ci.yml

name: CI - Build, Test, and Publish SDKs

permissions:
  contents: read

# This workflow builds, tests, and publishes Python SDK packages
# - Builds and tests run on all branches (main, release/*)
# - Publishing to package repository ONLY happens on release/* branches
# - Development versions (with 'dev' suffix) are created on all non-tagged commits
# - Official releases (without 'dev' suffix) require a Git tag on a release/* branch

on:
  push:
    branches: [ main, "release/*" ]
  pull_request:
    branches: [ main, "release/*" ]

jobs:
  version-number:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout repository
      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
      with:
        fetch-depth: 0  # Need full history for git versioning

    - name: Set up Python
      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
      with:
        python-version: '3.11'

    - name: Install setuptools-git-versioning
      run: |
        python -m pip install --upgrade pip
        python -m pip install setuptools-git-versioning

    - id: package_version
      name: Calculate Package Version
      run: |
        cd ./versioning
        version=$(python -m setuptools_git_versioning)
        echo "Package version calculated: $version"
        echo "PACKAGE_VERSION=$version" >> $GITHUB_OUTPUT

    outputs:
      PACKAGE_VERSION: ${{ steps.package_version.outputs.PACKAGE_VERSION }}
  
  changed-sdks:
    name: Determine Changed SDKs
    runs-on: ubuntu-latest
    outputs:
      python-sdk: ${{ steps.check_python_sdk.outputs.changed }}
    steps:
    - name: Checkout repository
      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
      with:
        fetch-depth: 0

    - id: git_refs
      name: Set Git refs for diff
      run: |
          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
            echo "base=${{ github.event.pull_request.base.sha }}" >> "$GITHUB_OUTPUT"
            echo "head=${{ github.event.pull_request.head.sha }}" >> "$GITHUB_OUTPUT"
          else
            echo "base=${{ github.event.before }}" >> "$GITHUB_OUTPUT"
            echo "head=${{ github.sha }}" >> "$GITHUB_OUTPUT"
          fi

    - id: check_python_sdk
      name: Check Python SDK changes
      run: |
        if git diff --name-only "${{ steps.git_refs.outputs.base }}" "${{ steps.git_refs.outputs.head }}" -- 'libraries/**' 'setup.py' 'pyproject.toml' 'uv.lock' 'versioning/**' 'scripts/verify_release_artifacts.py' '.github/workflows/ci.yml' | grep -q .; then
          echo "Python SDK changes detected"
          echo "changed=true" >> $GITHUB_OUTPUT
        else
          echo "No Python SDK changes detected"
          echo "changed=false" >> $GITHUB_OUTPUT
        fi

  python-sdk:
    name: Python SDK
    needs: [version-number, changed-sdks]
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ./
    env:
      PYTHONPATH: ${{ github.workspace }}/versioning/helper

    strategy:
      matrix:
        python-version: ['3.11', '3.12']

    steps:
    - name: Checkout repository
      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

    - name: Install the latest version of uv and set the python version
      uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
      with:
        version: '0.6.x'
        python-version: ${{ matrix.python-version }}
        working-directory: ./
        enable-cache: true
        cache-dependency-glob: "./pyproject.toml"
    
    - name: Install the project
      run: uv sync --locked --all-extras --dev

    - name: Verify centralized version constraints
      run: uv run --frozen tox -e verify-constraints

    - name: Check linting
      run: uv run --frozen tox -e lint

    - name: Check formatting
      run: uv run --frozen tox -e format

    - name: Build package
      run: |
        build_dir=$(mktemp -d "$RUNNER_TEMP/agent365-wheels.XXXXXX")
        echo "SDK_DIST_DIR=$build_dir" >> "$GITHUB_ENV"
        uv build --all-packages --wheel --out-dir "$build_dir"
        uv run --frozen --no-sync python scripts/verify_release_artifacts.py "$build_dir" --version "$AGENT365_PYTHON_SDK_PACKAGE_VERSION"
      env:
        AGENT365_PYTHON_SDK_PACKAGE_VERSION: ${{ needs.version-number.outputs.PACKAGE_VERSION }}

    - name: Run unit tests
      run: uv run --frozen tox -e py3${{ matrix.python-version == '3.11' && '11' || '12' }}

    # Copy package and samples to drop folder
    - name: Copy package and samples to drop folder
      run: |
        drop_dir=$(mktemp -d "$RUNNER_TEMP/agent365-drop.XXXXXX")
        echo "SDK_DROP_DIR=$drop_dir" >> "$GITHUB_ENV"
        mkdir "$drop_dir/dist"
        cp -v "$SDK_DIST_DIR"/*.whl "$drop_dir/dist/"

    # Zip files since upload-artifact does not seem like to like folders
    - name: Create zip
      run: cd "$SDK_DROP_DIR" && zip -r "$SDK_DROP_DIR.zip" .

    - name: Upload package and samples as artifacts
      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
      with:
        name: python-${{ matrix.python-version }}
        path: ${{ env.SDK_DROP_DIR }}.zip

  publish:
    name: Publish verified packages
    needs: [version-number, changed-sdks, python-sdk]
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/heads/release/') && needs.changed-sdks.outputs.python-sdk == 'true'
    runs-on: ubuntu-latest
    env:
      PYTHONPATH: ${{ github.workspace }}/versioning/helper

    steps:
    - name: Checkout repository
      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

    - name: Set up uv and Python
      uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
      with:
        version: '0.6.x'
        python-version: '3.11'

    - name: Install locked release tools
      run: uv sync --locked --all-extras --dev

    - name: Create fresh artifact directory
      run: |
        download_dir=$(mktemp -d "$RUNNER_TEMP/agent365-download.XXXXXX")
        echo "SDK_ARTIFACT_DIR=$download_dir" >> "$GITHUB_ENV"

    - name: Download verified Python 3.11 artifact
      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
      with:
        name: python-3.11
        path: ${{ env.SDK_ARTIFACT_DIR }}

    - name: Extract release wheels
      run: |
        publish_dir=$(mktemp -d "$RUNNER_TEMP/agent365-publish.XXXXXX")
        unzip -q "$SDK_ARTIFACT_DIR"/*.zip -d "$publish_dir"
        echo "SDK_DIST_DIR=$publish_dir/dist" >> "$GITHUB_ENV"

    - name: Publish
      run: |
        : "${TWINE_REPOSITORY_URL:?Set the AGENT365_PACKAGE_REPOSITORY_URL repository variable to the approved upload endpoint}"
        uv run --frozen --no-sync python scripts/verify_release_artifacts.py "$SDK_DIST_DIR" --version "${{ needs.version-number.outputs.PACKAGE_VERSION }}"
        uv run --frozen --no-sync twine upload --non-interactive --repository-url "$TWINE_REPOSITORY_URL" "$SDK_DIST_DIR"/*.whl
      env:
        TWINE_REPOSITORY_URL: ${{ vars.AGENT365_PACKAGE_REPOSITORY_URL }}
        TWINE_USERNAME: __token__
        TWINE_PASSWORD: ${{ secrets.AZURE_DEVOPS_TOKEN }}