ci.yml

name: Continuous Integration
on:
  pull_request:
  push:
    branches:
      - main
      - "releases/*"

permissions:
  contents: read
  actions: read

env:
  COLUMNS: 120

jobs:
  # Build and test the project
  build-lint-test:
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        python: ["3.10", "3.14"]
        os: [ubuntu-latest, ubuntu-arm, macos-arm, windows-latest]
        include:
          - os: ubuntu-latest
            python: "3.14"
            docsTarget: true
            clippyLinter: true
          - python: "3.10"
            pytestExtraArgs: '--reruns 3 --only-rerun "RuntimeError: Failed validating workflow"'
          - os: ubuntu-arm
            runsOn: ubuntu-24.04-arm64-2-core
          - os: macos-arm
            runsOn: macos-latest
    runs-on: ${{ matrix.runsOn || matrix.os }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          submodules: recursive
      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          components: "clippy"
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: ${{ matrix.pythonOverride || matrix.python }}
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          workspaces: temporalio/bridge -> target
          key: ${{ env.pythonLocation }}
      - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3
        with:
          # TODO(cretz): Can upgrade proto when https://github.com/arduino/setup-protoc/issues/99 fixed
          version: "23.x"
          repo-token: ${{ secrets.GITHUB_TOKEN }}
      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8
      - run: uv tool install poethepoet
      - run: uv sync --all-extras
      - run: poe bridge-lint
        if: ${{ matrix.clippyLinter }}
      - run: poe build-develop
      - run: poe lint
      - run: mkdir junit-xml
      - run: poe test ${{matrix.pytestExtraArgs}} -s --junit-xml=junit-xml/${{ matrix.python }}--${{ matrix.os }}.xml
        timeout-minutes: 15
      - run: poe test ${{matrix.pytestExtraArgs}} -s --workflow-environment time-skipping-v2 --junit-xml=junit-xml/${{ matrix.python }}--${{ matrix.os }}--time-skipping-v2.xml
        timeout-minutes: 10
      - name: "Upload junit-xml artifacts"
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        if: always()
        with:
          name: junit-xml--${{github.run_id}}--${{github.run_attempt}}--${{ matrix.python }}--${{ matrix.os }}
          path: junit-xml
          retention-days: 14

      # Do docs stuff (only on one host)
      - name: Build API docs
        if: ${{ matrix.docsTarget }}
        run: poe gen-docs
      - name: Deploy prod API docs
        if: ${{ github.ref == 'refs/heads/main' && matrix.docsTarget }}
        env:
          VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
          VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}
        run: npx vercel deploy build/apidocs -t ${{ secrets.VERCEL_TOKEN }} --prod --yes

      # Confirm README ToC is generated properly
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
      - name: Check generated README ToC
        if: ${{ matrix.docsTarget }}
        run: |
          npx doctoc README.md
          [[ -z $(git status --porcelain README.md) ]] || (git diff README.md; echo "README changed"; exit 1)

  # Verify the optional FIPS build: the Rust core must link aws-lc-fips-sys
  # (aws-lc-rs FIPS mode) and must NOT link `ring` (the cargo-tree guard, ported
  # from sdk-ruby PR #466's `fips_tree` guard); then run the test suite against the
  # FIPS binary and build the release wheel.
  fips-build:
    timeout-minutes: 45
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          submodules: recursive
      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.10"
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          workspaces: temporalio/bridge -> target
          key: fips-${{ env.pythonLocation }}
      # aws-lc-fips-sys builds the validated AWS-LC module from source, which
      # needs Go, CMake, Perl and a C compiler (see the FIPS Compliance section
      # in the README).
      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5
        with:
          go-version: "1.24"
      - name: Verify FIPS linkage (aws-lc-fips-sys present, ring absent)
        working-directory: temporalio/bridge
        run: |
          set -uo pipefail
          # Resolve the FIPS build's dependency graph once and query it for a
          # single crate. `cargo tree -i <crate>` ("invert") prints the chain of
          # packages that pull in <crate>, or nothing if <crate> is not in the
          # graph at all. We capture that output and decide PRESENT/ABSENT by
          # whether the string is empty -- NOT by the exit code, because
          # `cargo tree -i` exits 0 either way (an absent crate just prints
          # "nothing to print" to stderr). Ported from sdk-ruby PR #466.
          links_in_fips_build() {
            cargo tree -p temporal-sdk-bridge --no-default-features --features fips -i "$1" 2>/dev/null
          }
          echo "== aws-lc-fips-sys must be PRESENT =="
          aws_lc_fips="$(links_in_fips_build aws-lc-fips-sys)"
          if [ -z "$aws_lc_fips" ]; then
            echo "ERROR: aws-lc-fips-sys is absent from the FIPS dependency tree" >&2
            exit 1
          fi
          echo "$aws_lc_fips"
          echo "== ring must be ABSENT =="
          ring="$(links_in_fips_build ring)"
          if [ -n "$ring" ]; then
            echo "ERROR: 'ring' is still linked in the FIPS build" >&2
            echo "$ring" >&2
            exit 1
          fi
          echo "FIPS linkage verified: aws-lc-fips-sys linked, ring absent."
      - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3
        with:
          version: "23.x"
          repo-token: ${{ secrets.GITHUB_TOKEN }}
      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8
      - run: uv tool install poethepoet
      - run: uv sync --all-extras
      # Develop build so the FIPS extension is importable, then run the suite
      # against it to confirm the aws-lc-rs stack works end to end (not just links).
      - run: poe build-develop-fips
      - name: Confirm the FIPS build is loaded
        run: uv run python -c "from temporalio.bridge import temporal_sdk_bridge; assert temporal_sdk_bridge.FIPS, 'not a FIPS build'"
      - run: mkdir junit-xml
      - name: Run tests against the FIPS build
        run: |
          poe test --reruns 3 --only-rerun "RuntimeError: Failed validating workflow" -s --junit-xml=junit-xml/fips.xml
        timeout-minutes: 15
      - name: "Upload junit-xml artifacts"
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        if: always()
        with:
          name: junit-xml--${{github.run_id}}--${{github.run_attempt}}--fips
          path: junit-xml
          retention-days: 14
      - name: Build FIPS wheel (proves the release feature set compiles)
        run: uv run maturin build --release --no-default-features --features fips
        env:
          TEMPORALIO_FIPS: "1"

  alpine-package-test:
    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
        include:
          - cibw-build: cp310-musllinux_x86_64
            runsOn: ubuntu-latest
          - cibw-build: cp310-musllinux_aarch64
            runsOn: ubuntu-24.04-arm64-2-core
    runs-on: ${{ matrix.runsOn }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          submodules: recursive
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.14"
      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8
      - run: uv sync --all-extras
      - name: Build Alpine wheel
        run: uv run cibuildwheel --output-dir dist
        env:
          CIBW_BUILD: ${{ matrix.cibw-build }}
      - name: Test Alpine wheel
        uses: ./.github/actions/alpine-package-smoke
        with:
          wheel-dir: dist

  check-protos:
    timeout-minutes: 30
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          submodules: recursive
      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.10"
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          workspaces: temporalio/bridge -> target
          key: ${{ env.pythonLocation }}
      - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3
        with:
          # TODO(cretz): Can upgrade proto when https://github.com/arduino/setup-protoc/issues/99 fixed
          version: "23.x"
          repo-token: ${{ secrets.GITHUB_TOKEN }}
      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8
      - run: uv tool install poethepoet
      - run: uv add --dev --python 3.10 "googleapis-common-protos==1.70.0"
      - run: uv add --python 3.10 "protobuf<4"
      - run: uv sync --all-extras
      - run: cargo install --locked nexgen --version 0.2.8 --features advanced --force
      - run: poe build-develop
      - run: poe gen-protos
      - name: Check generation unchanged
        run: |
          [[ -z $(git status --porcelain temporalio tests) ]] || (git diff temporalio tests; echo "Protos changed"; exit 1)
      - name: Test with protobuf 3.x
        run: poe test -s
        env:
          TEMPORAL_TEST_PROTO3: 1

  test-latest-deps:
    timeout-minutes: 30
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          submodules: recursive
      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          components: "clippy"
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.13"
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          workspaces: temporalio/bridge -> target
          key: ${{ env.pythonLocation }}
      - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3
        with:
          # TODO(cretz): Can upgrade proto when https://github.com/arduino/setup-protoc/issues/99 fixed
          version: "23.x"
          repo-token: ${{ secrets.GITHUB_TOKEN }}
      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8
      - run: uv tool install poethepoet
      - run: uv lock --upgrade
      - run: uv sync --all-extras
      - run: poe build-develop
      - run: poe lint
      - run: mkdir junit-xml
      - run: poe test -s --junit-xml=junit-xml/latest-deps.xml
        timeout-minutes: 15
      - name: "Upload junit-xml artifacts"
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        if: always()
        with:
          name: junit-xml--${{github.run_id}}--${{github.run_attempt}}--latest-deps--time-skipping
          path: junit-xml
          retention-days: 14

  # Run the test suite against Temporal Cloud (skipped on forks and Dependabot-triggered runs)
  cloud-test:
    if: ${{ github.actor != 'dependabot[bot]' && (github.event.pull_request.head.repo.full_name == '' || github.event.pull_request.head.repo.full_name == 'temporalio/sdk-python') }}
    timeout-minutes: 30
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          submodules: recursive
      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.14"
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          workspaces: temporalio/bridge -> target
          key: ${{ env.pythonLocation }}
      - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3
        with:
          # TODO(cretz): Can upgrade proto when https://github.com/arduino/setup-protoc/issues/99 fixed
          version: "23.x"
          repo-token: ${{ secrets.GITHUB_TOKEN }}
      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8
      - run: uv tool install poethepoet
      - run: uv sync --all-extras
      - run: poe build-develop
      - name: Generate Cloud test certificates
        run: |
          cert_dir="$RUNNER_TEMP/cloud-test-certs"
          mkdir "$cert_dir"
          openssl req -x509 -newkey rsa:2048 -nodes -days 1 \
            -keyout "$cert_dir/ca.key" -out "$cert_dir/ca.pem" \
            -subj '/CN=Temporal Python SDK Cloud CI CA'
          openssl req -newkey rsa:2048 -nodes \
            -keyout "$cert_dir/client.key" -out "$cert_dir/client.csr" \
            -subj '/CN=Temporal Python SDK Cloud CI'
          openssl x509 -req -days 1 -in "$cert_dir/client.csr" \
            -CA "$cert_dir/ca.pem" -CAkey "$cert_dir/ca.key" -CAcreateserial \
            -out "$cert_dir/client.pem" -extfile <(printf 'extendedKeyUsage=clientAuth')
          {
            echo "TEMPORAL_CLOUD_CLIENT_CA_PATH=$cert_dir/ca.pem"
            echo "TEMPORAL_TLS_CLIENT_CERT_PATH=$cert_dir/client.pem"
            echo "TEMPORAL_TLS_CLIENT_KEY_PATH=$cert_dir/client.key"
          } >> "$GITHUB_ENV"
      - name: Create Cloud namespace
        id: create-cloud-namespace
        run: uv run python .github/scripts/cloud_namespace.py create
        env:
          TEMPORAL_CLIENT_CLOUD_API_KEY: ${{ secrets.TEMPORAL_CLIENT_CLOUD_API_KEY }}
          TEMPORAL_CLIENT_CLOUD_API_VERSION: v0.19.1
      - run: mkdir junit-xml
      - run: poe test -s --workflow-environment envconfig --junit-xml=junit-xml/cloud.xml
        timeout-minutes: 15
        env:
          TEMPORAL_ADDRESS: ${{ steps.create-cloud-namespace.outputs.namespace }}.tmprl.cloud:7233
          TEMPORAL_NAMESPACE: ${{ steps.create-cloud-namespace.outputs.namespace }}
          TEMPORAL_IS_CLOUD_TESTS: true
          TEMPORAL_CLIENT_CLOUD_API_KEY: ${{ secrets.TEMPORAL_CLIENT_CLOUD_API_KEY }}
          TEMPORAL_CLIENT_CLOUD_API_VERSION: v0.19.1
          TEMPORAL_CLIENT_CLOUD_NAMESPACE: ${{ steps.create-cloud-namespace.outputs.namespace }}
      - name: Delete Cloud namespace
        if: ${{ always() && steps.create-cloud-namespace.outputs.namespace != '' }}
        run: uv run python .github/scripts/cloud_namespace.py delete "${{ steps.create-cloud-namespace.outputs.namespace }}"
        env:
          TEMPORAL_CLIENT_CLOUD_API_KEY: ${{ secrets.TEMPORAL_CLIENT_CLOUD_API_KEY }}
          TEMPORAL_CLIENT_CLOUD_API_VERSION: v0.19.1
      - name: "Upload junit-xml artifacts"
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        if: always()
        with:
          name: junit-xml--${{github.run_id}}--${{github.run_attempt}}--cloud
          path: junit-xml
          retention-days: 14

  # Runs the sdk features repo tests with this repo's current SDK code
  features-tests:
    uses: temporalio/features/.github/workflows/python.yaml@main
    with:
      python-repo-path: ${{github.event.pull_request.head.repo.full_name}}
      version: ${{github.event.pull_request.head.ref}}
      version-is-repo-ref: true

  # The single required status check for merging: a PR can merge only if every job in
  # `needs` passed.
  required-pr-checks:
    name: Required PR Checks
    # Without always(), this job would be skipped when a dependency fails, and GitHub
    # treats a skipped required check as passing.
    if: always()
    needs:
      - build-lint-test
      - check-protos
      - test-latest-deps
      - cloud-test
    runs-on: ubuntu-latest
    steps:
      - name: Fail if any check failed or was cancelled
        if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
        run: exit 1