ci-test-python.yml

name: "CI: Test Python"

on:
  pull_request:
    paths:
      - "libs/python/**"
      # cua-sandbox is a thin wrapper over the cua SDK: SDK changes can break it.
      - "libs/cua/crates/**"
      - "libs/cua/python/**"
      - "libs/cua/proto/**"
      - "libs/cua/Cargo.*"
      # cua-test-fixtures links a real driver core.
      - "libs/cua-spacesd/tests/spaces-e2e/**"
      - ".github/workflows/ci-test-python.yml"
  push:
    branches: [main]
    paths:
      - "libs/python/**"
      # cua-sandbox is a thin wrapper over the cua SDK: SDK changes can break it.
      - "libs/cua/crates/**"
      - "libs/cua/python/**"
      - "libs/cua/proto/**"
      - "libs/cua/Cargo.*"
      # cua-test-fixtures links a real driver core.
      - "libs/cua-spacesd/tests/spaces-e2e/**"
      - ".github/workflows/ci-test-python.yml"
  workflow_dispatch: # Allow manual trigger

permissions:
  contents: read

env:
  CARGO_NET_RETRY: "10"
  CARGO_HTTP_TIMEOUT: "120"
  CARGO_HTTP_MULTIPLEXING: "false"
  # CI checks behavior, not speed: a cheaper release profile compiles about a
  # quarter faster and the dev profile drops debug info (the line-table
  # test binaries filled the runner's disk). Release builds in cd-*.yml keep
  # the shipped profile.
  CARGO_PROFILE_RELEASE_OPT_LEVEL: "1"
  CARGO_PROFILE_RELEASE_DEBUG: "0"
  CARGO_PROFILE_RELEASE_LTO: "off"
  CARGO_PROFILE_RELEASE_CODEGEN_UNITS: "16"
  CARGO_PROFILE_DEV_DEBUG: "0"

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  test:
    if: ${{ !startsWith(github.head_ref, 'release-please--branches--') }}
    name: Test ${{ matrix.package }}
    runs-on: ubuntu-latest

    strategy:
      fail-fast: false # Test all packages even if one fails
      matrix:
        package:
          - core
          - agent
          - som
          - cua-e2b

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install uv
        run: |
          pip install uv

      - name: Install package and dependencies
        run: |
          cd libs/python/${{ matrix.package }}
          # Install the package in editable mode with dev dependencies
          if [ -f pyproject.toml ]; then
            uv pip install --system -e "."
          fi
        shell: bash

      - name: Install test dependencies
        run: |
          # Install test dependencies from root pyproject.toml if tests directory exists
          # The root pyproject.toml has package=false, so we install just the dependency group
          if [ -d "libs/python/${{ matrix.package }}/tests" ]; then
            uv pip install --system --group test
          fi
        shell: bash

      - name: Run tests
        run: |
          cd libs/python/${{ matrix.package }}
          if [ -d tests ]; then
            python -m pytest tests/ -v --tb=short --cov --cov-report=term --cov-report=xml
          else
            echo "No tests directory found, skipping tests"
          fi
        shell: bash
        env:
          CUA_TELEMETRY_ENABLED: "false" # Disable telemetry during tests

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4
        if: always()
        with:
          file: ./libs/python/${{ matrix.package }}/coverage.xml
          flags: ${{ matrix.package }}
          name: codecov-${{ matrix.package }}
          fail_ci_if_error: false
        continue-on-error: true

  cua-sandbox:
    if: ${{ !startsWith(github.head_ref, 'release-please--branches--') }}
    # cua-sandbox drives sandboxes through the cua SDK (UniFFI over cua-sdk),
    # so the native library and the MockServer fixture are built first. The
    # hermetic suite never touches the host or a cloud;
    # the live runtime suites are excluded (they are gated separately).
    name: Test cua-sandbox (hermetic, on the cua SDK)
    runs-on: ubuntu-latest
    timeout-minutes: 60
    env:
      CARGO_TERM_COLOR: always
      CARGO_BUILD_JOBS: "4"
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - uses: ./.github/actions/linux-rust-prep

      - name: Install protoc
        uses: ./.github/actions/setup-protoc

      - name: Install pinned Rust toolchain
        uses: dtolnay/rust-toolchain@1.97.1

      - uses: ./.github/actions/rust-cache
        with:
          workspaces: libs/cua
          key: cua-sandbox

      - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6

      - name: Build the cua SDK library and the spacesd MockServer fixture
        working-directory: libs/cua
        run: |
          cargo build --locked --release -p cua-sdk
          scripts/build-test-fixtures.sh
          node scripts/stage-uniffi-library.mjs --only=python

      - name: Install cua-sandbox
        working-directory: libs/python/cua-sandbox
        run: uv sync --frozen --python 3.12

      - name: Run the hermetic suite
        working-directory: libs/python/cua-sandbox
        env:
          CUA_TELEMETRY_ENABLED: "false"
        run: >
          uv run --frozen pytest tests -p no:cacheprovider --timeout=120 -ra
          --ignore=tests/live
          --ignore=tests/test_runtime.py
          --ignore=tests/test_snapshots.py
          --ignore=tests/test_windows_timing.py
          --deselect tests/test_oci.py::TestLiveRegistry

  summary:
    name: Test Summary
    runs-on: ubuntu-latest
    needs: [test, cua-sandbox]
    if: ${{ !cancelled() }}

    steps:
      - name: Check test results
        run: |
          if [ "${{ needs.test.result }}" == "failure" ] || [ "${{ needs.cua-sandbox.result }}" == "failure" ]; then
            echo "❌ Some tests failed. Please check the logs above."
            exit 1
          else
            echo "✅ All tests passed!"
          fi