mirror of
https://github.com/langchain-ai/langgraph.git
synced 2026-08-30 19:59:40 +02:00
Mason DaughertyandGitHub
11f4d3339f
Extract a composite GitHub Action for Python + uv setup, replacing 12
scattered `astral-sh/setup-uv@v7` calls with a single reusable
`uv_setup` action that scopes cache dependency globs per library. Also
tightens issue template language and fixes a broken expression in the
release-test workflow.
## Changes
- Add `.github/actions/uv_setup/action.yml` — composite action wrapping
`astral-sh/setup-uv@v7` with a `working-directory` input that scopes
`cache-dependency-glob` to `<dir>/pyproject.toml`, `<dir>/uv.lock`, and
`<dir>/requirements*.txt`
- Migrate all workflow files (`_test.yml`, `_lint.yml`,
`_test_langgraph.yml`, `_integration_test.yml`, `baseline.yml`,
`bench.yml`, `ci.yml`, `release.yml`, `_test_release.yml`,
`uv_lock_ugprade.yml`) from inline `astral-sh/setup-uv@v7` to
`./.github/actions/uv_setup`, passing library-specific
`working-directory` for cache scoping
- Fix typo in `_test_release.yml` step name: `$${ env.PYTHON_VERSION }}`
→ `${{ env.PYTHON_VERSION }}`
- Disable uv cache for the release smoke-test job (`enable-cache:
false`) since it installs from PyPI, not the local lockfile
- Update `config.yml` API reference URL to point to `/python/langgraph/`
instead of `/python/`
- Tighten `privileged.yml` — shorter description, add English language
policy link, add "do not begin work unless assigned" notice
98 lines
3.2 KiB
YAML
98 lines
3.2 KiB
YAML
name: test-release
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
working-directory:
|
|
required: true
|
|
type: string
|
|
description: "From which folder this pipeline executes"
|
|
|
|
env:
|
|
PYTHON_VERSION: "3.10"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
|
|
outputs:
|
|
pkg-name: ${{ steps.check-version.outputs.pkg-name }}
|
|
version: ${{ steps.check-version.outputs.version }}
|
|
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
- name: Set up Python ${{ env.PYTHON_VERSION }}
|
|
uses: ./.github/actions/uv_setup
|
|
with:
|
|
python-version: ${{ env.PYTHON_VERSION }}
|
|
cache-suffix: "release"
|
|
working-directory: ${{ inputs.working-directory }}
|
|
|
|
# We want to keep this build stage *separate* from the release stage,
|
|
# so that there's no sharing of permissions between them.
|
|
# The release stage has trusted publishing and GitHub repo contents write access,
|
|
# and we want to keep the scope of that access limited just to the release job.
|
|
# Otherwise, a malicious `build` step (e.g. via a compromised dependency)
|
|
# could get access to our GitHub or PyPI credentials.
|
|
#
|
|
# Per the trusted publishing GitHub Action:
|
|
# > It is strongly advised to separate jobs for building [...]
|
|
# > from the publish job.
|
|
# https://github.com/pypa/gh-action-pypi-publish#non-goals
|
|
- name: Build project for distribution
|
|
run: uv build
|
|
working-directory: ${{ inputs.working-directory }}
|
|
|
|
- name: Upload build
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: test-dist
|
|
path: ${{ inputs.working-directory }}/dist/
|
|
|
|
- name: Check Version
|
|
id: check-version
|
|
shell: bash
|
|
working-directory: ${{ inputs.working-directory }}
|
|
run: |
|
|
echo pkg-name=$(grep -m 1 "^name = " pyproject.toml | cut -d '"' -f 2)
|
|
echo version=$(grep -m 1 "^version = " pyproject.toml | cut -d '"' -f 2)
|
|
|
|
publish:
|
|
needs:
|
|
- build
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
# This permission is used for trusted publishing:
|
|
# https://blog.pypi.org/posts/2023-04-20-introducing-trusted-publishers/
|
|
#
|
|
# Trusted publishing has to also be configured on PyPI for each package:
|
|
# https://docs.pypi.org/trusted-publishers/adding-a-publisher/
|
|
id-token: write
|
|
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
- uses: actions/download-artifact@v8
|
|
with:
|
|
name: test-dist
|
|
path: ${{ inputs.working-directory }}/dist/
|
|
|
|
- name: Publish to test PyPI
|
|
uses: pypa/gh-action-pypi-publish@release/v1
|
|
with:
|
|
packages-dir: ${{ inputs.working-directory }}/dist/
|
|
verbose: true
|
|
print-hash: true
|
|
repository-url: https://test.pypi.org/legacy/
|
|
|
|
# We overwrite any existing distributions with the same name and version.
|
|
# This is *only for CI use* and is *extremely dangerous* otherwise!
|
|
# https://github.com/pypa/gh-action-pypi-publish#tolerating-release-package-file-duplicates
|
|
skip-existing: true
|
|
# Temp workaround since attestations are on by default as of gh-action-pypi-publish v1.11.0
|
|
attestations: false
|