chore(main): release stackone-ai 3.0.0 #723
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| branches: | |
| - main | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| gitleaks: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| fetch-depth: 0 | |
| # The gitleaks GitHub Action requires a paid licence for organisation-owned | |
| # repositories. The CLI is free, so install and run it directly. Secret | |
| # scanning is a CI gate only — there is no make target for it. | |
| - name: Install gitleaks | |
| run: | | |
| set -euo pipefail | |
| curl -sSfL "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/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \ | |
| | tar -xz -C /usr/local/bin gitleaks | |
| env: | |
| GITLEAKS_VERSION: 8.29.0 | |
| - name: Run Gitleaks | |
| run: gitleaks detect --source . --config .gitleaks.toml | |
| ci: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| python-version: ["3.11", "3.12", "3.13"] | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Setup uv | |
| uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| enable-cache: true | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 | |
| - name: Setup Node | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| - name: Install Python dependencies | |
| run: uv sync --all-extras --locked | |
| - name: Install Node dependencies (MCP mock server) | |
| run: pnpm install --frozen-lockfile | |
| # Run the tools directly rather than through make: the make targets write | |
| # to the tree, and CI must verify what was committed, not fix it. | |
| - name: Run Lint | |
| run: | | |
| uv run ruff check . | |
| uv run ruff format --check . | |
| - name: Run Ty | |
| run: uv run ty check stackone_ai | |
| - name: Type check examples against the current SDK | |
| run: uv run ty check examples | |
| - name: Run Tests | |
| run: uv run pytest | |
| # Enforces the wire contract in docs/SDK-UCA-CONTRACT.md. | |
| # StackOneHQ/sdk-conformance is private and requires CONFORMANCE_REPO_TOKEN. | |
| # Fork PRs and Dependabot runs cannot access this secret and skip this gate; | |
| # internal branches and PRs require the secret and fail if it is absent or expired. | |
| check-secret: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| can-skip: ${{ steps.check.outputs.can-skip }} | |
| steps: | |
| - id: check | |
| env: | |
| TOKEN: ${{ secrets.CONFORMANCE_REPO_TOKEN }} | |
| IS_FORK: ${{ github.event.pull_request.head.repo.fork == true }} | |
| IS_DEPENDABOT: ${{ github.actor == 'dependabot[bot]' }} | |
| run: | | |
| if [ -z "$TOKEN" ] && { [ "$IS_FORK" = "true" ] || [ "$IS_DEPENDABOT" = "true" ]; }; then | |
| echo "can-skip=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "can-skip=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| conformance: | |
| needs: check-secret | |
| if: needs.check-secret.outputs.can-skip != 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check conformance token is configured | |
| env: | |
| TOKEN: ${{ secrets.CONFORMANCE_REPO_TOKEN }} | |
| run: | | |
| if [ -z "$TOKEN" ]; then | |
| echo "::error::CONFORMANCE_REPO_TOKEN is not set or has expired." | |
| exit 1 | |
| fi | |
| - name: Checkout SDK | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| path: sdk | |
| - name: Checkout conformance suite | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| repository: StackOneHQ/sdk-conformance | |
| ref: 7e3b471ac947c9dd743ff6d47ad535afd5804a86 | |
| token: ${{ secrets.CONFORMANCE_REPO_TOKEN }} | |
| path: sdk-conformance | |
| persist-credentials: false | |
| - name: Setup uv | |
| uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 | |
| with: | |
| python-version: "3.13" | |
| enable-cache: true | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 | |
| with: | |
| version: 10.26.0 | |
| package_json_file: sdk-conformance/package.json | |
| - name: Setup Node | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 22 | |
| - name: Install conformance dependencies | |
| working-directory: sdk-conformance | |
| run: pnpm install --frozen-lockfile | |
| - name: Run conformance suite | |
| working-directory: sdk-conformance | |
| env: | |
| PYTHON_SDK_DIR: ${{ github.workspace }}/sdk | |
| run: pnpm test:python -- --strict-schema | |
| # Make this the one required status check. Individually required checks go | |
| # missing when a job is renamed or a matrix entry is added, and nothing notices. | |
| ci-ok: | |
| if: always() | |
| needs: [check-secret, gitleaks, ci, conformance] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Require every job to have passed | |
| run: | | |
| if [ "${{ needs.gitleaks.result != 'success' || needs.ci.result != 'success' }}" = "true" ]; then | |
| echo "::error::A required job did not pass (gitleaks: ${{ needs.gitleaks.result }}, ci: ${{ needs.ci.result }})" | |
| exit 1 | |
| fi | |
| if [ "${{ needs.conformance.result != 'success' && needs.check-secret.outputs.can-skip != 'true' }}" = "true" ]; then | |
| echo "::error::Conformance check did not pass (result: ${{ needs.conformance.result }})" | |
| exit 1 | |
| fi | |
| coverage: | |
| runs-on: ubuntu-latest | |
| if: github.ref == 'refs/heads/main' | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Setup uv | |
| uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 | |
| with: | |
| python-version: "3.13" | |
| enable-cache: true | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 | |
| - name: Setup Node | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| - name: Install Python dependencies | |
| run: uv sync --all-extras --locked | |
| - name: Install Node dependencies (MCP mock server) | |
| run: pnpm install --frozen-lockfile | |
| - name: Run Tests with Coverage | |
| run: uv run pytest --cov --cov-report=term --cov-report=json --cov-report=html | |
| - name: Create Coverage Badge | |
| uses: jaywcjlove/coverage-badges-cli@4e8975aa2628e3329126e7eee36724d07ed86fda # v2.2.0 | |
| with: | |
| source: coverage/coverage.json | |
| output: coverage/badges.svg | |
| jsonPath: totals.percent_covered | |
| - name: Upload coverage artifact | |
| uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v3.0.2 | |
| with: | |
| path: coverage/ | |
| deploy-coverage: | |
| needs: coverage | |
| runs-on: ubuntu-latest | |
| if: github.ref == 'refs/heads/main' | |
| permissions: | |
| pages: write | |
| id-token: write | |
| environment: | |
| name: github-pages | |
| url: ${{ steps.deployment.outputs.page_url }} | |
| steps: | |
| - name: Deploy to GitHub Pages | |
| id: deployment | |
| uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5 |