ci_python.yml

# SPDX-FileCopyrightText: Copyright (c) 2025-2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

name: Python

on:
  workflow_call:
    inputs:
      ref_type:
        description: 'The ref type from the triggering workflow'
        required: true
        type: string
      ref_name:
        description: 'The ref name from the triggering workflow'
        required: true
        type: string
      run_package:
        description: 'Whether to build package artifacts'
        required: false
        default: true
        type: boolean
      run_integration_langchain:
        description: 'Whether to run LangChain, LangGraph, and DeepAgents Python integration tests'
        required: false
        default: false
        type: boolean
      run_integration_google_adk:
        description: 'Whether to run Google ADK Python integration tests'
        required: false
        default: false
        type: boolean
    secrets:
      CODECOV_TOKEN:
        required: false

defaults:
  run:
    shell: bash

env:
  GH_TOKEN: "${{ github.token }}"
  GIT_COMMIT: "${{ github.sha }}"
  NEMO_RELAY_CI_WORKSPACE: "${{ github.workspace }}"
  NEMO_RELAY_CI_WORKSPACE_TMP: "${{ github.workspace }}/tmp"
  UV_PYTHON_DOWNLOADS: never
  UV_PYTHON_PREFERENCE: only-system

jobs:
  Test:
    name: Test (${{ matrix.platform }})
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 30
    permissions:
      contents: read
    strategy:
      fail-fast: true
      matrix:
        include:
          - &linux-amd64
            platform: linux-amd64
            runner: ubuntu-latest
          - &linux-arm64
            platform: linux-arm64
            runner: ubuntu-24.04-arm
          - &macos-arm64
            platform: macos-arm64
            runner: macos-15
          - &windows-amd64
            platform: windows-amd64
            runner: windows-2022
          - &windows-arm64
            platform: windows-arm64
            runner: windows-11-arm

    steps:
      - name: Remove untrusted Homebrew tap
        if: ${{ runner.os == 'macOS' }}
        run: |
          if [ -d "$(brew --repository aws/tap)" ]; then
            brew untap aws/tap
          fi

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Load CI tool versions
        id: ci-config
        uses: ./.github/actions/load-ci-tool-versions

      - name: Set up Protoc
        id: protoc
        uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3
        with:
          version: ${{ steps.ci-config.outputs.protoc_version }}
          repo-token: ${{ github.token }}

      - name: Set up Buf
        uses: bufbuild/buf-setup-action@a47c93e0b1648d5651a065437926377d060baa99 # v1.50.0
        with:
          version: ${{ steps.ci-config.outputs.buf_version }}
          github_token: ${{ github.token }}

      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
        with:
          cache: false
          toolchain: ${{ steps.ci-config.outputs.rust_version }}
          components: llvm-tools

      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
        with:
          shared-key: nemo-relay-rust-${{ matrix.platform }}-${{ steps.ci-config.outputs.rust_version }}-python-debug
          workspaces: . -> target
          cache-all-crates: true
          cache-bin: false
          save-if: ${{ github.ref == 'refs/heads/main' }}

      - uses: taiki-e/install-action@c070f87102a1c75b3183910f391c1cb887fe13c8 # v2.77.6
        with:
          tool: cargo-llvm-cov@${{ steps.ci-config.outputs.cargo_llvm_cov_version }},cargo-nextest@${{ steps.ci-config.outputs.cargo_nextest_version }},just@${{ steps.ci-config.outputs.just_version }}

      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8
        with:
          version: ${{ steps.ci-config.outputs.uv_version }}
          enable-cache: true
          save-cache: ${{ github.ref == 'refs/heads/main' }}
          cache-dependency-glob: ${{ env.NEMO_RELAY_CI_WORKSPACE }}/uv.lock

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ steps.ci-config.outputs.default_python_version }}
      - name: Run Python tests with coverage
        working-directory: ${{ env.NEMO_RELAY_CI_WORKSPACE }}
        run: just --set ci true --set output_dir "${{ github.workspace }}" test-python

      - name: Run Python plugin end-to-end test
        if: >-
          ${{ matrix.platform == 'linux-amd64' ||
              matrix.platform == 'macos-arm64' ||
              matrix.platform == 'windows-amd64' }}
        working-directory: ${{ env.NEMO_RELAY_CI_WORKSPACE }}
        run: just test-python-plugin-e2e

      - name: Run Python LangChain integration tests
        if: ${{ inputs.run_integration_langchain && matrix.platform != 'windows-arm64' }}
        working-directory: ${{ env.NEMO_RELAY_CI_WORKSPACE }}
        run: just --set ci true --set output_dir "${{ github.workspace }}" test-python-langchain

      - name: Run Python Google ADK integration tests
        if: ${{ inputs.run_integration_google_adk && matrix.platform != 'windows-arm64' }}
        working-directory: ${{ env.NEMO_RELAY_CI_WORKSPACE }}
        run: just --set ci true --set output_dir "${{ github.workspace }}" test-python-google-adk

      - name: Upload Python coverage to Codecov
        id: codecov-upload
        continue-on-error: true
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          disable_search: true
          files: >-
            ${{ matrix.platform == 'windows-arm64' && 'python-coverage.xml'
                || inputs.run_integration_google_adk && 'python-coverage.xml,python-rust.lcov,python-google-adk-coverage.xml'
                || 'python-coverage.xml,python-rust.lcov' }}
          flags: python-${{ matrix.platform }}
          name: python-${{ matrix.platform }}
          verbose: true
          fail_ci_if_error: true

      - name: Record the failed Codecov upload
        if: ${{ steps.codecov-upload.outcome == 'failure' }}
        env:
          MARKER: codecov-upload-failed-python-${{ matrix.platform }}
        run: printf '%s\n' "$MARKER" > "$MARKER"

      - name: Keep the failed Codecov upload marker
        if: ${{ steps.codecov-upload.outcome == 'failure' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: codecov-upload-failed-python-${{ matrix.platform }}
          path: codecov-upload-failed-python-${{ matrix.platform }}

  Package:
    name: Package (${{ matrix.platform }})
    if: ${{ inputs.run_package }}
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 45
    permissions:
      contents: read
    strategy:
      fail-fast: true
      matrix:
        include:
          - *linux-amd64
          - *linux-arm64
          - *macos-arm64
          - *windows-amd64
          - *windows-arm64
          - &package-linux-musl-amd64
            platform: linux-musl-amd64
            architecture: x86_64
            rust_target: x86_64-unknown-linux-musl
            runner: ubuntu-latest
            container_image: quay.io/pypa/musllinux_1_2_x86_64@sha256:7b54360b191356838f6e41d4b9820c69be4f3d8dc8e7bca26f2684d48e5c8633
          - &package-linux-musl-arm64
            platform: linux-musl-arm64
            architecture: aarch64
            rust_target: aarch64-unknown-linux-musl
            runner: ubuntu-24.04-arm
            container_image: quay.io/pypa/musllinux_1_2_aarch64@sha256:274a947b4d5d745b56b868b0d052641e0798a652e3e65755987edf60547d1268

    steps:
      - name: Remove untrusted Homebrew tap
        if: ${{ runner.os == 'macOS' }}
        run: |
          if [ -d "$(brew --repository aws/tap)" ]; then
            brew untap aws/tap
          fi

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Load CI tool versions
        id: ci-config
        uses: ./.github/actions/load-ci-tool-versions

      - name: Set up Protoc
        id: protoc
        uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3
        with:
          version: ${{ steps.ci-config.outputs.protoc_version }}
          repo-token: ${{ github.token }}

      - name: Set up Buf
        uses: bufbuild/buf-setup-action@a47c93e0b1648d5651a065437926377d060baa99 # v1.50.0
        with:
          version: ${{ steps.ci-config.outputs.buf_version }}
          github_token: ${{ github.token }}

      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
        if: ${{ !contains(matrix.platform, 'musl') }}
        with:
          cache: false
          toolchain: ${{ steps.ci-config.outputs.rust_version }}

      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
        if: ${{ !contains(matrix.platform, 'musl') }}
        with:
          shared-key: nemo-relay-rust-${{ matrix.platform }}-${{ steps.ci-config.outputs.rust_version }}-python-release
          workspaces: . -> target
          cache-all-crates: true
          cache-bin: false
          save-if: ${{ github.ref == 'refs/heads/main' }}

      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8
        if: ${{ !contains(matrix.platform, 'musl') }}
        with:
          version: ${{ steps.ci-config.outputs.uv_version }}
          enable-cache: true
          save-cache: ${{ github.ref == 'refs/heads/main' }}
          cache-dependency-glob: ${{ env.NEMO_RELAY_CI_WORKSPACE }}/uv.lock

      - name: Set up Python
        if: ${{ !contains(matrix.platform, 'musl') }}
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ steps.ci-config.outputs.default_python_version }}

      - uses: taiki-e/install-action@c070f87102a1c75b3183910f391c1cb887fe13c8 # v2.77.6
        if: ${{ !contains(matrix.platform, 'musl') }}
        with:
          tool: just@${{ steps.ci-config.outputs.just_version }}

      - name: Create packaging output directory
        if: ${{ !contains(matrix.platform, 'musl') }}
        run: |
          set -e
          mkdir -p "${{ env.NEMO_RELAY_CI_WORKSPACE_TMP }}/wheels"

      - name: Derive Python package version
        working-directory: ${{ env.NEMO_RELAY_CI_WORKSPACE }}
        run: |
          set -e
          version="$(sed -n 's/^version = "\(.*\)"$/\1/p' Cargo.toml | head -n1)"
          if [ -z "$version" ]; then
            echo "Error: failed to read workspace version from Cargo.toml" >&2
            exit 1
          fi
          sha="${GITHUB_SHA::8}"
          if [ "${{ inputs.ref_type }}" = "tag" ]; then
            version="${{ inputs.ref_name }}"
          else
            version="${version}+${sha}"
          fi
          printf 'NEMO_RELAY_PACKAGE_VERSION=%s\n' "$version" >> "$GITHUB_ENV"

      - name: Package Python wheel
        if: ${{ !contains(matrix.platform, 'musl') }}
        working-directory: ${{ env.NEMO_RELAY_CI_WORKSPACE }}
        run: |
          set -e
          just \
            --set output_dir "${{ env.NEMO_RELAY_CI_WORKSPACE_TMP }}" \
            --set ref_name "${NEMO_RELAY_PACKAGE_VERSION}" \
            package-python

      - name: Upload wheel artifact
        if: ${{ !contains(matrix.platform, 'musl') }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: wheel-${{ matrix.platform }}
          path: ${{ env.NEMO_RELAY_CI_WORKSPACE_TMP }}/wheels/*.whl
          if-no-files-found: error

      - name: Package Python source distribution
        if: ${{ matrix.platform == 'linux-amd64' }}
        working-directory: ${{ env.NEMO_RELAY_CI_WORKSPACE }}
        run: |
          set -e
          just \
            --set output_dir "${{ env.NEMO_RELAY_CI_WORKSPACE_TMP }}" \
            --set ref_name "${NEMO_RELAY_PACKAGE_VERSION}" \
            package-python-sdist

      - name: Upload Python source distribution artifact
        if: ${{ matrix.platform == 'linux-amd64' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: python-sdist
          path: ${{ env.NEMO_RELAY_CI_WORKSPACE_TMP }}/sdists/nemo_relay-*.tar.gz
          if-no-files-found: error

      - name: Package Python plugin SDK wheel
        if: ${{ matrix.platform == 'linux-amd64' }}
        working-directory: ${{ env.NEMO_RELAY_CI_WORKSPACE }}
        run: |
          set -e
          just \
            --set output_dir "${{ env.NEMO_RELAY_CI_WORKSPACE_TMP }}" \
            --set ref_name "${NEMO_RELAY_PACKAGE_VERSION}" \
            package-python-plugin

      - name: Upload Python plugin SDK wheel artifact
        if: ${{ matrix.platform == 'linux-amd64' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: plugin-wheel
          path: ${{ env.NEMO_RELAY_CI_WORKSPACE_TMP }}/plugin-wheels/*.whl
          if-no-files-found: error

      - name: Derive Maturin version
        if: ${{ contains(matrix.platform, 'musl') }}
        run: |
          set -euo pipefail
          maturin_version="$(awk '
            $0 == "name = \"maturin\"" { found = 1; next }
            found && /^version = / {
              gsub(/"/, "", $3)
              print $3
              exit
            }
          ' uv.lock)"
          if [[ -z "$maturin_version" ]]; then
            echo "Error: failed to read maturin version from uv.lock" >&2
            exit 1
          fi
          printf 'NEMO_RELAY_MATURIN_VERSION=%s\n' "$maturin_version" >> "$GITHUB_ENV"

      - name: Create musllinux packaging output directory
        if: ${{ contains(matrix.platform, 'musl') }}
        run: |
          set -euo pipefail
          mkdir -p "${{ env.NEMO_RELAY_CI_WORKSPACE_TMP }}/musllinux-wheels"

      - name: Stage musllinux packaging source
        if: ${{ contains(matrix.platform, 'musl') }}
        working-directory: ${{ env.NEMO_RELAY_CI_WORKSPACE }}
        run: |
          set -euo pipefail
          python3 scripts/package_python_musllinux.py \
            --version "$NEMO_RELAY_PACKAGE_VERSION" \
            --source-out "${{ env.NEMO_RELAY_CI_WORKSPACE_TMP }}/musllinux-source"
          cp "$(command -v buf)" "${{ env.NEMO_RELAY_CI_WORKSPACE_TMP }}/buf"
          cp "$(command -v protoc)" "${{ env.NEMO_RELAY_CI_WORKSPACE_TMP }}/protoc"
          mkdir -p "${{ env.NEMO_RELAY_CI_WORKSPACE_TMP }}/protoc-include"
          cp -R "${{ steps.protoc.outputs.path }}/include/google" "${{ env.NEMO_RELAY_CI_WORKSPACE_TMP }}/protoc-include/"

      - name: Build musllinux wheel
        if: ${{ contains(matrix.platform, 'musl') }}
        env:
          # Use the host musl loader for native plugins; Rust crates stay static.
          RUSTFLAGS: -C target-feature=-crt-static
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          maturin-version: v${{ env.NEMO_RELAY_MATURIN_VERSION }}
          manylinux: musllinux_1_2
          container: ${{ matrix.container_image }}
          docker-options: >-
            --volume "${{ env.NEMO_RELAY_CI_WORKSPACE_TMP }}/buf:/usr/local/bin/buf:ro"
            --volume "${{ env.NEMO_RELAY_CI_WORKSPACE_TMP }}/protoc:/usr/local/bin/protoc:ro"
            --volume "${{ env.NEMO_RELAY_CI_WORKSPACE_TMP }}/protoc-include/google:/usr/local/include/google:ro"
          target: ${{ matrix.rust_target }}
          rust-toolchain: ${{ steps.ci-config.outputs.rust_version }}
          working-directory: tmp/musllinux-source
          args: >-
            --locked --release
            --interpreter /opt/python/cp311-cp311/bin/python
            --out ${{ env.NEMO_RELAY_CI_WORKSPACE_TMP }}/musllinux-wheels

      - name: Verify musllinux wheel platform tag
        if: ${{ contains(matrix.platform, 'musl') }}
        run: |
          set -euo pipefail
          shopt -s nullglob
          wheels=("${{ env.NEMO_RELAY_CI_WORKSPACE_TMP }}/musllinux-wheels"/*-cp311-abi3-musllinux_1_2_${{ matrix.architecture }}.whl)
          if [[ "${#wheels[@]}" -ne 1 ]]; then
            echo "Error: expected one cp311-abi3 musllinux wheel for ${{ matrix.architecture }}, found ${#wheels[@]}" >&2
            exit 1
          fi

      - name: Upload musllinux wheel artifact
        if: ${{ contains(matrix.platform, 'musl') }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: wheel-${{ matrix.platform }}
          path: ${{ env.NEMO_RELAY_CI_WORKSPACE_TMP }}/musllinux-wheels/*.whl
          if-no-files-found: error

  PackageSmoke:
    name: Package smoke (${{ matrix.platform }})
    needs: [Package]
    if: ${{ inputs.run_package && !cancelled() && needs.Package.result == 'success' }}
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 30
    permissions:
      contents: read
    strategy:
      fail-fast: true
      matrix:
        include:
          - *linux-amd64
          - *linux-arm64
          - *macos-arm64
          - *windows-amd64
          - *windows-arm64
          - *package-linux-musl-amd64
          - *package-linux-musl-arm64
          - platform: source-and-plugin
            runner: ubuntu-latest

    steps:
      - name: Remove untrusted Homebrew tap
        if: ${{ runner.os == 'macOS' }}
        run: |
          if [ -d "$(brew --repository aws/tap)" ]; then
            brew untap aws/tap
          fi

      - name: Checkout
        if: ${{ !contains(matrix.platform, 'musl') }}
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Load CI tool versions
        if: ${{ !contains(matrix.platform, 'musl') }}
        id: ci-config
        uses: ./.github/actions/load-ci-tool-versions

      - name: Set up Protoc
        if: ${{ !contains(matrix.platform, 'musl') }}
        id: protoc
        uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3
        with:
          version: ${{ steps.ci-config.outputs.protoc_version }}
          repo-token: ${{ github.token }}

      - name: Set up Buf
        if: ${{ !contains(matrix.platform, 'musl') }}
        uses: bufbuild/buf-setup-action@a47c93e0b1648d5651a065437926377d060baa99 # v1.50.0
        with:
          version: ${{ steps.ci-config.outputs.buf_version }}
          github_token: ${{ github.token }}

      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
        if: ${{ matrix.platform == 'source-and-plugin' }}
        with:
          cache: false
          toolchain: ${{ steps.ci-config.outputs.rust_version }}

      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
        if: ${{ matrix.platform == 'source-and-plugin' }}
        with:
          shared-key: nemo-relay-rust-linux-amd64-${{ steps.ci-config.outputs.rust_version }}-python-release
          workspaces: . -> target
          cache-all-crates: true
          cache-bin: false
          save-if: false

      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8
        if: ${{ !contains(matrix.platform, 'musl') }}
        with:
          version: ${{ steps.ci-config.outputs.uv_version }}
          enable-cache: false

      - name: Set up Python
        if: ${{ !contains(matrix.platform, 'musl') }}
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ steps.ci-config.outputs.default_python_version }}

      - name: Download matching Python wheel artifact
        if: ${{ !contains(matrix.platform, 'musl') && matrix.platform != 'source-and-plugin' }}
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: wheel-${{ matrix.platform }}
          path: python-wheel/

      - name: Install and import Python wheel
        if: ${{ !contains(matrix.platform, 'musl') && matrix.platform != 'source-and-plugin' }}
        run: |
          set -euo pipefail
          wheel="$(find python-wheel -maxdepth 1 -name '*.whl' -print -quit)"
          test -n "$wheel"
          uv venv --python "$(uv python find)" "${RUNNER_TEMP}/nemo-relay-wheel-venv"
          if [ "${{ runner.os }}" = "Windows" ]; then
            venv_python="${RUNNER_TEMP}/nemo-relay-wheel-venv/Scripts/python.exe"
          else
            venv_python="${RUNNER_TEMP}/nemo-relay-wheel-venv/bin/python"
          fi
          # SONAR_IGNORE_START: local wheel with no dependencies or index access.
          uv pip install --python "$venv_python" --no-deps --no-index "$wheel"
          # SONAR_IGNORE_END
          "$venv_python" -c "import nemo_relay"

      - name: Download matching musllinux Python wheel artifact
        if: ${{ contains(matrix.platform, 'musl') }}
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: wheel-${{ matrix.platform }}
          path: python-wheel/

      - name: Install and import musllinux Python wheel
        if: ${{ contains(matrix.platform, 'musl') }}
        env:
          MUSLLINUX_IMAGE: ${{ matrix.container_image }}
        run: |
          set -euo pipefail
          docker run --rm \
            --volume "${{ github.workspace }}:${{ github.workspace }}" \
            --workdir "${{ github.workspace }}" \
            "$MUSLLINUX_IMAGE" \
            /bin/sh -ec '
              wheel="$(find python-wheel -maxdepth 1 -name "*.whl" -print -quit)"
              test -n "$wheel"
              /opt/python/cp311-cp311/bin/python -m venv /tmp/nemo-relay-wheel-venv
              /tmp/nemo-relay-wheel-venv/bin/python -m pip install --no-deps "$wheel"
              /tmp/nemo-relay-wheel-venv/bin/python -c "import nemo_relay"
            '

      - name: Download Python source distribution artifact
        if: ${{ matrix.platform == 'source-and-plugin' }}
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: python-sdist
          path: python-sdist/

      - name: Download Python plugin SDK wheel artifact
        if: ${{ matrix.platform == 'source-and-plugin' }}
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: plugin-wheel
          path: plugin-wheel/

      - name: Build, install, and import Python source distribution
        if: ${{ matrix.platform == 'source-and-plugin' }}
        env:
          # The sdist builds outside the checkout's rustup directory override.
          RUSTUP_TOOLCHAIN: ${{ steps.ci-config.outputs.rust_version }}
        run: |
          set -euo pipefail
          sdist="$(find python-sdist -maxdepth 1 -name '*.tar.gz' -print -quit)"
          test -n "$sdist"
          uv venv --python "$(uv python find)" "${RUNNER_TEMP}/nemo-relay-sdist-venv"
          build_constraints="${RUNNER_TEMP}/nemo-relay-build-constraints.txt"
          uv export --frozen --only-group dev --no-emit-project --no-emit-workspace --no-annotate --no-header --output-file "$build_constraints"
          # SONAR_IGNORE_START: build constraints lock the sdist backend from uv.lock.
          uv pip install --python "${RUNNER_TEMP}/nemo-relay-sdist-venv/bin/python" --build-constraints "$build_constraints" --no-deps "$sdist"
          # SONAR_IGNORE_END
          "${RUNNER_TEMP}/nemo-relay-sdist-venv/bin/python" -c "import nemo_relay"

      - name: Install and import Python plugin SDK wheel
        if: ${{ matrix.platform == 'source-and-plugin' }}
        run: |
          set -euo pipefail
          wheel="$(find plugin-wheel -maxdepth 1 -name '*.whl' -print -quit)"
          test -n "$wheel"
          uv venv --python "$(uv python find)" "${RUNNER_TEMP}/nemo-relay-plugin-venv"
          plugin_requirements="${RUNNER_TEMP}/nemo-relay-plugin-requirements.txt"
          uv export --frozen --package nemo-relay-plugin --no-dev --no-emit-project --no-emit-workspace --no-annotate --no-header --output-file "$plugin_requirements"
          uv pip install --python "${RUNNER_TEMP}/nemo-relay-plugin-venv/bin/python" --require-hashes --no-deps -r "$plugin_requirements"
          # SONAR_IGNORE_START: local wheel with no dependencies or index access.
          uv pip install --python "${RUNNER_TEMP}/nemo-relay-plugin-venv/bin/python" --no-deps --no-index "$wheel"
          # SONAR_IGNORE_END
          "${RUNNER_TEMP}/nemo-relay-plugin-venv/bin/python" -c \
            "import nemo_relay_plugin._proto.nvidia.nemo.relay.worker.v1.plugin_worker_service_pb2_grpc"