ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  qualification-class:
    name: Determine qualification class
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      classification: ${{ steps.classify.outputs.classification }}
      reason: ${{ steps.classify.outputs.reason }}
      changed_count: ${{ steps.classify.outputs.changed_count }}
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Resolve changed paths without repository API access
        id: classify
        env:
          SOURCE_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          SOURCE_EVENT_NAME: ${{ github.event_name }}
          SOURCE_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          python scripts/ci/classify_pr_qualification.py \
            --root . \
            --event-name "$SOURCE_EVENT_NAME" \
            --base-ref "$SOURCE_BASE_SHA" \
            --head-ref "$SOURCE_HEAD_SHA" \
            --github-output "$GITHUB_OUTPUT"

  qualification-class-report:
    name: Qualification class — ${{ needs.qualification-class.outputs.classification }}
    needs: qualification-class
    runs-on: ubuntu-latest
    timeout-minutes: 2
    steps:
      - name: Report selected qualification
        env:
          CHANGED_COUNT: ${{ needs.qualification-class.outputs.changed_count }}
          QUALIFICATION_CLASS: ${{ needs.qualification-class.outputs.classification }}
          QUALIFICATION_REASON: ${{ needs.qualification-class.outputs.reason }}
        run: |
          case "$QUALIFICATION_CLASS" in
            focused-documentation|complete) ;;
            *) exit 1 ;;
          esac
          echo "::notice title=Qualification class::$QUALIFICATION_CLASS ($QUALIFICATION_REASON; $CHANGED_COUNT changed paths)"

  regression-corpus:
    name: Regression corpus
    needs: qualification-class
    if: ${{ needs.qualification-class.outputs.classification == 'complete' }}
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: "3.12"
      - name: Install the official Python binding
        run: pip install -e .
      - name: Require durable replay and codec evidence
        env:
          CORPUS_BASE_REF: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
        run: |
          arguments=()
          if [[ "$CORPUS_BASE_REF" =~ ^[0-9a-f]{40}$ ]] && [[ ! "$CORPUS_BASE_REF" =~ ^0+$ ]]; then
            arguments+=(--base-ref "$CORPUS_BASE_REF")
          fi
          python scripts/ci/validate-regression-corpus.py "${arguments[@]}"
      - name: Test regression corpus policy guards
        run: python scripts/ci/test-validate-regression-corpus.py

  lint:
    needs: qualification-class
    if: ${{ needs.qualification-class.outputs.classification == 'complete' }}
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: "3.12"
      - run: pip install -e '.[dev]'
      - run: ruff check src/ tests/
      - run: mypy src/durable_workflow/
      - name: Enforce load-calibrated Avro Value regression budget
        run: python benchmarks/avro_value.py --enforce

  avro-benchmark:
    name: Avro Value absolute throughput (advisory)
    needs: qualification-class
    if: ${{ needs.qualification-class.outputs.classification == 'complete' }}
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: "3.12"
      - run: pip install -e .
      - name: Measure the bounded absolute throughput signal
        continue-on-error: true
        run: >-
          python benchmarks/avro_value.py --enforce-absolute
          --output avro-value-benchmark.json
      - name: Publish the measured sample summary
        if: ${{ always() && github.server_url == 'https://github.com' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
        with:
          name: avro-value-benchmark-${{ github.sha }}
          path: avro-value-benchmark.json
          if-no-files-found: error

  test:
    needs: qualification-class
    if: ${{ needs.qualification-class.outputs.classification == 'complete' }}
    runs-on: ubuntu-latest
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.11", "3.12"]
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: ${{ matrix.python-version }}
      - run: pip install -e '.[dev]'
      - run: pytest tests/ -m "not integration" -q

  package:
    needs: qualification-class
    if: ${{ needs.qualification-class.outputs.classification == 'complete' }}
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
        with:
          fetch-depth: 0
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: "3.12"
      - run: pip install build twine
      - run: sh -n scripts/ci/check-docs-release-audit.sh
      - name: Verify release recovery source contracts
        env:
          CONFORMANCE_BASE_REF: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
        run: |
          arguments=()
          if [ -n "$CONFORMANCE_BASE_REF" ]; then
            arguments+=(--previous-ref "$CONFORMANCE_BASE_REF")
          fi
          python scripts/ci/release_recovery_consumer_conformance.py \
            --contract scripts/ci/release-recovery-consumer-contract.json \
            --adapter scripts/ci/release-recovery-consumer-adapter.json \
            "${arguments[@]}"
          python scripts/ci/test-component-release-recovery.py ConsumerContractIdentityRegressionTest
      - run: python -m build
      - name: Compare built release metadata with the exact source commit
        run: python scripts/check_release_metadata.py --source-ref "$(git rev-parse HEAD)" --dist dist
      - run: twine check dist/*
      - run: python scripts/smoke-built-package.py

  cli-parity:
    needs: qualification-class
    if: ${{ needs.qualification-class.outputs.classification == 'complete' }}
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
        with:
          path: sdk-python
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: "3.12"
      - name: Checkout public CLI integration source
        run: python sdk-python/scripts/ci/checkout-public-repository.py cli cli
      - name: Compare shared control-plane parity fixtures
        working-directory: sdk-python
        run: python scripts/check-cli-parity.py --cli ../cli

  integration:
    if: ${{ needs.qualification-class.outputs.classification == 'complete' }}
    runs-on: ubuntu-latest
    timeout-minutes: 25
    needs: [qualification-class, lint, test]
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
        with:
          path: sdk-python
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: "3.12"
      - name: Checkout public Server integration source
        run: python sdk-python/scripts/ci/checkout-public-repository.py server server
      - run: pip install -e '.[dev]'
        working-directory: sdk-python
      - name: Configure isolated Docker project
        working-directory: sdk-python
        run: python scripts/ci/configure-compose-project.py
      - name: Start server stack
        working-directory: sdk-python
        run: |
          docker compose --project-name "$COMPOSE_PROJECT_NAME" -f docker-compose.test.yml \
            up -d --build --wait --timeout 300
      - name: Select and probe integration endpoint
        working-directory: sdk-python
        run: python scripts/ci/configure-integration-endpoint.py
      - name: Run integration tests
        working-directory: sdk-python
        env:
          DURABLE_WORKFLOW_AUTH_TOKEN: test-token
        run: pytest tests/integration/ -v
      - name: Emit integration diagnostics
        if: failure()
        working-directory: sdk-python
        run: |
          for service in bootstrap server worker; do
            echo "::group::$service logs"
            docker compose --project-name "$COMPOSE_PROJECT_NAME" -f docker-compose.test.yml \
              logs --no-color --tail 200 "$service" || true
            echo "::endgroup::"
          done
      - name: Teardown
        if: always()
        working-directory: sdk-python
        run: |
          docker compose --project-name "$COMPOSE_PROJECT_NAME" -f docker-compose.test.yml \
            down -v --rmi local

  target-branch-qualification:
    name: Target branch qualification
    if: ${{ always() }}
    needs:
      - qualification-class
      - qualification-class-report
      - regression-corpus
      - lint
      - avro-benchmark
      - test
      - package
      - cli-parity
      - integration
    runs-on: ubuntu-latest
    timeout-minutes: 2
    steps:
      - name: Require every supported Python and integration cell
        env:
          CLASSIFICATION_RESULT: ${{ needs.qualification-class.result }}
          CLASSIFICATION_REPORT_RESULT: ${{ needs.qualification-class-report.result }}
          QUALIFICATION_CLASS: ${{ needs.qualification-class.outputs.classification }}
          LINT_RESULT: ${{ needs.lint.result }}
          AVRO_BENCHMARK_RESULT: ${{ needs.avro-benchmark.result }}
          CORPUS_RESULT: ${{ needs.regression-corpus.result }}
          TEST_RESULT: ${{ needs.test.result }}
          PACKAGE_RESULT: ${{ needs.package.result }}
          PARITY_RESULT: ${{ needs.cli-parity.result }}
          INTEGRATION_RESULT: ${{ needs.integration.result }}
        run: |
          test "$CLASSIFICATION_RESULT" = success
          test "$CLASSIFICATION_REPORT_RESULT" = success
          if [ "$QUALIFICATION_CLASS" = focused-documentation ]; then
            test "$LINT_RESULT" = skipped
            test "$AVRO_BENCHMARK_RESULT" = skipped
            test "$CORPUS_RESULT" = skipped
            test "$TEST_RESULT" = skipped
            test "$PACKAGE_RESULT" = skipped
            test "$PARITY_RESULT" = skipped
            test "$INTEGRATION_RESULT" = skipped
            echo "Focused documentation qualification selected; Docs PR checks and Public Boundary remain required."
          elif [ "$QUALIFICATION_CLASS" = complete ]; then
            test "$LINT_RESULT" = success
            test "$AVRO_BENCHMARK_RESULT" = success
            test "$CORPUS_RESULT" = success
            test "$TEST_RESULT" = success
            test "$PACKAGE_RESULT" = success
            test "$PARITY_RESULT" = success
            test "$INTEGRATION_RESULT" = success
          else
            exit 1
          fi