ci: run Python SDK and sample regression tests - #325
Conversation
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
|
Nice work, @arjun2075, clean scope, clean sequencing, and good call documenting the expected red baseline instead of mixing fixes into the CI PR. |
|
Thanks — really appreciate the review. That separation was intentional: I wanted the CI change to make the existing contract visible without bundling in behavioral fixes just to get a green baseline. Once #310 and #313 land, I’ll rebase onto main, rerun both Python suites, and update the draft with the resulting green baseline before marking it ready for review. |
verify() only called verify_expected_claims under if typ in TYP_TERMINAL, so on an intermediate hop (typ kb+sd-jwt+kb) a caller that passes expected_aud or expected_nonce got no check at all. That is why test_verify_rejects_aud_mismatch and test_verify_rejects_nonce_mismatch fail on main. Move the check out of the terminal guard so it runs on every hop. Matches the verify() docstring (expected match is a general check) and create() (which already requires aud and nonce on every hop). Mandatory presence of expected_aud/expected_nonce when a terminal hop carries those claims is intentionally deferred to a follow-up so this change can land as a clean green baseline for google-agentic-commerce#325. Signed-off-by: SashaMIT <sash.t.mitchell@gmail.com>
The repo-wide BIOME_LINT job fails on pre-existing code/web-client/** errors unrelated to this PR (same red on google-agentic-commerce#313/google-agentic-commerce#325). Add a root biome.json that scopes Biome off the web-client, per chopmob-cloud's note; took Lint Code Base green on google-agentic-commerce#279. Co-authored-by: Cursor <cursoragent@cursor.com>
The repo-wide BIOME_LINT job fails on pre-existing code/web-client/** errors unrelated to this PR (same red on google-agentic-commerce#313/google-agentic-commerce#325). Add a root biome.json that scopes Biome off the web-client, per chopmob-cloud' note; took Lint Code Base green on google-agentic-commerce#279.
|
Status note: #325 is unchanged and still intentionally CI-only. The current red Python baseline is expected pending #313 , and the sample suite becomes available via #310 . Once those land I'll rebase onto main, rerun the combined job, and update this PR with the green baseline. No action needed from the follow-up PRs referencing #325 — they'll be picked up automatically once this CI job lands. |
|
One thing the baseline note doesn't cover: Lint Code Base is the #306 condition, not a consequence of #313 or #310. It fails on main too. #310 disables VALIDATE_BIOME_LINT in the workflow; #313 and #326 carry a root biome.json scoping Biome off code/web-client and docs/assets/**/*.svg. Whichever lands first will clear it for you on rebase - worth knowing which, so the second run isn't confusing either. |
2 participants
Description
The Python SDK tests (
code/sdk/python/ap2/tests/) and the sample regression tests(
code/samples/python/tests/) are not currently executed by any GitHub Actionsworkflow, so regressions in either suite are only caught when a contributor runs
pytest locally.
This PR adds a single Python 3.12 CI job that syncs the AP2 uv workspace once and
then runs both suites.
What this changes
.github/workflows/python-tests.yml— one job, on pushes tomainand pullrequests targeting
mainuv sync --all-packages, then runs both suites withuv run --no-syncso they reuse that environment instead of re-resolving per stepWhat this deliberately does not change
uv.lock(removed in fix: remove uvlock #246), so the workflow resolves the workspace at run time, matching the
repository's current setup. This PR does not reintroduce a lockfile.
paths:filter initially, so the check behaves predictably on every PR ratherthan depending on workflow-level path skipping. Straightforward to narrow if
maintainers prefer lower CI usage.
small, and a minimum-supported-version matrix is a reasonable follow-up.
Workflow hardening
Third-party actions are pinned to immutable commit SHAs,
persist-credentials: falseis set on checkout, workflow permissions are
contents: read, and the job is boundedwith
timeout-minutes: 15. These are defensive choices rather than an existingrepository-wide requirement.
Current status — draft
This is opened as a draft because the checks are expected to be red on the current
mainbaseline:code/samples/python/tests/does not exist onmainyet — it is added by fix(samples): fail closed in x402 PSP when agent-provider key is missing #310, sothe sample step currently collects no tests.
main(
kb_sd_jwt_intermediate_tests.py::test_verify_rejects_aud_mismatchand::test_verify_rejects_nonce_mismatch) are addressed by fix(sdjwt): honor expected aud/nonce on every KB hop #313.Local run on Python 3.12 against this branch: SDK suite 186 passed / 2 failed (the two
above), sample suite 0 collected. This PR intentionally does not modify
kb_sd_jwt,the failing tests, or #310 — it only adds the workflow. Once #310 and #313 land, this
branch will be rebased so the check can be evaluated against a green baseline.
The sample-test coverage motivation came out of the discussion on #310, which notes
that no CI job currently runs the sample pytest suite. This PR does not fix #310.
CONTRIBUTINGGuide.