hatchet/.github/workflows/sdk-python.yml

name: python
on:
  pull_request:
    paths:
      - ".github/**"
      - "api/**"
      - "api-contracts/**"
      - "internal/**"
      - "pkg/**"
      - "sdks/python/**"
  push:
    branches:
      - main
    paths:
      - "sdks/python/**"

defaults:
  run:
    working-directory: ./sdks/python

jobs:
  lint:
    runs-on: ubicloud-standard-4
    strategy:
      matrix:
        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install Poetry
        uses: snok/install-poetry@76e04a911780d5b312d89783f7b1cd627778900a # v1.4.1
        with:
          version: 2.3.0
          virtualenvs-create: true
          virtualenvs-in-project: true

      - name: Install linting tools
        run: poetry install --all-extras

      - name: Run Black
        run: poetry run black . --check --verbose --diff --color

      - name: Run MyPy
        run: poetry run mypy --config-file=pyproject.toml

      - name: Run Ruff
        run: poetry run ruff check .

      - name: Run Pydoclint
        run: poetry run pydoclint .

      - name: Test install
        run: pip install -e .

  test:
    runs-on: ubicloud-standard-4
    strategy:
      matrix:
        python-version: ${{ github.event_name == 'pull_request' && fromJSON('["3.14"]') || fromJSON('["3.10", "3.11", "3.12", "3.13", "3.14"]') }}
        optimistic-scheduling: ["true", "false"]
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install Protoc
        uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
        with:
          version: "25.1"
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Install Task
        uses: arduino/setup-task@b91d5d2c96a56797b48ac1e0e89220bf64044611 # v2.0.0
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: "1.25"

      - name: Start Docker dependencies
        working-directory: .
        run: docker compose up -d

      - name: Generate
        working-directory: .
        run: |
          export DATABASE_URL="postgresql://hatchet:hatchet@127.0.0.1:5431/hatchet"
          go run ./cmd/hatchet-migrate

      - name: Setup
        working-directory: .
        run: |
          export SEED_DEVELOPMENT=true
          export SERVER_PORT=8080
          export SERVER_URL=http://localhost:8080
          export SERVER_AUTH_COOKIE_DOMAIN=localhost
          export SERVER_AUTH_COOKIE_INSECURE=true
          export SERVER_DEFAULT_ENGINE_VERSION=V1
          export SERVER_MSGQUEUE_RABBITMQ_URL="amqp://user:password@localhost:5672/"
          export SERVER_OPTIMISTIC_SCHEDULING_ENABLED=${{ matrix.optimistic-scheduling }}
          export SERVER_OBSERVABILITY_ENABLED=true

          go run ./cmd/hatchet-admin quickstart

          go run ./cmd/hatchet-engine --config ./generated/ > engine.log 2>&1 &
          go run ./cmd/hatchet-api --config ./generated/ > api.log 2>&1 &

          sleep 30
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: ${{ matrix.python-version }}

      - name: Display Python version
        run: python -c "import sys; print(sys.version)"

      - name: Install Poetry
        uses: snok/install-poetry@76e04a911780d5b312d89783f7b1cd627778900a # v1.4.1
        with:
          version: 2.3.0
          virtualenvs-create: true
          virtualenvs-in-project: true

      - name: Install dependencies
        run: poetry install --no-interaction --all-extras

      - name: Generate Env File
        working-directory: .
        run: |
          echo "HATCHET_CLIENT_TOKEN=$(go run ./cmd/hatchet-admin token create --config ./generated/ --tenant-id 707d0855-80ab-4e1f-a156-f1c4546cbf52)" >> $GITHUB_ENV
          echo "HATCHET_CLIENT_TLS_ROOT_CA_FILE=../../certs/ca.cert" >> $GITHUB_ENV
          echo "HATCHET_CLIENT_WORKER_HEALTHCHECK_ENABLED=True" >> $GITHUB_ENV

      - name: Set HATCHET_CLIENT_NAMESPACE
        run: |
          PYTHON_VERSION=$(python -c "import sys; print(f'py{sys.version_info.major}{sys.version_info.minor}')")
          SHORT_SHA=$(git rev-parse --short HEAD)
          echo "HATCHET_CLIENT_NAMESPACE=${PYTHON_VERSION}-${SHORT_SHA}" >> $GITHUB_ENV

      - name: Run pytest
        run: |
          echo "Using HATCHET_CLIENT_NAMESPACE: $HATCHET_CLIENT_NAMESPACE"

          poetry run pytest -s -vvv --maxfail=5 --capture=no --retries 3 --retry-delay 2 -n auto

      - name: Upload engine logs
        if: always()
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: ${{ env.HATCHET_CLIENT_NAMESPACE }}-opt-${{ matrix.optimistic-scheduling }}-engine-logs
          path: engine.log

      - name: Upload API logs
        if: always()
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: ${{ env.HATCHET_CLIENT_NAMESPACE }}-opt-${{ matrix.optimistic-scheduling }}-api-logs
          path: api.log

  old-engine-new-sdk:
    runs-on: ubicloud-standard-4
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          fetch-tags: true

      - name: Setup Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: "1.25"

      - name: Start Docker dependencies
        working-directory: .
        run: docker compose up -d

      - name: Determine latest stable release tag
        working-directory: .
        run: |
          LATEST_TAG=$(git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | head -1)
          if [ -z "$LATEST_TAG" ]; then
            echo "ERROR: No stable release tag found"
            exit 1
          fi
          echo "Latest stable tag: $LATEST_TAG"
          echo "LATEST_TAG=$LATEST_TAG" >> $GITHUB_ENV

      - name: Pull release images
        working-directory: .
        run: docker compose -f docker-compose.yml -f docker-compose.release.yml pull hatchet-migrate hatchet-admin hatchet-engine hatchet-api

      - name: Run migrations
        working-directory: .
        run: docker compose -f docker-compose.yml -f docker-compose.release.yml run --rm hatchet-migrate

      - name: Setup config and seed database
        working-directory: .
        run: |
          mkdir -p generated
          docker compose -f docker-compose.yml -f docker-compose.release.yml run --rm \
            hatchet-admin /hatchet/hatchet-admin quickstart --skip certs --generated-config-dir /hatchet/generated

      - name: Generate API token
        working-directory: .
        run: |
          TOKEN=$(docker compose -f docker-compose.yml -f docker-compose.release.yml run -T --rm \
            hatchet-admin /hatchet/hatchet-admin token create --config /hatchet/generated --tenant-id 707d0855-80ab-4e1f-a156-f1c4546cbf52)
          echo "HATCHET_CLIENT_TOKEN=$TOKEN" >> $GITHUB_ENV

      - name: Start engine and API
        working-directory: .
        run: |
          docker compose -f docker-compose.yml -f docker-compose.release.yml up -d hatchet-engine hatchet-api
          sleep 30

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: '3.14'

      - name: Install Poetry
        uses: snok/install-poetry@76e04a911780d5b312d89783f7b1cd627778900a # v1.4.1
        with:
          version: 2.3.0
          virtualenvs-create: true
          virtualenvs-in-project: true

      - name: Install dependencies
        run: poetry install --no-interaction --all-extras

      - name: Set HATCHET_CLIENT_NAMESPACE
        run: |
          SHORT_SHA=$(git rev-parse --short HEAD)
          echo "HATCHET_CLIENT_NAMESPACE=old-engine-new-sdk-${SHORT_SHA}" >> $GITHUB_ENV

      - name: Run pytest
        env:
          HATCHET_CLIENT_TLS_STRATEGY: none
          HATCHET_CLIENT_WORKER_HEALTHCHECK_ENABLED: "True"
        run: |
          echo "Testing current SDK against engine ${{ env.LATEST_TAG }}"
          echo "Using HATCHET_CLIENT_NAMESPACE: $HATCHET_CLIENT_NAMESPACE"
          poetry run pytest -s -vvv --maxfail=5 --capture=no --retries 3 --retry-delay 2 -n auto

      - name: Collect engine logs
        if: always()
        working-directory: .
        run: docker compose -f docker-compose.yml -f docker-compose.release.yml logs hatchet-engine > /tmp/engine.log 2>&1 || true

      - name: Upload engine logs
        if: always()
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: ${{ env.HATCHET_CLIENT_NAMESPACE }}-engine-logs
          path: /tmp/engine.log

      - name: Collect API logs
        if: always()
        working-directory: .
        run: docker compose -f docker-compose.yml -f docker-compose.release.yml logs hatchet-api > /tmp/api.log 2>&1 || true

      - name: Upload API logs
        if: always()
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: ${{ env.HATCHET_CLIENT_NAMESPACE }}-api-logs
          path: /tmp/api.log

      - name: Teardown
        if: always()
        working-directory: .
        run: docker compose -f docker-compose.yml -f docker-compose.release.yml down

  new-engine-old-sdk:
    runs-on: ubicloud-standard-4
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          fetch-tags: true

      - name: Setup Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: "1.25"

      - name: Start Docker dependencies
        working-directory: .
        run: docker compose up -d

      - name: Run migrations
        working-directory: .
        run: |
          export DATABASE_URL="postgresql://hatchet:hatchet@127.0.0.1:5431/hatchet"
          go run ./cmd/hatchet-migrate

      - name: Setup and start engine
        working-directory: .
        run: |
          export SEED_DEVELOPMENT=true
          export SERVER_PORT=8080
          export SERVER_URL=http://localhost:8080
          export SERVER_AUTH_COOKIE_DOMAIN=localhost
          export SERVER_AUTH_COOKIE_INSECURE=true
          export SERVER_DEFAULT_ENGINE_VERSION=V1
          export SERVER_MSGQUEUE_RABBITMQ_URL="amqp://user:password@localhost:5672/"

          go run ./cmd/hatchet-admin quickstart

          go run ./cmd/hatchet-engine --config ./generated/ > engine.log 2>&1 &
          go run ./cmd/hatchet-api --config ./generated/ > api.log 2>&1 &

          sleep 30

      - name: Generate API token
        working-directory: .
        run: |
          echo "HATCHET_CLIENT_TOKEN=$(go run ./cmd/hatchet-admin token create --config ./generated/ --tenant-id 707d0855-80ab-4e1f-a156-f1c4546cbf52)" >> $GITHUB_ENV
          echo "HATCHET_CLIENT_TLS_ROOT_CA_FILE=${{ github.workspace }}/certs/ca.cert" >> $GITHUB_ENV
          echo "HATCHET_CLIENT_WORKER_HEALTHCHECK_ENABLED=True" >> $GITHUB_ENV

      - name: Clone main SDK source
        run: |
          git clone --depth=1 --branch main https://github.com/hatchet-dev/hatchet.git /tmp/old-sdk

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: '3.14'

      - name: Install Poetry
        uses: snok/install-poetry@76e04a911780d5b312d89783f7b1cd627778900a # v1.4.1
        with:
          version: 2.3.0
          virtualenvs-create: true
          virtualenvs-in-project: true

      - name: Install SDK and test dependencies
        working-directory: /tmp/old-sdk/sdks/python
        run: poetry install --no-interaction --all-extras

      - name: Set HATCHET_CLIENT_NAMESPACE
        run: |
          SHORT_SHA=$(git rev-parse --short HEAD)
          echo "HATCHET_CLIENT_NAMESPACE=new-engine-old-sdk-${SHORT_SHA}" >> $GITHUB_ENV

      - name: Run pytest against new engine
        working-directory: /tmp/old-sdk/sdks/python
        run: |
          echo "Testing main SDK against current engine"
          echo "Using HATCHET_CLIENT_NAMESPACE: $HATCHET_CLIENT_NAMESPACE"
          poetry run pytest -s -vvv --maxfail=5 --capture=no --retries 3 --retry-delay 2 -n auto

      - name: Upload engine logs
        if: always()
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: ${{ env.HATCHET_CLIENT_NAMESPACE }}-engine-logs
          path: engine.log

      - name: Upload API logs
        if: always()
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: ${{ env.HATCHET_CLIENT_NAMESPACE }}-api-logs
          path: api.log

  publish:
    runs-on: ubicloud-standard-4
    needs: [lint, test]
    if: github.ref == 'refs/heads/main'
    steps:
      - name: Checkout Repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.x"

      - name: Install Poetry
        run: |
          pipx install poetry==2.3.0

      - name: Run publish.sh script
        run: |
          CURRENT_PYPI_VERSION=$(pip index versions hatchet-sdk | awk 'NR==1 {gsub(/[()]/,"",$2); print $2}')
          NEW_VERSION=$(cat pyproject.toml| grep "^version =" | cut -d '"' -f 2)

          if [ "$CURRENT_PYPI_VERSION" == "$NEW_VERSION" ]; then
            echo "Version has not changed. Skipping publish."
            exit 0
          fi

          sh publish.sh
        env:
          POETRY_PYPI_TOKEN_PYPI: ${{ secrets.POETRY_PYPI_TOKEN_PYPI }}