ci.yml

name: CI

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

# Nothing here writes to the repository: it lints, types, tests, and builds an
# image it does not push. Declared at the top so a job added later starts from
# read-only rather than inheriting whatever the repository default happens to be.
permissions:
  contents: read

env:
  COLUMNS: 150

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ["3.10", "3.13"]
    steps:
      - uses: actions/checkout@v7

      - name: Install uv
        uses: astral-sh/setup-uv@v10.2.0

      - name: Set up Python ${{ matrix.python-version }}
        run: uv python install ${{ matrix.python-version }}

      - name: Install dependencies
        run: uv sync --python ${{ matrix.python-version }} --all-extras

      - name: Run ruff format check
        run: uv run ruff format --check

      - name: Run ruff lint
        run: uv run ruff check

  typecheck:
    name: Type Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Install uv
        uses: astral-sh/setup-uv@v10.2.0

      - name: Set up Python
        run: uv python install 3.12

      - name: Install dependencies
        run: uv sync --all-extras

      - name: Run Pyright
        run: uv run pyright

      - name: Run MyPy
        run: uv run mypy src/pydantic_ai_backends

  test:
    name: Test Python ${{ matrix.python-version }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.11", "3.12", "3.13"]
    steps:
      - uses: actions/checkout@v7

      - name: Install uv
        uses: astral-sh/setup-uv@v10.2.0

      - name: Set up Python ${{ matrix.python-version }}
        run: uv python install ${{ matrix.python-version }}

      - name: Install dependencies
        run: uv sync --python ${{ matrix.python-version }} --all-extras

      - name: Run tests with coverage
        run: |
          uv run coverage run -m pytest
          uv run coverage report
          uv run coverage lcov -o coverage.lcov

      - name: Upload coverage to Coveralls
        if: matrix.python-version == '3.12'
        uses: coverallsapp/github-action@v2
        continue-on-error: true
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          file: coverage.lcov

  pydantic-ai-range:
    # The `console` extra declares `pydantic-ai-slim>=2.52.0`, and every job
    # above installs whatever `uv.lock` pins — so the *declared* range was never
    # exercised at either end. A floor is satisfiable by every later release, so
    # an application on a newer one installs this library cleanly and finds out at
    # runtime whether `prepare_tools` and `before_tool_execute` still behave.
    #
    # That failure is quiet in the direction that matters: a hook whose signature
    # no longer matches stops hiding the tools a ruleset denied, and the
    # capability hands the model `execute` with nothing reporting it.
    name: pydantic-ai ${{ matrix.pydantic-ai }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        pydantic-ai: ["2.52.0", "latest"]
    steps:
      - uses: actions/checkout@v7

      - name: Install uv
        uses: astral-sh/setup-uv@v10.2.0

      - name: Set up Python
        run: uv python install 3.12

      - name: Install dependencies
        run: uv sync --all-extras

      - name: Install pydantic-ai ${{ matrix.pydantic-ai }}
        run: |
          if [ "${{ matrix.pydantic-ai }}" = "latest" ]; then
            uv pip install --upgrade pydantic-ai-slim
          else
            uv pip install 'pydantic-ai-slim==${{ matrix.pydantic-ai }}'
          fi
          uv run --no-sync python -c "import pydantic_ai; print(pydantic_ai.__version__)"

      # `--no-sync`, or uv restores the locked version and the job tests nothing.
      - name: Run tests
        run: uv run --no-sync pytest -q

  extras:
    # Every job above installs all extras, so a module importing a package that no
    # extra it ships with declares passes there - and fails for anyone installing
    # just that extra. `workspaces` imported `httpx` from `remote` until 0.2.33, and
    # every `pip install pydantic-deep` broke on it.
    name: Extras (${{ matrix.extras }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        extras: ["console,workspaces"]
    steps:
      - uses: actions/checkout@v7

      - name: Install uv
        uses: astral-sh/setup-uv@v10.2.0

      - name: Install the package with only these extras
        run: |
          uv venv --python 3.12 "$RUNNER_TEMP/extras"
          uv pip install --python "$RUNNER_TEMP/extras/bin/python" ".[${{ matrix.extras }}]"

      - name: Import every public name
        run: '"$RUNNER_TEMP/extras/bin/python" scripts/import_every_export.py'

  image:
    # A Dockerfile only built at release time is one that breaks at release time.
    # Single platform and no push: this answers "does it still build and start",
    # and `publish.yml` does the rest.
    name: Sandboxd Image
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: docker/setup-buildx-action@v3

      - uses: docker/build-push-action@v7
        with:
          context: .
          push: false
          load: true
          tags: sandboxd:ci
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: It refuses to start without a token, and says so
        run: |
          output=$(docker run --rm sandboxd:ci 2>&1 || true)
          echo "$output"
          echo "$output" | grep -q SANDBOXD_TOKEN

      - name: It serves /healthz
        run: |
          docker run -d --name sandboxd-ci -p 8080:8080 \
            -e SANDBOXD_TOKEN=ci-token -e SANDBOXD_PREWARM=false sandboxd:ci
          for _ in $(seq 30); do
            curl -fsS localhost:8080/healthz && break
            sleep 1
          done
          curl -fsS localhost:8080/healthz
          docker rm -f sandboxd-ci

  all-checks:
    name: All Checks Passed
    runs-on: ubuntu-latest
    needs: [lint, typecheck, test, pydantic-ai-range, extras, image]
    steps:
      - name: All checks passed
        run: echo "All CI checks passed successfully!"