test: provision Cloud namespace per CI run (#1731) #6030
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Continuous Integration | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| - "releases/*" | |
| permissions: | |
| contents: read | |
| actions: read | |
| env: | |
| COLUMNS: 120 | |
| jobs: | |
| # Build and test the project | |
| build-lint-test: | |
| timeout-minutes: 30 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python: ["3.10", "3.14"] | |
| os: [ubuntu-latest, ubuntu-arm, macos-arm, windows-latest] | |
| include: | |
| - os: ubuntu-latest | |
| python: "3.14" | |
| docsTarget: true | |
| openaiTestTarget: true | |
| clippyLinter: true | |
| - python: "3.10" | |
| pytestExtraArgs: '--reruns 3 --only-rerun "RuntimeError: Failed validating workflow"' | |
| - os: ubuntu-arm | |
| runsOn: ubuntu-24.04-arm64-2-core | |
| - os: macos-arm | |
| runsOn: macos-latest | |
| runs-on: ${{ matrix.runsOn || matrix.os }} | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| submodules: recursive | |
| - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable | |
| with: | |
| components: "clippy" | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| with: | |
| python-version: ${{ matrix.pythonOverride || matrix.python }} | |
| - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 | |
| with: | |
| workspaces: temporalio/bridge -> target | |
| key: ${{ env.pythonLocation }} | |
| - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3 | |
| with: | |
| # TODO(cretz): Can upgrade proto when https://github.com/arduino/setup-protoc/issues/99 fixed | |
| version: "23.x" | |
| repo-token: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8 | |
| - run: uv tool install poethepoet | |
| - run: uv sync --all-extras | |
| - run: poe bridge-lint | |
| if: ${{ matrix.clippyLinter }} | |
| - run: poe build-develop | |
| - run: poe lint | |
| - run: mkdir junit-xml | |
| - run: poe test ${{matrix.pytestExtraArgs}} -s --junit-xml=junit-xml/${{ matrix.python }}--${{ matrix.os }}.xml | |
| timeout-minutes: 15 | |
| # Time skipping doesn't yet support ARM | |
| - if: ${{ !endsWith(matrix.os, '-arm') }} | |
| run: poe test ${{matrix.pytestExtraArgs}} -s --workflow-environment time-skipping --junit-xml=junit-xml/${{ matrix.python }}--${{ matrix.os }}--time-skipping.xml | |
| timeout-minutes: 10 | |
| - if: ${{ matrix.openaiTestTarget && (github.event.pull_request.head.repo.full_name == '' || github.event.pull_request.head.repo.full_name == 'temporalio/sdk-python') }} | |
| run: poe test tests/contrib/openai_agents/test_openai.py ${{matrix.pytestExtraArgs}} -s --junit-xml=junit-xml/${{ matrix.python }}--${{ matrix.os }}--openai.xml | |
| timeout-minutes: 10 | |
| env: | |
| OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} | |
| - name: "Upload junit-xml artifacts" | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| if: always() | |
| with: | |
| name: junit-xml--${{github.run_id}}--${{github.run_attempt}}--${{ matrix.python }}--${{ matrix.os }} | |
| path: junit-xml | |
| retention-days: 14 | |
| # Do docs stuff (only on one host) | |
| - name: Build API docs | |
| if: ${{ matrix.docsTarget }} | |
| run: poe gen-docs | |
| - name: Deploy prod API docs | |
| if: ${{ github.ref == 'refs/heads/main' && matrix.docsTarget }} | |
| env: | |
| VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }} | |
| VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }} | |
| run: npx vercel deploy build/apidocs -t ${{ secrets.VERCEL_TOKEN }} --prod --yes | |
| # Confirm README ToC is generated properly | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| - name: Check generated README ToC | |
| if: ${{ matrix.docsTarget }} | |
| run: | | |
| npx doctoc README.md | |
| [[ -z $(git status --porcelain README.md) ]] || (git diff README.md; echo "README changed"; exit 1) | |
| alpine-package-test: | |
| timeout-minutes: 60 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - cibw-build: cp310-musllinux_x86_64 | |
| runsOn: ubuntu-latest | |
| - cibw-build: cp310-musllinux_aarch64 | |
| runsOn: ubuntu-24.04-arm64-2-core | |
| runs-on: ${{ matrix.runsOn }} | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| submodules: recursive | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| with: | |
| python-version: "3.14" | |
| - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8 | |
| - run: uv sync --all-extras | |
| - name: Build Alpine wheel | |
| run: uv run cibuildwheel --output-dir dist | |
| env: | |
| CIBW_BUILD: ${{ matrix.cibw-build }} | |
| - name: Test Alpine wheel | |
| uses: ./.github/actions/alpine-package-smoke | |
| with: | |
| wheel-dir: dist | |
| check-protos: | |
| timeout-minutes: 30 | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| submodules: recursive | |
| - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| with: | |
| python-version: "3.10" | |
| - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 | |
| with: | |
| workspaces: temporalio/bridge -> target | |
| key: ${{ env.pythonLocation }} | |
| - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3 | |
| with: | |
| # TODO(cretz): Can upgrade proto when https://github.com/arduino/setup-protoc/issues/99 fixed | |
| version: "23.x" | |
| repo-token: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8 | |
| - run: uv tool install poethepoet | |
| - run: uv remove google-adk --optional google-adk | |
| - run: uv add --dev --python 3.10 "googleapis-common-protos==1.70.0" | |
| - run: uv add --python 3.10 "protobuf<4" | |
| - run: uv sync --all-extras | |
| - run: poe build-develop | |
| - run: poe gen-protos | |
| - name: Check generation unchanged | |
| run: | | |
| [[ -z $(git status --porcelain temporalio tests) ]] || (git diff temporalio tests; echo "Protos changed"; exit 1) | |
| - name: Test with protobuf 3.x | |
| run: poe test -s --ignore=tests/contrib/google_adk_agents/ | |
| env: | |
| TEMPORAL_TEST_PROTO3: 1 | |
| test-latest-deps: | |
| timeout-minutes: 30 | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| submodules: recursive | |
| - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable | |
| with: | |
| components: "clippy" | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| with: | |
| python-version: "3.13" | |
| - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 | |
| with: | |
| workspaces: temporalio/bridge -> target | |
| key: ${{ env.pythonLocation }} | |
| - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3 | |
| with: | |
| # TODO(cretz): Can upgrade proto when https://github.com/arduino/setup-protoc/issues/99 fixed | |
| version: "23.x" | |
| repo-token: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8 | |
| - run: uv tool install poethepoet | |
| - run: uv lock --upgrade | |
| - run: uv sync --all-extras | |
| - run: poe build-develop | |
| - run: poe lint | |
| - run: mkdir junit-xml | |
| - run: poe test -s --junit-xml=junit-xml/latest-deps.xml | |
| timeout-minutes: 15 | |
| - name: "Upload junit-xml artifacts" | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| if: always() | |
| with: | |
| name: junit-xml--${{github.run_id}}--${{github.run_attempt}}--latest-deps--time-skipping | |
| path: junit-xml | |
| retention-days: 14 | |
| # Run the test suite against Temporal Cloud (skipped on forks) | |
| cloud-test: | |
| if: ${{ github.event.pull_request.head.repo.full_name == '' || github.event.pull_request.head.repo.full_name == 'temporalio/sdk-python' }} | |
| timeout-minutes: 30 | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| submodules: recursive | |
| - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| with: | |
| python-version: "3.14" | |
| - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 | |
| with: | |
| workspaces: temporalio/bridge -> target | |
| key: ${{ env.pythonLocation }} | |
| - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3 | |
| with: | |
| # TODO(cretz): Can upgrade proto when https://github.com/arduino/setup-protoc/issues/99 fixed | |
| version: "23.x" | |
| repo-token: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8 | |
| - run: uv tool install poethepoet | |
| - run: uv sync --all-extras | |
| - run: poe build-develop | |
| - name: Generate Cloud test certificates | |
| run: | | |
| cert_dir="$RUNNER_TEMP/cloud-test-certs" | |
| mkdir "$cert_dir" | |
| openssl req -x509 -newkey rsa:2048 -nodes -days 1 \ | |
| -keyout "$cert_dir/ca.key" -out "$cert_dir/ca.pem" \ | |
| -subj '/CN=Temporal Python SDK Cloud CI CA' | |
| openssl req -newkey rsa:2048 -nodes \ | |
| -keyout "$cert_dir/client.key" -out "$cert_dir/client.csr" \ | |
| -subj '/CN=Temporal Python SDK Cloud CI' | |
| openssl x509 -req -days 1 -in "$cert_dir/client.csr" \ | |
| -CA "$cert_dir/ca.pem" -CAkey "$cert_dir/ca.key" -CAcreateserial \ | |
| -out "$cert_dir/client.pem" -extfile <(printf 'extendedKeyUsage=clientAuth') | |
| { | |
| echo "TEMPORAL_CLOUD_CLIENT_CA_PATH=$cert_dir/ca.pem" | |
| echo "TEMPORAL_TLS_CLIENT_CERT_PATH=$cert_dir/client.pem" | |
| echo "TEMPORAL_TLS_CLIENT_KEY_PATH=$cert_dir/client.key" | |
| } >> "$GITHUB_ENV" | |
| - name: Create Cloud namespace | |
| id: create-cloud-namespace | |
| run: uv run python .github/scripts/cloud_namespace.py create | |
| env: | |
| TEMPORAL_CLIENT_CLOUD_API_KEY: ${{ secrets.TEMPORAL_CLIENT_CLOUD_API_KEY }} | |
| TEMPORAL_CLIENT_CLOUD_API_VERSION: v0.19.1 | |
| - run: mkdir junit-xml | |
| - run: poe test -s --workflow-environment envconfig --junit-xml=junit-xml/cloud.xml | |
| timeout-minutes: 15 | |
| env: | |
| TEMPORAL_ADDRESS: ${{ steps.create-cloud-namespace.outputs.namespace }}.tmprl.cloud:7233 | |
| TEMPORAL_NAMESPACE: ${{ steps.create-cloud-namespace.outputs.namespace }} | |
| TEMPORAL_IS_CLOUD_TESTS: true | |
| TEMPORAL_CLIENT_CLOUD_API_KEY: ${{ secrets.TEMPORAL_CLIENT_CLOUD_API_KEY }} | |
| TEMPORAL_CLIENT_CLOUD_API_VERSION: v0.19.1 | |
| TEMPORAL_CLIENT_CLOUD_NAMESPACE: ${{ steps.create-cloud-namespace.outputs.namespace }} | |
| - name: Delete Cloud namespace | |
| if: ${{ always() && steps.create-cloud-namespace.outputs.namespace != '' }} | |
| run: uv run python .github/scripts/cloud_namespace.py delete "${{ steps.create-cloud-namespace.outputs.namespace }}" | |
| env: | |
| TEMPORAL_CLIENT_CLOUD_API_KEY: ${{ secrets.TEMPORAL_CLIENT_CLOUD_API_KEY }} | |
| TEMPORAL_CLIENT_CLOUD_API_VERSION: v0.19.1 | |
| - name: "Upload junit-xml artifacts" | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| if: always() | |
| with: | |
| name: junit-xml--${{github.run_id}}--${{github.run_attempt}}--cloud | |
| path: junit-xml | |
| retention-days: 14 | |
| # Runs the sdk features repo tests with this repo's current SDK code | |
| features-tests: | |
| uses: temporalio/features/.github/workflows/python.yaml@main | |
| with: | |
| python-repo-path: ${{github.event.pull_request.head.repo.full_name}} | |
| version: ${{github.event.pull_request.head.ref}} | |
| version-is-repo-ref: true |