Merge branch 'master' into feat/server/a2a-jwt-jwks

Author: Tyooughtul

.github/actions/java-gradle/pre-merge/action.yml

@@ -93,6 +93,16 @@ runs:
         USE_EXTERNAL_SERVER: true
       run: ./gradlew test
 
+    - name: Check for ByteBuf leaks
+      if: ${{ !cancelled() && inputs.task == 'test' }}
+      shell: bash
+      run: |
+        if grep -r "LEAK:" foreign/java/java-sdk/build/test-results/ 2>/dev/null; then
+          echo "::error::Netty ByteBuf memory leaks detected in test output!"
+          exit 1
+        fi
+        echo "No ByteBuf leaks detected"
+
     - name: Generate coverage report
       if: inputs.task == 'test'
       shell: bash

.github/actions/python-maturin/pre-merge/action.yml

@@ -29,34 +29,29 @@ runs:
     - name: Setup Python
       uses: actions/setup-python@v5
       with:
-        python-version: "3.11"
+        python-version: "3.10"
 
     - name: Setup Rust with cache
       uses: ./.github/actions/utils/setup-rust-with-cache
 
-    - name: Cache pip
+    - name: Install uv
+      uses: astral-sh/setup-uv@v7
+
+    - name: Cache uv
       uses: actions/cache@v4
       with:
-        path: ~/.cache/pip
-        key: pip-${{ runner.os }}-${{ hashFiles('foreign/python/pyproject.toml') }}
+        path: ~/.cache/uv
+        key: uv-${{ runner.os }}-${{ hashFiles('examples/python/uv.lock', 'foreign/python/uv.lock', 'bdd/python/uv.lock') }}
 
     - name: Install dependencies
+      shell: bash
       run: |
-        python -m pip install --upgrade pip wheel setuptools
-
-        # Install maturin for building
-        pip install 'maturin>=1.2,<2.0'
-
-        # Install testing dependencies from pyproject.toml
         cd foreign/python
-        pip install -e ".[testing,dev]"
-        cd ../..
-
-        # Install additional CI dependencies for Docker testing if needed
         if [ "${{ inputs.task }}" = "test" ]; then
-          pip install 'testcontainers[docker]>=3.7.0,<5.0' || true
+          uv sync --frozen --extra dev --extra testing --extra testing-docker
+        else
+          uv sync --frozen --extra dev --extra testing
         fi
-      shell: bash
 
     - name: Lint and format check
       if: inputs.task == 'lint'
@@ -71,19 +66,21 @@ runs:
         [ -d "$DIR_BDD" ] && DIRS_TO_CHECK="$DIRS_TO_CHECK $DIR_BDD"
         [ -d "$DIR_EXAMPLES" ] && DIRS_TO_CHECK="$DIRS_TO_CHECK $DIR_EXAMPLES"
 
+        cd foreign/python
+
         echo "Directories to check: $DIRS_TO_CHECK"
-        echo "ruff version: $(ruff --version)"
+        echo "ruff version: $(uv run ruff --version)"
 
         echo "Running ruff check..."
-        ruff check $DIRS_TO_CHECK
+        uv run ruff check $DIRS_TO_CHECK
 
         echo "Running ruff format --check..."
-        ruff format --check $DIRS_TO_CHECK
+        uv run ruff format --check $DIRS_TO_CHECK
 
         # mypy only for the SDK (has type stubs)
         echo "Running mypy on SDK..."
-        mypy --explicit-package-bases "$DIR_SDK"
-        echo "mypy version: $(mypy --version)"
+        uv run mypy --explicit-package-bases "$DIR_SDK"
+        echo "mypy version: $(uv run mypy --version)"
       shell: bash
 
     - name: Build Python wheel for testing
@@ -93,12 +90,12 @@ runs:
 
         # Build the module
         echo "Building Python wheel..."
-        maturin build -o dist
+        uv run maturin build -o dist
 
         if [ "${{ inputs.task }}" = "test" ]; then
           # Install the built wheel for testing
           echo "Installing built wheel..."
-          pip install dist/*.whl --force-reinstall
+          uv pip install dist/*.whl --force-reinstall
         fi
 
         if [ "${{ inputs.task }}" = "build" ]; then
@@ -125,7 +122,7 @@ runs:
         # Run all tests with server connection
         IGGY_SERVER_HOST=127.0.0.1 \
         IGGY_SERVER_TCP_PORT=8090 \
-          pytest tests/ -v \
+          uv run pytest tests/ -v \
             --junitxml=../../reports/python-junit.xml \
             --tb=short \
             --capture=no || TEST_EXIT_CODE=$?
@@ -142,7 +139,7 @@ runs:
         echo "⚠️ Server failed to start, running unit tests only..."
 
         # Run unit tests only (exclude integration tests)
-        pytest tests/ -v \
+        uv run pytest tests/ -v \
           -m "not integration" \
           --junitxml=../../reports/python-junit.xml \
           --tb=short || TEST_EXIT_CODE=$?

.github/actions/rust/pre-merge/action.yml

@@ -150,7 +150,7 @@ runs:
       shell: bash
 
     - name: Backwards compatibility check
-      if: inputs.task == 'compat' && (github.event_name != 'pull_request' || !contains(github.event.pull_request.body || '', 'BREAKING'))
+      if: inputs.task == 'compat' && (github.event_name != 'pull_request' || !contains(join(github.event.pull_request.labels.*.name, ','), 'breaking:storage'))
       run: |
         scripts/check-backwards-compat.sh \
           --master-ref master \

.github/actions/utils/setup-rust-with-cache/action.yml

@@ -49,7 +49,12 @@ runs:
     - name: Install system dependencies (macOS)
       if: runner.os == 'macOS'
       run: |
-        brew install hwloc
+        # Pin version of hwloc to 2.12.2_1
+        # brew extract doesn't have this version, so we fetch the formula directly
+        brew tap-new iggy/local-hwloc
+        curl -fsSL https://raw.githubusercontent.com/Homebrew/homebrew-core/bb1e23f8e5eacf4d31acd489f6079c8a53ebd690/Formula/h/hwloc.rb \
+          -o "$(brew --repository iggy/local-hwloc)/Formula/hwloc.rb"
+        brew install iggy/local-hwloc/hwloc
       shell: bash
 
     - name: Setup Rust toolchain

.github/workflows/_build_python_wheels.yml

@@ -99,7 +99,6 @@ jobs:
             elif command -v yum &> /dev/null; then
               yum install -y perl-IPC-Cmd
             fi
-            python3 -m pip --version || python3 -m ensurepip
           manylinux: ${{ matrix.manylinux }}
           args: --release --out dist --interpreter python3.10 python3.11 python3.12 python3.13
           sccache: "true"

.github/workflows/_test_examples.yml

@@ -59,14 +59,18 @@ jobs:
         if: inputs.component == 'examples-suite' && inputs.task == 'examples-python'
         uses: actions/setup-python@v5
         with:
-          python-version: "3.11"
+          python-version: "3.10"
 
-      - name: Cache pip
+      - name: Setup uv
+        if: inputs.component == 'examples-suite' && inputs.task == 'examples-python'
+        uses: astral-sh/setup-uv@v7
+
+      - name: Cache uv
         if: inputs.component == 'examples-suite' && inputs.task == 'examples-python'
         uses: actions/cache@v4
         with:
-          path: ~/.cache/pip
-          key: pip-${{ runner.os }}-${{ hashFiles('foreign/python/pyproject.toml') }}
+          path: ~/.cache/uv
+          key: uv-${{ runner.os }}-${{ hashFiles('examples/python/uv.lock', 'foreign/python/uv.lock', 'bdd/python/uv.lock') }}
 
       - name: Setup Java with cache for examples
         if: inputs.component == 'examples-suite' && inputs.task == 'examples-java'

.github/workflows/publish.yml

@@ -468,6 +468,17 @@ jobs:
               continue
             fi
 
+            # In auto-publish mode, stable Docker versions only get :edge tag.
+            # Versioned git tags require manual publish (workflow_dispatch).
+            REGISTRY=$(_jq '.registry')
+            if [ "${{ inputs.create_edge_docker_tag }}" = "true" ] && [ "$REGISTRY" = "dockerhub" ]; then
+              if [[ ! "$VERSION" =~ -(edge|rc) ]]; then
+                echo "⏭️ $NAME: Stable Docker version in auto-publish mode, tag will be skipped"
+                echo "| $NAME | $VERSION | $TAG | ⏭️ Stable (manual publish only) |" >> $GITHUB_STEP_SUMMARY
+                continue
+              fi
+            fi
+
             if [ "$VERSION" = "ERROR" ] || [ "$TAG" = "ERROR" ]; then
               echo "❌ Failed to extract version/tag for $NAME"
               echo "| $NAME | ERROR | ERROR | ❌ Failed to extract |" >> $GITHUB_STEP_SUMMARY