ci_python.yml

# SPDX-FileCopyrightText: Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

name: Python

on:
  workflow_call:
    inputs:
      ref:
        description: 'The Git ref to check out; defaults to the triggering commit'
        required: false
        default: ''
        type: string
      ref_name:
        description: 'The effective ref name; defaults to the triggering ref name'
        required: false
        default: ''
        type: string
      ref_type:
        description: 'The effective ref type; defaults to the triggering ref type'
        required: false
        default: ''
        type: string
      skip_tests:
        description: 'Skip the Python test matrix and only build wheels'
        required: false
        default: false
        type: boolean
  pull_request:
  push:
    branches: [main]
    tags: ['*']

concurrency:
  group: ci-python-${{ inputs.ref || github.ref }}
  cancel-in-progress: true

defaults:
  run:
    shell: bash

jobs:
  test:
    name: Test (Python ${{ matrix.python-version }}, ${{ matrix.platform }})
    if: ${{ (inputs.ref_type || github.ref_type) != 'tag' && !inputs.skip_tests }}
    strategy:
      fail-fast: false
      matrix:
        platform: [linux-amd64, linux-arm64, macos-arm64, windows-amd64]
        python-version: ['3.11', '3.12', '3.13', '3.14']
        include:
          - platform: linux-amd64
            runner: ubuntu-24.04
          - platform: linux-arm64
            runner: ubuntu-24.04-arm
          - platform: macos-arm64
            runner: macos-15
          - platform: windows-amd64
            runner: windows-2022
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 30
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false
          ref: ${{ inputs.ref || github.sha }}

      # Rust is needed both to build the native extension (maturin backend) and
      # because the CLI-backed smokes shell out to `cargo run -p nemo-fabric-cli`.
      - name: Set up Rust
        uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606 # v1.15.4
        with:
          toolchain: stable
          cache: false

      - name: Install just
        uses: taiki-e/install-action@c070f87102a1c75b3183910f391c1cb887fe13c8 # v2.77.6
        with:
          tool: just@1.50.0

      - name: Set up uv
        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8

      - name: Cache cargo build
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
        with:
          shared-key: fabric-rust-${{ runner.os }}-${{ runner.arch }}

      - name: Create virtual environment
        run: |
          uv venv --python "${UV_PYTHON:-${{ matrix.python-version }}}" .venv

      # Exercise the supported root adapter and harness compositions. The
      # adapter-tests group also keeps local test dependencies independently
      # installable for leaf adapter development.
      - name: Build SDK with native extension
        run: |
          uv sync --no-default-groups --group adapter-tests --group collector --group test --extra claude --extra codex --extra deepagents --extra mini-swe-agent --extra openclaw --extra remote-agent ${{ (matrix.python-version == '3.12' || matrix.python-version == '3.13') && '--extra nooa' || '' }} ${{ matrix.python-version != '3.11' && '--extra harbor' || '' }} --extra relay

      - name: Run pytest
        run: |
          set -euo pipefail
          just --set no_uv true test-python

  hermes:
    name: Hermes adapter (upstream Relay 0.9, Python 3.14)
    if: ${{ (inputs.ref_type || github.ref_type) != 'tag' && !inputs.skip_tests }}
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false
          ref: ${{ inputs.ref || github.sha }}

      - name: Checkout merged upstream Hermes Relay 0.9 revision
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          repository: NousResearch/hermes-agent
          ref: dccb84b92401234db294667ec203d3ac3dc1b87f
          path: external/hermes-agent
          persist-credentials: false

      - name: Set up Rust
        uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606 # v1.15.4
        with:
          toolchain: stable
          cache: false

      - name: Install just
        uses: taiki-e/install-action@c070f87102a1c75b3183910f391c1cb887fe13c8 # v2.77.6
        with:
          tool: just@1.50.0

      - name: Set up uv
        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8

      - name: Test ordinary Hermes adapter behavior
        run: just test-hermes

  opencode-e2e:
    name: OpenCode E2E
    if: ${{ (inputs.ref_type || github.ref_type) != 'tag' && !inputs.skip_tests }}
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false
          ref: ${{ inputs.ref || github.sha }}

      - name: Set up Rust
        uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606 # v1.15.4
        with:
          toolchain: stable
          cache: false

      - name: Set up Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: adapters/typescript/package-lock.json

      - name: Set up Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.4.2

      - name: Install just
        uses: taiki-e/install-action@c070f87102a1c75b3183910f391c1cb887fe13c8 # v2.77.6
        with:
          tool: just@1.50.0

      - name: Set up uv
        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8

      - name: Create virtual environment
        run: uv venv --python 3.12 .venv

      - name: Install OpenCode adapter dependencies
        run: |
          just install-typescript-opencode
          npm run build --prefix adapter-contract/typescript
          npm run build --prefix adapters/typescript --workspace nemo-fabric-adapters-common
          npm run build --prefix adapters/typescript --workspace nemo-fabric-adapters-opencode

      - name: Run deterministic OpenCode E2E
        run: |
          uv sync --no-default-groups --group test
          uv run --no-sync pytest tests/e2e/test_opencode.py -k local_openai_compatible -q

  cline-e2e:
    name: Cline E2E
    if: ${{ (inputs.ref_type || github.ref_type) != 'tag' && !inputs.skip_tests }}
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false
          ref: ${{ inputs.ref || github.sha }}

      - name: Set up Rust
        uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606 # v1.15.4
        with:
          toolchain: stable
          cache: false

      - name: Set up Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: adapters/typescript/package-lock.json

      - name: Install just
        uses: taiki-e/install-action@c070f87102a1c75b3183910f391c1cb887fe13c8 # v2.77.6
        with:
          tool: just@1.50.0

      - name: Set up uv
        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8

      - name: Create virtual environment
        run: uv venv --python 3.12 .venv

      - name: Install Cline adapter and caller-owned SDK
        run: |
          just install-typescript-cline
          # Cline is caller-managed, so this intentionally tests the exact supported
          # SDK release with its current transitive graph outside NeMo Fabric's lockfile.
          npm install --prefix adapters/typescript --workspace nemo-fabric-adapters-cline --include-workspace-root --no-save --package-lock=false --ignore-scripts --no-audit --no-fund @cline/sdk@0.0.83
          npm run build --prefix adapter-contract/typescript
          npm run build --prefix adapters/typescript --workspace nemo-fabric-adapters-common
          npm run build --prefix adapters/typescript --workspace nemo-fabric-adapters-cline

      - name: Run deterministic Cline E2E
        run: |
          uv sync --frozen --no-default-groups --group test --no-sources-package hermes-agent
          uv run --no-sync pytest tests/e2e/test_cline.py -k plans_diagnoses_runs_and_isolates_sessions -q

  qwen-e2e:
    name: Qwen Code E2E
    if: ${{ (inputs.ref_type || github.ref_type) != 'tag' && !inputs.skip_tests }}
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false
          ref: ${{ inputs.ref || github.sha }}

      - name: Set up Rust
        uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606 # v1.15.4
        with:
          toolchain: stable
          cache: false

      - name: Set up Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: adapters/typescript/package-lock.json

      - name: Install just
        uses: taiki-e/install-action@c070f87102a1c75b3183910f391c1cb887fe13c8 # v2.77.6
        with:
          tool: just@1.50.0

      - name: Set up uv
        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8

      - name: Create virtual environment
        run: uv venv --python 3.12 .venv

      - name: Install Qwen adapter dependencies
        run: |
          just install-typescript-qwen
          npm run build --prefix adapter-contract/typescript
          npm run build --prefix adapters/typescript --workspace nemo-fabric-adapters-common
          npm run build --prefix adapters/typescript --workspace nemo-fabric-adapters-qwen

      - name: Run deterministic Qwen E2E
        run: |
          uv sync --frozen --no-default-groups --group test --no-sources-package hermes-agent
          uv run --no-sync pytest tests/e2e/test_qwen.py -q

  build-wheels:
    name: Build wheels (${{ matrix.platform }})
    needs: [test, hermes]
    if: ${{ always() && (needs.test.result == 'success' || needs.test.result == 'skipped') && (needs.hermes.result == 'success' || needs.hermes.result == 'skipped') }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux-amd64
            runner: ubuntu-24.04
          - platform: linux-arm64
            runner: ubuntu-24.04-arm
          - platform: macos-arm64
            runner: macos-15
          - platform: windows-amd64
            runner: windows-2022
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 30
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false
          fetch-depth: 0
          ref: ${{ inputs.ref || github.sha }}

      - name: Set up Rust
        uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606 # v1.15.4
        with:
          toolchain: stable
          cache: false

      - name: Install just
        uses: taiki-e/install-action@c070f87102a1c75b3183910f391c1cb887fe13c8 # v2.77.6
        with:
          tool: just@1.50.0

      - name: Set up uv
        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8
        with:
          enable-cache: true
          cache-dependency-glob: uv.lock

      - name: Create virtual environment
        run: uv venv --python "${UV_PYTHON:-${{ 3.12 }}}" .venv

      - name: Set version from tag
        if: ${{ (inputs.ref_type || github.ref_type) == 'tag' }}
        env:
          RELEASE_VERSION: ${{ inputs.ref_name || github.ref_name }}
        run: just set-version "$RELEASE_VERSION"

      - name: Cache cargo build
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
        with:
          shared-key: fabric-python-wheels-${{ runner.os }}-${{ runner.arch }}

      - name: Build wheels
        run: just wheels

      - name: Validate wheel licenses
        run: just check-wheel-licenses

      - name: Upload wheels
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: python-wheels-${{ matrix.platform }}
          path: dist/*.whl
          if-no-files-found: error