ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:
    inputs:
      server_commit:
        description: Exact public Server candidate SHA, or empty for its default branch
        type: string
        default: ""
      cooperative_qualification:
        description: Qualify the candidate cooperative protocol 1.20
        type: boolean
        default: false
      native_commit:
        description: Optional exact public Native source overlay SHA for candidate qualification
        type: string
        default: ""
      published_activity_acceptance:
        description: Run the reviewed published SDK/Server activity identity tuple
        type: boolean
        default: false
      published_timer_redrive:
        description: Run the reviewed published SDK/native timer-redrive tuple
        type: boolean
        default: false
      activity_retry_cap:
        description: Run the reviewed installed scalar local retry-cap case
        type: boolean
        default: false
      retry_cap_artifact_source:
        description: Select the approved build candidate or its identical registry wheel
        type: choice
        options: [candidate, registry]
        default: candidate

permissions:
  contents: read

concurrency:
  group: ci-${{ github.event_name }}-${{ github.event_name == 'pull_request' && github.ref || github.sha }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  activity-retry-cap:
    if: github.event_name == 'workflow_dispatch' && inputs.activity_retry_cap
    needs: [action-policy, lint]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      actions: read
    env:
      RETRY_CAP_ARTIFACT_SOURCE: ${{ inputs.retry_cap_artifact_source }}
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
        with:
          persist-credentials: false
          fetch-depth: 0
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: "3.12.16"
      - name: Resolve the exact approved build candidate
        if: inputs.retry_cap_artifact_source == 'candidate'
        id: retry-candidate
        env:
          GH_TOKEN: ${{ github.token }}
        run: python .github/scripts/promote_release.py resolve --version 2.18.0
      - name: Download the approved candidate handoff
        if: inputs.retry_cap_artifact_source == 'candidate'
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8
        with:
          artifact-ids: ${{ steps.retry-candidate.outputs.artifact-id }}
          run-id: ${{ steps.retry-candidate.outputs.run-id }}
          github-token: ${{ github.token }}
          repository: ${{ github.repository }}
          path: .release-candidate
          archive: false
      - name: Verify candidate archive and distribution bytes
        if: inputs.retry_cap_artifact_source == 'candidate'
        run: python .github/scripts/promote_release.py extract --version 2.18.0
      - name: Bootstrap patched pip trust
        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7  # clean-trust
        with:
          clients: pip,python
      - name: Run the approved scalar local retry case
        run: >-
          python scripts/ci/published-activity-acceptance.py
          --scenario retry-cap --artifact-source "$RETRY_CAP_ARTIFACT_SOURCE"
      - name: Retain exact package and retry evidence
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
        with:
          name: activity-retry-cap-${{ github.sha }}
          path: published-activity-results/
          retention-days: 7
  published-timer-redrive:
    if: github.event_name == 'workflow_dispatch' && inputs.published_timer_redrive
    needs: [action-policy, lint]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
        with:
          persist-credentials: false
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: "3.12.16"
      - name: Bootstrap patched pip trust
        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7  # clean-trust
        with:
          clients: pip,python
      - name: Run the published cold Worker timer-redrive case
        run: python scripts/ci/published-activity-acceptance.py --scenario timer-redrive
      - name: Retain published tuple and scenario evidence
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
        with:
          name: published-timer-redrive-${{ github.sha }}
          path: published-activity-results/
          retention-days: 7
  published-activity-acceptance:
    if: github.event_name == 'workflow_dispatch' && inputs.published_activity_acceptance
    needs: [action-policy, lint]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
        with:
          persist-credentials: false
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: "3.12.16"
      - name: Bootstrap patched pip trust
        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7  # clean-trust
        with:
          clients: pip,python
      - name: Run the published activity identity case
        run: python scripts/ci/published-activity-acceptance.py
      - name: Retain published tuple and scenario evidence
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
        with:
          name: published-activity-acceptance-${{ github.sha }}
          path: published-activity-results/
          retention-days: 7
  action-policy:
    name: Central action policy preflight
    if: ${{ github.server_url == 'https://github.com' }}
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Check out candidate source
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
        with:
          persist-credentials: false
      - name: Check out central action policy
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
        with:
          repository: durable-workflow/.github
          ref: main
          path: .central-action-policy
          persist-credentials: false
      - name: Set up Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: "3.13"
      - name: Bootstrap patched pip trust
        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7  # clean-trust
      - name: Install policy dependencies
        run: >-
          python -m pip install --only-binary :all: PyYAML==6.0.2
      - name: Require centrally approved immutable action commits
        run: >-
          python .central-action-policy/scripts/qualification_policy.py validate
          --policy .central-action-policy/qualification/policy.json
          --target sdk-python
          --workflow-directory .github/workflows

  regression-corpus:
    name: Regression corpus
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: "3.12"
      - name: Bootstrap patched pip trust
        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7  # clean-trust
        with:
          clients: pip,python
      - name: Install the SDK
        run: pip install -e .
      - name: Require durable replay and codec evidence
        env:
          CORPUS_BASE_REF: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
        run: |
          arguments=()
          if [[ "$CORPUS_BASE_REF" =~ ^[0-9a-f]{40}$ ]] && [[ ! "$CORPUS_BASE_REF" =~ ^0+$ ]]; then
            arguments+=(--base-ref "$CORPUS_BASE_REF")
          fi
          python scripts/ci/validate-regression-corpus.py "${arguments[@]}"
      - name: Test regression corpus policy guards
        run: python scripts/ci/test-validate-regression-corpus.py

  lint:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: "3.12"
      - name: Bootstrap patched pip trust
        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7  # clean-trust
        with:
          clients: pip,python
      - run: pip install -e '.[dev]'
      - run: >-
          ruff check src/ tests/ scripts/ci/activity_acceptance_*.py
          scripts/ci/verify_activity_install.py scripts/ci/published-activity-acceptance.py
      - run: mypy src/durable_workflow/
      - name: Enforce load-calibrated Avro Value regression budget
        run: python benchmarks/avro_value.py --enforce

  avro-benchmark:
    name: Avro Value absolute throughput (advisory)
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: "3.12"
      - name: Bootstrap patched pip trust
        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7  # clean-trust
        with:
          clients: pip,python
      - run: pip install -e .
      - name: Measure the bounded absolute throughput signal
        continue-on-error: true
        run: >-
          python benchmarks/avro_value.py --enforce-absolute
          --output avro-value-benchmark.json
      - name: Publish the measured sample summary
        if: ${{ always() && github.server_url == 'https://github.com' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
        with:
          name: avro-value-benchmark-${{ github.sha }}
          path: avro-value-benchmark.json
          if-no-files-found: error

  test:
    name: Python ${{ matrix.python-version }}
    runs-on: ubuntu-latest
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14", "3.15"]
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: ${{ matrix.python-version }}
      - name: Bootstrap patched pip trust
        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7  # clean-trust
        with:
          clients: pip,python
      - run: pip install -e '.[dev,prometheus]'
      - name: Run unit tests with stalled-thread diagnostics
        id: unit_tests
        shell: bash
        run: |
          set -o pipefail
          command -v openssl
          # Leave room within the 15-minute job for bounded failure diagnostics.
          timeout --signal=INT --kill-after=10s 13m \
            pytest tests/ -m "not integration" -vv \
            -o faulthandler_timeout=120 --durations=20 \
            2>&1 | tee "$RUNNER_TEMP/sdk-unit-tests.log"
      - name: Attach bounded failure diagnostics to the check
        if: ${{ always() && steps.unit_tests.outcome == 'failure' }}
        shell: bash
        run: |
          if [[ -f "$RUNNER_TEMP/sdk-unit-tests.log" ]]; then
            # Check annotations truncate at 4096 bytes; keep the final summary.
            phase_unit_tail="$(tail -c 3000 "$RUNNER_TEMP/sdk-unit-tests.log")"
            phase_unit_tail="${phase_unit_tail//'%'/'%25'}"
            phase_unit_tail="${phase_unit_tail//$'\r'/'%0D'}"
            phase_unit_tail="${phase_unit_tail//$'\n'/'%0A'}"
            printf '::error title=Unit-test failure diagnostics::%s\n' "$phase_unit_tail"
          fi

  package:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
        with:
          fetch-depth: 0
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: "3.12"
      - name: Bootstrap patched pip trust
        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7  # clean-trust
        with:
          clients: pip,python
      - run: >-
          pip install --only-binary :all: build==1.6.1 twine==7.0.0
      - run: python -m build
      - name: Compare built release metadata with the exact source commit
        run: python scripts/check_release_metadata.py --source-ref "$(git rev-parse HEAD)" --dist dist
      - run: twine check dist/*
      - run: python scripts/smoke-built-package.py

  integration:
    runs-on: ubuntu-latest
    timeout-minutes: 25
    needs: [lint]
    env:
      DURABLE_WORKFLOW_COOPERATIVE_QUALIFICATION: ${{ inputs.cooperative_qualification && '1' || '0' }}
      DURABLE_WORKFLOW_NATIVE_SOURCE: ${{ github.workspace }}/native
      COMPOSE_FILE: docker-compose.test.yml
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
        with:
          path: sdk-python
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: "3.12"
      - name: Check out public Server integration source
        env:
          SERVER_COMMIT: ${{ inputs.server_commit }}
        run: python sdk-python/scripts/ci/checkout-public-repository.py server server --commit "$SERVER_COMMIT"
      - name: Require exact cooperative candidate identities
        env:
          COOPERATIVE_REQUESTED: ${{ inputs.cooperative_qualification }}
          SERVER_COMMIT: ${{ inputs.server_commit }}
          NATIVE_COMMIT: ${{ inputs.native_commit }}
        run: |
          if [ "$COOPERATIVE_REQUESTED" = true ]; then
            [[ "$SERVER_COMMIT" =~ ^[0-9a-f]{40}$ ]]
          fi
          if [ -n "$NATIVE_COMMIT" ]; then
            test "$COOPERATIVE_REQUESTED" = true
            [[ "$NATIVE_COMMIT" =~ ^[0-9a-f]{40}$ ]]
          fi
      - name: Check out optional exact public Native source
        if: ${{ inputs.native_commit != '' }}
        env:
          NATIVE_COMMIT: ${{ inputs.native_commit }}
        run: python sdk-python/scripts/ci/checkout-public-repository.py workflow native --commit "$NATIVE_COMMIT"
      - name: Select readonly Native source qualification
        if: ${{ inputs.native_commit != '' }}
        run: |
          printf 'COMPOSE_FILE=docker-compose.test.yml:docker-compose.native-cancellation.yml\n' >> "$GITHUB_ENV"
          printf 'DURABLE_WORKFLOW_NATIVE_SOURCE_QUALIFICATION=1\n' >> "$GITHUB_ENV"
      - name: Bootstrap patched pip trust
        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7  # clean-trust
        with:
          clients: pip,python
      - run: pip install -e '.[dev]'
        working-directory: sdk-python
      - name: Configure isolated Docker project
        working-directory: sdk-python
        run: python scripts/ci/configure-compose-project.py
      - name: Start Server stack
        working-directory: sdk-python
        run: |
          docker compose --project-name "$COMPOSE_PROJECT_NAME" \
            up -d --build --wait --timeout 300
      - name: Retain exact source and published image authority
        working-directory: sdk-python
        env:
          NATIVE_COMMIT: ${{ inputs.native_commit }}
        run: |
          docker compose exec -T server cat /app/.package-provenance > integration-package-provenance.txt
          docker compose images --format json > integration-images.json
          jq --null-input --arg sdk "$GITHUB_SHA" --arg server "$(git -C ../server rev-parse HEAD)" --arg native "$NATIVE_COMMIT" \
            '{qualification:"source",sdk_commit:$sdk,server_commit:$server,native_source_overlay:($native | if length > 0 then . else null end)}' \
            > integration-source-provenance.json
      - name: Select and probe integration endpoint
        working-directory: sdk-python
        run: python scripts/ci/configure-integration-endpoint.py
      - name: Run integration tests
        id: integration_tests
        shell: bash
        working-directory: sdk-python
        env:
          DURABLE_WORKFLOW_AUTH_TOKEN: test-token
        run: pytest tests/integration/ -v --capture=tee-sys --junitxml=integration-results.xml 2>&1 | tee integration-scenarios.log
      - name: Report bounded integration failure identities
        if: ${{ always() && steps.integration_tests.outcome == 'failure' }}
        working-directory: sdk-python
        run: |
          python - <<'PY'
          from pathlib import Path
          import re
          import xml.etree.ElementTree as ET

          report = Path("integration-results.xml")
          if not report.is_file():
              print("::error title=Integration diagnostics::JUnit report unavailable")
              raise SystemExit(0)
          failed = 0
          for case in ET.parse(report).getroot().iter("testcase"):
              if case.find("failure") is None and case.find("error") is None:
                  continue
              failed += 1
              if failed > 20:
                  continue
              identity = case.get("classname", "") + "." + case.get("name", "").partition("[")[0]
              if len(identity) > 256 or re.fullmatch(r"[A-Za-z0-9_.]+", identity) is None:
                  identity = "unidentified_integration_case"
              print(f"::error title=Integration test failure::{identity}")
          print(f"::notice title=Integration summary::failed_test_cases={failed}")
          PY
      - name: Retain connected scenario results
        if: ${{ always() && github.server_url == 'https://github.com' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
        with:
          name: connected-integration-${{ github.sha }}
          path: |
            sdk-python/integration-results.xml
            sdk-python/integration-scenarios.log
            sdk-python/integration-source-provenance.json
            sdk-python/integration-package-provenance.txt
            sdk-python/integration-images.json
          if-no-files-found: warn
          retention-days: ${{ inputs.cooperative_qualification && 90 || 7 }}
      - name: Emit integration diagnostics
        if: failure()
        working-directory: sdk-python
        run: |
          for service in bootstrap server worker repair; do
            echo "::group::$service logs"
            docker compose --project-name "$COMPOSE_PROJECT_NAME" \
              logs --no-color --tail 200 "$service" || true
            echo "::endgroup::"
          done
      - name: Teardown
        if: always()
        working-directory: sdk-python
        run: |
          docker compose --project-name "$COMPOSE_PROJECT_NAME" \
            down -v --rmi local

  target-branch-qualification:
    name: Target branch qualification
    if: ${{ always() }}
    needs:
      - action-policy
      - regression-corpus
      - lint
      - avro-benchmark
      - test
      - package
      - integration
    runs-on: ubuntu-latest
    timeout-minutes: 2
    steps:
      - name: Require central action policy preflight
        if: ${{ github.server_url == 'https://github.com' }}
        env:
          ACTION_POLICY_RESULT: ${{ needs.action-policy.result }}
        run: test "$ACTION_POLICY_RESULT" = success
      - name: Require every supported Python and integration cell
        env:
          AVRO_BENCHMARK_RESULT: ${{ needs.avro-benchmark.result }}
          CORPUS_RESULT: ${{ needs.regression-corpus.result }}
          INTEGRATION_RESULT: ${{ needs.integration.result }}
          LINT_RESULT: ${{ needs.lint.result }}
          PACKAGE_RESULT: ${{ needs.package.result }}
          TEST_RESULT: ${{ needs.test.result }}
        run: |
          test "$AVRO_BENCHMARK_RESULT" = success
          test "$CORPUS_RESULT" = success
          test "$INTEGRATION_RESULT" = success
          test "$LINT_RESULT" = success
          test "$PACKAGE_RESULT" = success
          test "$TEST_RESULT" = success