needs.regression-corpus.result }}
          INTEGRATION_RESULT: ${{ needs.integration.result }}
          LINT_RESULT: ${{ needs.lint.result }}
          PACKAGE_RESULT: ${{ needs.package.result }}
          TEST_RESULT: ${{ needs.test.result }}
        run: |
          test "$AVRO_BENCHMARK_RESULT" = success
          test "$CORPUS_RESULT" = success
          test "$INTEGRATION_RESULT" = success
          test "$LINT_RESULT" = success
          test "$PACKAGE_RESULT" = success
          test "$TEST_RESULT" = success