Repository navigation
chore(deps): bump requests from 2.32.5 to 2.33.0 (#157) #912
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| branches: | |
| - main | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| gitleaks: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| fetch-depth: 0 | |
| # The gitleaks GitHub Action requires a paid licence for organisation-owned | |
| # repositories. The CLI is free, so install and run it directly. Secret | |
| # scanning is a CI gate only — there is no make target for it. | |
| - name: Install gitleaks | |
| run: | | |
| set -euo pipefail | |
| curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \ | |
| | tar -xz -C /usr/local/bin gitleaks | |
| env: | |
| GITLEAKS_VERSION: 8.29.0 | |
| - name: Run Gitleaks | |
| run: gitleaks detect --source . --config .gitleaks.toml | |
| ci: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| python-version: ["3.11", "3.12", "3.13"] | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Setup uv | |
| uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| enable-cache: true | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 | |
| - name: Setup Node | |
| uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| - name: Install Python dependencies | |
| run: uv sync --all-extras --locked | |
| - name: Install Node dependencies (MCP mock server) | |
| run: pnpm install --frozen-lockfile | |
| # Run the tools directly rather than through make: the make targets write | |
| # to the tree, and CI must verify what was committed, not fix it. | |
| - name: Run Lint | |
| run: | | |
| uv run ruff check . | |
| uv run ruff format --check . | |
| - name: Run Ty | |
| run: uv run ty check stackone_ai | |
| - name: Type check examples against the current SDK | |
| run: uv run ty check examples | |
| - name: Run Tests | |
| run: uv run pytest | |
| # Enforces the wire contract in docs/SDK-UCA-CONTRACT.md. | |
| # StackOneHQ/sdk-conformance is private and requires CONFORMANCE_REPO_TOKEN. | |
| # Fork PRs and Dependabot runs cannot access this secret and skip this gate; | |
| # internal branches and PRs require the secret and fail if it is absent or expired. | |
| check-secret: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| can-skip: ${{ steps.check.outputs.can-skip }} | |
| steps: | |
| - id: check | |
| env: | |
| TOKEN: ${{ secrets.CONFORMANCE_REPO_TOKEN }} | |
| IS_FORK: ${{ github.event.pull_request.head.repo.fork == true }} | |
| IS_DEPENDABOT: ${{ github.actor == 'dependabot[bot]' }} | |
| run: | | |
| if [ -z "$TOKEN" ] && { [ "$IS_FORK" = "true" ] || [ "$IS_DEPENDABOT" = "true" ]; }; then | |
| echo "can-skip=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "can-skip=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| # Runs the full suite, both SDKs side by side, so a change here that the Node SDK does not | |
| # match fails here rather than drifting. | |
| conformance: | |
| needs: check-secret | |
| if: needs.check-secret.outputs.can-skip != 'true' | |
| runs-on: ubuntu-latest | |
| env: | |
| # Pinned to a commit on stackone-ai-node's main, not the branch, so a Node change never | |
| # silently changes what this job grades. Bump it deliberately. | |
| NODE_SDK_REF: 099fd1e3405f8a56125f9691e20ccd1333dda12f | |
| steps: | |
| - name: Check conformance token is configured | |
| env: | |
| TOKEN: ${{ secrets.CONFORMANCE_REPO_TOKEN }} | |
| run: | | |
| if [ -z "$TOKEN" ]; then | |
| echo "::error::CONFORMANCE_REPO_TOKEN is not set or has expired." | |
| exit 1 | |
| fi | |
| - name: Checkout SDK | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| path: sdk | |
| - name: Checkout conformance suite | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| repository: StackOneHQ/sdk-conformance | |
| ref: 4ead1c25bb443ef1fd1986d5f053b2d1475d0e90 | |
| token: ${{ secrets.CONFORMANCE_REPO_TOKEN }} | |
| path: sdk-conformance | |
| persist-credentials: false | |
| # Public, so no token. | |
| - name: Checkout Node SDK | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| repository: StackOneHQ/stackone-ai-node | |
| ref: ${{ env.NODE_SDK_REF }} | |
| path: stackone-ai-node | |
| persist-credentials: false | |
| # tests/test_shared_vectors.py grades the SDK against this copy; it must be the | |
| # pinned commit's vectors/ byte for byte. Refresh with scripts/sync_vectors.sh. | |
| - name: Vendored vectors match the pinned sdk-conformance | |
| run: diff -r sdk/tests/vectors sdk-conformance/vectors | |
| - name: Setup uv | |
| uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 | |
| with: | |
| python-version: "3.13" | |
| enable-cache: true | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 | |
| # pnpm from sdk-conformance's packageManager; in each SDK checkout pnpm switches to that | |
| # repo's own packageManager version, so one setup serves all three installs. | |
| with: | |
| package_json_file: sdk-conformance/package.json | |
| # 24, not 22: the Node SDK's devEngines pins Node ^24.11.0, and the suite runs on it too. | |
| - name: Setup Node | |
| uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 | |
| with: | |
| node-version: 24 | |
| - name: Install Node SDK dependencies | |
| working-directory: stackone-ai-node | |
| run: pnpm install --frozen-lockfile | |
| # The runner imports the built dist, not src, so the harness grades the publishable | |
| # artifact. It refuses a dist older than src. | |
| - name: Build Node SDK | |
| working-directory: stackone-ai-node | |
| run: pnpm run build | |
| - name: Install conformance dependencies | |
| working-directory: sdk-conformance | |
| run: pnpm install --frozen-lockfile | |
| - name: Run conformance suite | |
| working-directory: sdk-conformance | |
| env: | |
| NODE_SDK_DIST: ${{ github.workspace }}/stackone-ai-node/dist/index.mjs | |
| PYTHON_SDK_DIR: ${{ github.workspace }}/sdk | |
| run: pnpm test -- --strict-schema | |
| # Make this the one required status check. Individually required checks go | |
| # missing when a job is renamed or a matrix entry is added, and nothing notices. | |
| ci-ok: | |
| if: always() | |
| needs: [check-secret, gitleaks, ci, conformance] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Require every job to have passed | |
| run: | | |
| if [ "${{ needs.gitleaks.result != 'success' || needs.ci.result != 'success' }}" = "true" ]; then | |
| echo "::error::A required job did not pass (gitleaks: ${{ needs.gitleaks.result }}, ci: ${{ needs.ci.result }})" | |
| exit 1 | |
| fi | |
| if [ "${{ needs.conformance.result != 'success' && needs.check-secret.outputs.can-skip != 'true' }}" = "true" ]; then | |
| echo "::error::Conformance check did not pass (result: ${{ needs.conformance.result }})" | |
| exit 1 | |
| fi | |
| coverage: | |
| runs-on: ubuntu-latest | |
| if: github.ref == 'refs/heads/main' | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Setup uv | |
| uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 | |
| with: | |
| python-version: "3.13" | |
| enable-cache: true | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 | |
| - name: Setup Node | |
| uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| - name: Install Python dependencies | |
| run: uv sync --all-extras --locked | |
| - name: Install Node dependencies (MCP mock server) | |
| run: pnpm install --frozen-lockfile | |
| - name: Run Tests with Coverage | |
| run: uv run pytest --cov --cov-report=term --cov-report=json --cov-report=html | |
| - name: Create Coverage Badge | |
| uses: jaywcjlove/coverage-badges-cli@998665f7962b1a3935ba8c3e786171a99436e5d1 # v2.3.0 | |
| with: | |
| source: coverage/coverage.json | |
| output: coverage/badges.svg | |
| jsonPath: totals.percent_covered | |
| - name: Upload coverage artifact | |
| uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 | |
| with: | |
| path: coverage/ | |
| deploy-coverage: | |
| needs: coverage | |
| runs-on: ubuntu-latest | |
| if: github.ref == 'refs/heads/main' | |
| permissions: | |
| pages: write | |
| id-token: write | |
| environment: | |
| name: github-pages | |
| url: ${{ steps.deployment.outputs.page_url }} | |
| steps: | |
| - name: Deploy to GitHub Pages | |
| id: deployment | |
| uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1 |