python-sdk.yml

name: Python SDK package

on:
  pull_request:
    paths:
      - "product/runtime/auths-gateway/**"
      - "product/profiles/auths-profile-mcp/**"
      - "core/crates/auths-author/**"
      - "bindings/python/**"
      - "bindings/python-adapters/sqlite/**"
      - "bindings/wasm/auths-proof-wasm/examples/generate-node-vectors.rs"
      - "bindings/fixtures/openapi-corpus/**"
      - "bindings/fixtures/openapi-derivation/**"
      - "product/tools/auths-openapi-derive/**"
      - ".github/workflows/python-sdk.yml"
      - "Cargo.lock"
      - "Cargo.toml"
  push:
    branches: [main]
    paths:
      - "product/runtime/auths-gateway/**"
      - "product/profiles/auths-profile-mcp/**"
      - "core/crates/auths-author/**"
      - "bindings/python/**"
      - "bindings/python-adapters/sqlite/**"
      - "bindings/wasm/auths-proof-wasm/examples/generate-node-vectors.rs"
      - "bindings/fixtures/openapi-corpus/**"
      - "bindings/fixtures/openapi-derivation/**"
      - "product/tools/auths-openapi-derive/**"
      - ".github/workflows/python-sdk.yml"
      - "Cargo.lock"
      - "Cargo.toml"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: python-sdk-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  source-contract:
    name: source behavior and contracts
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup-rust-cache
        with:
          toolchain: 1.97.1
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.12"
      - name: Create source-test virtual environment
        shell: bash
        run: |
          python -m venv .venv
          echo "$PWD/.venv/bin" >> "$GITHUB_PATH"
      - run: >-
          python -m pip install maturin==1.9.6 pytest==9.0.2
          pytest-asyncio==1.3.0 ruff==0.14.9 mypy==1.19.1 pyright==1.1.407
      - run: >-
          cargo run --locked -p auths-proof-wasm
          --example generate-node-vectors -- target/binding-vectors
      - run: maturin develop --manifest-path bindings/python/Cargo.toml
      - run: python -m pip install --no-deps -e bindings/python-adapters/sqlite
      - run: pytest -q bindings/python/tests
      - run: pytest -q bindings/python-adapters/sqlite/tests
      - run: >-
          ruff check bindings/python/python bindings/python/tests
          bindings/python/external bindings/python/typecheck
          bindings/python-adapters/sqlite
      - run: >-
          python -m mypy --strict --warn-unused-ignores
          bindings/python-adapters/sqlite/python/auths_sqlite
      - run: >-
          python -m pyright --pythonpath "$(command -v python)"
          -p bindings/python-adapters/sqlite/pyrightconfig.json
      - run: python bindings/python/tools/check_public_api.py
      - run: python bindings/python/tools/check_type_stub.py
      - run: python bindings/python/tools/check_contract.py
      - run: python bindings/python/tools/check_doc_snippets.py

  consumer-contract:
    name: build external-consumer contract
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup-rust-cache
        with:
          toolchain: 1.97.1
      - run: >-
          cargo run --locked -p auths-proof-wasm
          --example generate-node-vectors -- target/binding-vectors
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: python-sdk-consumer-${{ github.run_id }}-${{ github.run_attempt }}
          path: |
            target/binding-vectors/
            bindings/customer-journey-matrix-v1.json
            bindings/public-topology-v1.json
            bindings/python/api/public-api.txt
            bindings/python/adapter-contracts.json
            bindings/python/external/full_workflow_consumer.py
            bindings/python/external/conformance_consumer.py
            bindings/python/external/self_hosted_profile_consumer.py
            bindings/python/external/gateway_observation_consumer.py
            bindings/python/external/openapi_derive_consumer.py
            bindings/fixtures/openapi-derivation/
            bindings/recipes/python/01_authenticate_identity.py
            bindings/python/identity-conformance-v1.json
            bindings/python/native-abi-v2.json
            bindings/python/performance-baseline.json
            bindings/python/pyrightconfig.json
            bindings/python/python/auths/
            bindings/python/tools/check_public_api.py
            bindings/python/tools/check_type_stub.py
            bindings/python/tools/check_contract.py
            bindings/python/tools/check_doc_snippets.py
            bindings/python/tools/check_performance.py
            bindings/python/tools/check_wheel.py
            bindings/python/sdk-capability.json
            bindings/python/sdk-runtime-contract.json
            bindings/python/typecheck/*.py
            bindings/python/typecheck/installed-pyrightconfig.json
          if-no-files-found: error
          retention-days: 1
          compression-level: 9

  wheel-build:
    name: build abi3 wheel (${{ matrix.os }})
    strategy:
      fail-fast: true
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup-rust-cache
        with:
          toolchain: 1.97.1
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.9"
      - run: python -m pip install maturin==1.9.6
      - run: >-
          maturin build --profile python-extension --locked
          --manifest-path bindings/python/Cargo.toml
          --features pyo3/extension-module
          --out target/python-release-wheels
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: python-wheel-${{ matrix.os }}-${{ github.run_id }}-${{ github.run_attempt }}
          path: target/python-release-wheels/*.whl
          if-no-files-found: error
          retention-days: 1
          compression-level: 0

  installed-workflow:
    name: installed CPython ${{ matrix.python }} (${{ matrix.os }})
    needs: [consumer-contract, wheel-build]
    strategy:
      fail-fast: true
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        python: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: ${{ matrix.python }}
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: python-wheel-${{ matrix.os }}-${{ github.run_id }}-${{ github.run_attempt }}
          path: wheelhouse
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: python-sdk-consumer-${{ github.run_id }}-${{ github.run_attempt }}
          path: consumer
      - name: Assert a source-free consumer boundary
        shell: bash
        run: |
          if find consumer -type f \( \
            -name '*.rs' -o \
            -name 'Cargo.toml' -o \
            -name 'Cargo.lock' -o \
            -name 'rust-toolchain*' \
          \) -print -quit | grep -q .; then
            echo "::error::External wheel workflow received Rust build inputs."
            exit 1
          fi
      - name: Install only the built wheel
        shell: bash
        run: python -m pip install wheelhouse/*.whl
      - name: Inspect exact wheel contents
        shell: bash
        run: python consumer/bindings/python/tools/check_wheel.py wheelhouse/*.whl
      - name: Execute the external Full Workflow consumer
        shell: bash
        working-directory: ${{ runner.temp }}
        run: >-
          python "${{ github.workspace }}/consumer/bindings/python/external/full_workflow_consumer.py"
          "${{ github.workspace }}/consumer/target/binding-vectors"
      - name: Execute the installed identity quickstart
        shell: bash
        working-directory: ${{ runner.temp }}
        run: >-
          python "${{ github.workspace }}/consumer/bindings/recipes/python/01_authenticate_identity.py"
      - name: Execute installed Auths-owned conformance
        shell: bash
        working-directory: ${{ runner.temp }}
        run: >-
          python "${{ github.workspace }}/consumer/bindings/python/external/conformance_consumer.py"
      - name: Generate and exercise a clean self-hosted consumer from the wheel
        shell: bash
        working-directory: ${{ runner.temp }}
        run: >-
          python "${{ github.workspace }}/consumer/bindings/python/external/self_hosted_profile_consumer.py"
          "${{ github.workspace }}/consumer/target/binding-vectors"
      - name: Derive, generate, and check one operation from the installed wheel
        shell: bash
        working-directory: ${{ runner.temp }}
        run: >-
          python "${{ github.workspace }}/consumer/bindings/python/external/openapi_derive_consumer.py"
          "${{ github.workspace }}/consumer/bindings/fixtures/openapi-derivation"
      - name: Check exact package/native contracts
        shell: bash
        run: python consumer/bindings/python/tools/check_contract.py
      - name: Check installed-wheel performance contract
        shell: bash
        run: >-
          python consumer/bindings/python/tools/check_performance.py
          consumer/target/binding-vectors wheelhouse/*.whl

  typing-and-api:
    name: installed typing and API contract
    needs: [consumer-contract, wheel-build]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.9"
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: python-wheel-ubuntu-latest-${{ github.run_id }}-${{ github.run_attempt }}
          path: wheelhouse
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: python-sdk-consumer-${{ github.run_id }}-${{ github.run_attempt }}
          path: consumer
      - name: Install the wheel and pinned type checkers
        shell: bash
        run: >-
          python -m pip install wheelhouse/*.whl
          mypy==1.19.1 pyright==1.1.407
      - name: Check strict mypy source contract
        run: >-
          python -m mypy --strict --warn-unused-ignores
          consumer/bindings/python/python/auths
      - name: Check installed mypy consumer narrowing and negative boundaries
        run: >-
          python -m mypy --strict --warn-unused-ignores
          consumer/bindings/python/typecheck/workflow_consumer.py
          consumer/bindings/python/typecheck/mypy_negative.py
      - name: Check strict Pyright source contract
        run: >-
          python -m pyright --pythonpath "$(command -v python)"
          -p consumer/bindings/python/pyrightconfig.json
      - name: Check installed Pyright consumer narrowing and negative boundaries
        run: >-
          python -m pyright --pythonpath "$(command -v python)"
          -p consumer/bindings/python/typecheck/installed-pyrightconfig.json
      - name: Check the installed public API snapshot
        run: python consumer/bindings/python/tools/check_public_api.py

  gateway-journey:
    name: installed wheel against the gateway harness (${{ matrix.os }})
    needs: [consumer-contract, wheel-build]
    strategy:
      fail-fast: true
      matrix:
        os: [ubuntu-latest, macos-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup-rust-cache
        with:
          toolchain: 1.97.1
      - name: Build the gateway test harness
        run: >-
          cargo build --locked -p auths-gateway --features testkit-harness
          --bin auths-gateway-harness
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.9"
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: python-wheel-${{ matrix.os }}-${{ github.run_id }}-${{ github.run_attempt }}
          path: wheelhouse
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: python-sdk-consumer-${{ github.run_id }}-${{ github.run_attempt }}
          path: consumer
      - name: Install only the built wheel
        shell: bash
        run: python -m pip install wheelhouse/*.whl
      - name: Check the socket path limit against the operating system
        shell: bash
        working-directory: ${{ runner.temp }}
        run: |
          python - <<'EOF'
          import os
          import socket
          import sys
          import tempfile
          from pathlib import Path

          from auths.gateway import GatewayEndpoint

          limit = 107 if sys.platform.startswith("linux") else 103
          base = Path(tempfile.mkdtemp(dir="/tmp")).resolve()


          def padded(size):
              path = base / ("s" * (size - len(os.fsencode(base)) - 1))
              assert len(os.fsencode(path)) == size
              return path


          longest = padded(limit)
          GatewayEndpoint(longest)
          with socket.socket(socket.AF_UNIX) as listener:
              listener.bind(str(longest))
          over = padded(limit + 1)
          try:
              GatewayEndpoint(over)
          except ValueError:
              pass
          else:
              sys.exit("GatewayEndpoint accepted a path over the limit")
          with socket.socket(socket.AF_UNIX) as listener:
              try:
                  listener.bind(str(over))
              except OSError:
                  pass
              else:
                  sys.exit(f"a {limit + 1}-byte socket path bound")
          print(f"socket path limit {limit} matches the operating system")
          EOF
      - name: Run the expected-before-replacement journey
        shell: bash
        working-directory: ${{ runner.temp }}
        run: >-
          python "${{ github.workspace }}/consumer/bindings/python/external/gateway_observation_consumer.py"
          "${{ github.workspace }}/target/debug/auths-gateway-harness"