ci.yml

name: Continuous Integration
on:
  pull_request:
  push:
    branches:
      - main
      - "releases/*"

permissions:
  contents: read
  actions: read

env:
  COLUMNS: 120

jobs:
  # Build and test the project
  build-lint-test:
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        python: ["3.10", "3.14"]
        os: [ubuntu-latest, ubuntu-arm, macos-intel, macos-arm, windows-latest]
        include:
          - os: ubuntu-latest
            python: "3.14"
            docsTarget: true
            openaiTestTarget: true
            clippyLinter: true
          - python: "3.10"
            pytestExtraArgs: "--reruns 3 --only-rerun \"RuntimeError: Failed validating workflow\""
          - os: ubuntu-arm
            runsOn: ubuntu-24.04-arm64-2-core
          - os: macos-intel
            runsOn: macos-15-intel
          - os: macos-arm
            runsOn: macos-latest
    runs-on: ${{ matrix.runsOn || matrix.os }}
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: "clippy"
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: temporalio/bridge -> target
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.pythonOverride || matrix.python }}
      - uses: arduino/setup-protoc@v3
        with:
          # TODO(cretz): Can upgrade proto when https://github.com/arduino/setup-protoc/issues/99 fixed
          version: "23.x"
          repo-token: ${{ secrets.GITHUB_TOKEN }}
      - uses: astral-sh/setup-uv@v5
      - run: uv tool install poethepoet
      - run: uv sync --all-extras
      - run: poe bridge-lint
        if: ${{ matrix.clippyLinter }}
      - run: poe build-develop
      - run: poe lint
      - run: mkdir junit-xml
      - run: poe test ${{matrix.pytestExtraArgs}} -s --junit-xml=junit-xml/${{ matrix.python }}--${{ matrix.os }}.xml
        timeout-minutes: 15
      # Time skipping doesn't yet support ARM
      - if: ${{ !endsWith(matrix.os, '-arm') }}
        run: poe test ${{matrix.pytestExtraArgs}} -s --workflow-environment time-skipping --junit-xml=junit-xml/${{ matrix.python }}--${{ matrix.os }}--time-skipping.xml
        timeout-minutes: 10
      - if: ${{ matrix.openaiTestTarget && (github.event.pull_request.head.repo.full_name == '' || github.event.pull_request.head.repo.full_name == 'temporalio/sdk-python') }}
        run: poe test tests/contrib/openai_agents/test_openai.py ${{matrix.pytestExtraArgs}} -s  --junit-xml=junit-xml/${{ matrix.python }}--${{ matrix.os }}--openai.xml
        timeout-minutes: 10
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
      - name: "Upload junit-xml artifacts"
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: junit-xml--${{github.run_id}}--${{github.run_attempt}}--${{ matrix.python }}--${{ matrix.os }}
          path: junit-xml
          retention-days: 14

      # Do docs stuff (only on one host)
      - name: Build API docs
        if: ${{ matrix.docsTarget }}
        run: poe gen-docs
      - name: Deploy prod API docs
        if: ${{ github.ref == 'refs/heads/main' && matrix.docsTarget }}
        env:
          VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
          VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}
        run: npx vercel deploy build/apidocs -t ${{ secrets.VERCEL_TOKEN }} --prod --yes

      # Confirm README ToC is generated properly
      - uses: actions/setup-node@v4
      - name: Check generated README ToC
        if: ${{ matrix.docsTarget }}
        run: |
          npx doctoc README.md
          [[ -z $(git status --porcelain README.md) ]] || (git diff README.md; echo "README changed"; exit 1)

  check-protos:
    timeout-minutes: 30
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: temporalio/bridge -> target
      - uses: actions/setup-python@v5
        with:
          python-version: "3.10"
      - uses: arduino/setup-protoc@v3
        with:
          # TODO(cretz): Can upgrade proto when https://github.com/arduino/setup-protoc/issues/99 fixed
          version: "23.x"
          repo-token: ${{ secrets.GITHUB_TOKEN }}
      - uses: astral-sh/setup-uv@v5
      - run: uv tool install poethepoet
      - run: uv remove google-adk --optional google-adk
      - run: uv add --python 3.10 "protobuf<4"
      - run: uv sync --all-extras
      - run: poe build-develop
      - run: poe gen-protos
      - name: Check generation unchanged
        run: |
          [[ -z $(git status --porcelain temporalio) ]] || (git diff temporalio; echo "Protos changed"; exit 1)
      - name: Test with protobuf 3.x
        run: poe test -s --ignore=tests/contrib/google_adk_agents/
        env:
          TEMPORAL_TEST_PROTO3: 1

  test-latest-deps:
    timeout-minutes: 30
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: "clippy"
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: temporalio/bridge -> target
      - uses: actions/setup-python@v5
        with:
          python-version: "3.13"
      - uses: arduino/setup-protoc@v3
        with:
          # TODO(cretz): Can upgrade proto when https://github.com/arduino/setup-protoc/issues/99 fixed
          version: "23.x"
          repo-token: ${{ secrets.GITHUB_TOKEN }}
      - uses: astral-sh/setup-uv@v5
      - run: uv tool install poethepoet
      - run: uv lock --upgrade
      - run: uv sync --all-extras
      - run: poe build-develop
      - run: poe lint
      - run: mkdir junit-xml
      - run: poe test -s --junit-xml=junit-xml/latest-deps.xml
        timeout-minutes: 15
      - name: "Upload junit-xml artifacts"
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: junit-xml--${{github.run_id}}--${{github.run_attempt}}--latest-deps--time-skipping
          path: junit-xml
          retention-days: 14

  # Run tests against Temporal Cloud (skipped on forks)
  cloud-test:
    if: ${{ github.event.pull_request.head.repo.full_name == '' || github.event.pull_request.head.repo.full_name == 'temporalio/sdk-python' }}
    timeout-minutes: 15
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: temporalio/bridge -> target
      - uses: actions/setup-python@v5
        with:
          python-version: "3.14"
      - uses: arduino/setup-protoc@v3
        with:
          # TODO(cretz): Can upgrade proto when https://github.com/arduino/setup-protoc/issues/99 fixed
          version: "23.x"
          repo-token: ${{ secrets.GITHUB_TOKEN }}
      - uses: astral-sh/setup-uv@v5
      - run: uv tool install poethepoet
      - run: uv sync --all-extras
      - run: poe build-develop
      - run: poe test -s tests/test_cloud.py --junit-xml=junit-xml/cloud.xml
        timeout-minutes: 10
        env:
          TEMPORAL_IS_CLOUD_TESTS: true
          TEMPORAL_CLIENT_CLOUD_API_KEY: ${{ secrets.TEMPORAL_CLIENT_CLOUD_API_KEY }}
          TEMPORAL_CLIENT_CLOUD_API_VERSION: 2024-05-13-00
          TEMPORAL_CLIENT_CLOUD_NAMESPACE: sdk-ci.a2dd6
          TEMPORAL_CLIENT_CLOUD_TARGET: sdk-ci.a2dd6.tmprl.cloud:7233
          TEMPORAL_CLIENT_CERT: ${{ secrets.TEMPORAL_CLIENT_CERT }}
          TEMPORAL_CLIENT_KEY: ${{ secrets.TEMPORAL_CLIENT_KEY }}
      - name: "Upload junit-xml artifacts"
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: junit-xml--${{github.run_id}}--${{github.run_attempt}}--cloud
          path: junit-xml
          retention-days: 14

  # Runs the sdk features repo tests with this repo's current SDK code
  features-tests:
    uses: temporalio/features/.github/workflows/python.yaml@main
    with:
      python-repo-path: ${{github.event.pull_request.head.repo.full_name}}
      version: ${{github.event.pull_request.head.ref}}
      version-is-repo-ref: true