diff --git a/.agents/skills/release-captain/SKILL.md b/.agents/skills/release-captain/SKILL.md index 5950a9b08c..6395ccc759 100644 --- a/.agents/skills/release-captain/SKILL.md +++ b/.agents/skills/release-captain/SKILL.md @@ -169,8 +169,7 @@ git worktree remove --force "$wt" ``` 4. **Watch and verify.** Check that `Select Qualified Prerelease` names the - approved candidate, the GitHub Release has assets, no job failed, and the - wheel reached PyPI: + approved candidate, the GitHub Release has assets and no job failed: ```shell gh run watch --exit-status diff --git a/.agents/skills/release-openshell/SKILL.md b/.agents/skills/release-openshell/SKILL.md index aca2a98f63..a56ef01c7c 100644 --- a/.agents/skills/release-openshell/SKILL.md +++ b/.agents/skills/release-openshell/SKILL.md @@ -33,8 +33,8 @@ Release creates `vX.Y.Z` at that exact commit, then rebuilds and publishes all stable artifacts without rerunning qualification. Embedded versions change, so stable artifacts are not byte-identical to the qualified prerelease. An existing stable tag may be retried only if it already points to the selected commit. A retry -publishes only missing artifacts; published images, charts, release assets, npm, -and PyPI versions are kept, while the snap is uploaded again. +publishes only missing artifacts; published images, charts, release assets, and +npm versions are kept, while the snap is uploaded again. Stable images are saved as OCI archives during the build and pushed under the stable version tags during publication. Their SBOMs are verified before updating `latest`; the qualified prerelease's commit-SHA image tags remain unchanged. @@ -84,17 +84,6 @@ immutable version and advance latest only for a newer version. Watch the stable release run and report its result. -## PyPI publishing +## Python SDK -Stable releases publish the Python wheel to PyPI from `wheel-publish.yml`, which the `publish-pypi` job in `release-publish.yml` calls after the GitHub Release is created. The workflow downloads the wheel from the stable GitHub Release, not a run's build artifact, and checks the stable tag's source commit and the wheel's release checksum. It uses Trusted Publishing with the `pypi` GitHub environment. PyPI matches the workflow file that contains the publishing job, so configure the `openshell` PyPI project's GitHub publisher with owner `NVIDIA`, repository `OpenShell`, workflow `wheel-publish.yml`, and environment `pypi`. No PyPI API token or GitLab trigger credentials are required. - -The environment must allow the branch used to dispatch Release or `wheel-publish.yml`. For a support release, explicitly allow its support branch before dispatching. Required reviewers, if configured, must approve the PyPI job. An existing wheel on PyPI is skipped; PyPI does not allow replacing a published wheel. - -If a stable release did not reach PyPI, publish the wheel without rerunning Release: - -```shell -gh workflow run wheel-publish.yml -R NVIDIA/OpenShell --ref main \ - -f release-tag=vX.Y.Z -f source-sha= -f python-version=X.Y.Z -``` - -Development and prerelease wheels remain GitHub Release assets and do not publish to PyPI. +Core no longer builds or publishes the Python SDK for releases. Stable and prerelease GitHub Releases carry no wheel, and nothing in core publishes to PyPI. `openshell` `0.1.7` is the last core-built wheel. From `0.1.8` on, [ai-openshell/sdk-python](https://github.com/ai-openshell/sdk-python) publishes `openshell` on the same day as each stable core release, once its update PR for the core tag merges. The rolling `dev` release still attaches a development wheel until the SDK sources leave core (NVIDIA/OpenShell#5287). diff --git a/.github/workflows/branch-checks.yml b/.github/workflows/branch-checks.yml index db22a74913..cd43df42e2 100644 --- a/.github/workflows/branch-checks.yml +++ b/.github/workflows/branch-checks.yml @@ -598,6 +598,9 @@ jobs: - name: Test run: mise run test:python + - name: Test Python scripts + run: mise run test:python-scripts + - name: Test local gateway configuration helpers run: | bash tasks/scripts/test-gateway-pull-policy.sh @@ -638,6 +641,42 @@ jobs: echo "$changed" exit 1 + python-sdk-freeze: + # The Python SDK moved to ai-openshell/sdk-python (#5287), which imported it + # at v0.1.7. Its files stay only until core removes them, so PRs must not + # add or change them. Deleting files is allowed (the removal PR). The paths + # are the ones the import moved: all of python/ plus the two SDK build + # scripts. The shared root pyproject.toml and uv.lock stay editable. + # Merge queue runs skip this job; the PR already passed it on its mirror. + name: Python SDK Freeze + needs: pr_metadata + if: needs.pr_metadata.outputs.should_run == 'true' && github.event_name == 'push' + runs-on: ubuntu-latest + timeout-minutes: 5 + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + fetch-depth: 0 + persist-credentials: false + + - name: Reject changes to the Python SDK + env: + BASE_SHA: ${{ needs.pr_metadata.outputs.base_sha }} + run: | + set -euo pipefail + changed=$(git diff --name-only --diff-filter=d "${BASE_SHA}...HEAD" -- \ + python \ + tasks/scripts/generate_python_proto.py \ + tasks/scripts/verify-python-wheel.py) + if [ -z "$changed" ]; then + echo "No added or changed Python SDK files." + exit 0 + fi + echo "::error title=Python SDK moved::The Python SDK moved to https://github.com/ai-openshell/sdk-python. Drop the Python SDK changes from this PR and open SDK changes there. Regenerated bindings are not needed here; sdk-python regenerates them from core releases." + echo "Changed Python SDK files:" + echo "$changed" + exit 1 + markdown: name: Markdown needs: pr_metadata diff --git a/.github/workflows/release-build.yml b/.github/workflows/release-build.yml index c85d29d2fc..32abc31952 100644 --- a/.github/workflows/release-build.yml +++ b/.github/workflows/release-build.yml @@ -20,9 +20,6 @@ on: required: true type: boolean outputs: - python_version: - description: Python package version - value: ${{ jobs.compute-versions.outputs.python_version }} npm_version: description: TypeScript package version value: ${{ jobs.compute-versions.outputs.npm_version }} @@ -56,7 +53,6 @@ jobs: run: shell: nix develop -c bash -euo pipefail {0} outputs: - python_version: ${{ steps.v.outputs.python }} cargo_version: ${{ steps.v.outputs.cargo }} npm_version: ${{ steps.v.outputs.npm }} deb_version: ${{ steps.v.outputs.deb }} @@ -106,7 +102,6 @@ jobs: fi { echo "is_prerelease=${is_prerelease}" - echo "python=$(uv run --no-project python tasks/scripts/release.py get-version --python)" echo "cargo=$(uv run --no-project python tasks/scripts/release.py get-version --cargo)" echo "npm=$(uv run --no-project python tasks/scripts/release.py get-version --npm)" echo "deb=$(uv run --no-project python tasks/scripts/release.py get-version --deb)" @@ -160,46 +155,6 @@ jobs: push-images: ${{ inputs.is-prerelease }} checkout-ref: ${{ needs.compute-versions.outputs.source_sha }} - build-python-wheel: - name: Build Python Wheel - needs: [compute-versions] - runs-on: linux-amd64-cpu8 - timeout-minutes: 20 - defaults: - run: - shell: nix develop -c bash -euo pipefail {0} - env: - SETUPTOOLS_SCM_PRETEND_VERSION_FOR_OPENSHELL: ${{ needs.compute-versions.outputs.python_version }} - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - fetch-depth: 0 - persist-credentials: false - ref: ${{ needs.compute-versions.outputs.source_sha }} - - - uses: ./.github/actions/setup-nix - with: - prepare-shell: "true" - - - name: Sync Python dependencies - run: uv sync --frozen - - - name: Build Python wheel - run: | - set -euo pipefail - uv run --frozen python tasks/scripts/generate_python_proto.py - uv build --wheel --out-dir target/wheels - uv run --no-project python tasks/scripts/verify-python-wheel.py target/wheels \ - --expected-version "${SETUPTOOLS_SCM_PRETEND_VERSION_FOR_OPENSHELL}" - ls -la target/wheels/*.whl - - - name: Upload wheel artifact - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 - with: - name: python-wheel - path: target/wheels/*.whl - retention-days: 5 - build-deb: name: Build Debian Packages needs: [compute-versions, build-binaries, build-vm-driver] diff --git a/.github/workflows/release-prerelease.yml b/.github/workflows/release-prerelease.yml index 2d54d02b23..6dc3b51378 100644 --- a/.github/workflows/release-prerelease.yml +++ b/.github/workflows/release-prerelease.yml @@ -124,7 +124,6 @@ jobs: release-tag: ${{ needs.resolve.outputs.tag }} source-sha: ${{ needs.build.outputs.source_sha }} semver: ${{ needs.build.outputs.semver }} - python-version: ${{ needs.build.outputs.python_version }} npm-version: ${{ needs.build.outputs.npm_version }} is-prerelease: true secrets: diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml index ed6e63827c..c4e9331587 100644 --- a/.github/workflows/release-publish.yml +++ b/.github/workflows/release-publish.yml @@ -27,10 +27,6 @@ on: description: Release version without the v prefix required: true type: string - python-version: - description: Python package version - required: true - type: string npm-version: description: TypeScript package version required: true @@ -116,12 +112,6 @@ jobs: name: prover-checksums path: release/ - - name: Download wheel artifact - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 - with: - name: python-wheel - path: release/ - - name: Download Debian package artifacts uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: @@ -143,16 +133,6 @@ jobs: path: release/ merge-multiple: true - - name: Verify wheel count - run: | - set -euo pipefail - shopt -s nullglob - wheels=(release/*.whl) - if [ "${#wheels[@]}" -ne 1 ]; then - echo "expected exactly one Python wheel, found ${#wheels[@]}" >&2 - exit 1 - fi - - name: Generate checksums run: | set -euo pipefail @@ -165,8 +145,7 @@ jobs: openshell-driver-vm-aarch64-unknown-linux-gnu.tar.gz \ openshell-driver-vm-aarch64-apple-darwin.tar.gz \ openshell_*.deb \ - openshell-*.rpm \ - *.whl > openshell-checksums-sha256.txt + openshell-*.rpm > openshell-checksums-sha256.txt cat openshell-checksums-sha256.txt sha256sum -- \ openshell-gateway-x86_64-unknown-linux-gnu.tar.gz \ @@ -199,7 +178,6 @@ jobs: release/*.tar.gz release/*.deb release/*.rpm - release/*.whl - name: Upload assembled release assets uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 @@ -428,7 +406,6 @@ jobs: release/openshell-prover-x86_64-unknown-linux-musl.tar.gz release/openshell-prover-aarch64-unknown-linux-musl.tar.gz release/openshell-prover-aarch64-apple-darwin.tar.gz - release/*.whl release/openshell.rb release/openshell-checksums-sha256.txt release/openshell-gateway-checksums-sha256.txt @@ -522,19 +499,6 @@ jobs: buf push proto --label "${RELEASE_TAG}" \ --source-control-url "${SOURCE_CONTROL_URL}" - publish-pypi: - name: Publish Python Wheel - needs: release - if: ${{ !inputs.is-prerelease }} - permissions: - contents: read - id-token: write - uses: ./.github/workflows/wheel-publish.yml - with: - release-tag: ${{ inputs.release-tag }} - source-sha: ${{ inputs.source-sha }} - python-version: ${{ inputs.python-version }} - publish-snap: name: Publish Snap needs: release @@ -600,7 +564,6 @@ jobs: - tag-ghcr-release - release-helm - release - - publish-pypi - publish-snap - publish-prerelease-snap - publish-sdk-typescript @@ -620,7 +583,7 @@ jobs: if [[ "${IS_PRERELEASE}" == "true" ]]; then expected+=(publish-prerelease-snap) else - expected+=(publish-pypi publish-sdk-typescript tag-sdk-go) + expected+=(publish-sdk-typescript tag-sdk-go) if [[ "${MAKE_LATEST}" == "true" ]]; then expected+=(publish-snap) fi diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6ec1e1914f..5f64d393a8 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -153,7 +153,6 @@ jobs: release-tag: ${{ needs.promote.outputs.tag }} source-sha: ${{ needs.build.outputs.source_sha }} semver: ${{ needs.build.outputs.semver }} - python-version: ${{ needs.build.outputs.python_version }} npm-version: ${{ needs.build.outputs.npm_version }} is-prerelease: false make-latest: ${{ needs.promote.outputs.make-latest == 'true' }} diff --git a/.github/workflows/wheel-publish.yml b/.github/workflows/wheel-publish.yml deleted file mode 100644 index 15512ee639..0000000000 --- a/.github/workflows/wheel-publish.yml +++ /dev/null @@ -1,92 +0,0 @@ -# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -# SPDX-License-Identifier: Apache-2.0 - -name: Publish Wheel - -# PyPI Trusted Publishing matches the `job_workflow_ref` claim, which names this -# file for both calls and dispatches. The `openshell` PyPI project trusts -# workflow `wheel-publish.yml` with environment `pypi`. -on: - workflow_call: - inputs: - release-tag: - required: true - type: string - source-sha: - required: true - type: string - python-version: - required: true - type: string - workflow_dispatch: - inputs: - release-tag: - description: Stable tag whose GitHub Release holds the wheel, e.g. v0.1.7 - required: true - type: string - source-sha: - description: Commit the tag points to - required: true - type: string - python-version: - description: Python package version, e.g. 0.1.7 - required: true - type: string - -permissions: - contents: read - -jobs: - publish: - name: Publish Python Wheel to PyPI - runs-on: ubuntu-latest - timeout-minutes: 10 - environment: - name: pypi - url: https://pypi.org/project/openshell/ - permissions: - contents: read - id-token: write - steps: - # Publish the wheel attached to the GitHub Release rather than a run's - # build artifact, so a retry or dispatch publishes the same bytes. - - name: Download and verify the released wheel - shell: bash - env: - GH_TOKEN: ${{ github.token }} - RELEASE_TAG: ${{ inputs.release-tag }} - SOURCE_SHA: ${{ inputs.source-sha }} - PYTHON_VERSION: ${{ inputs.python-version }} - run: | - set -euo pipefail - tag_sha=$(gh api "repos/${GITHUB_REPOSITORY}/commits/${RELEASE_TAG}" --jq .sha) - if [[ "${tag_sha}" != "${SOURCE_SHA}" ]]; then - echo "${RELEASE_TAG} points to ${tag_sha}, not ${SOURCE_SHA}" >&2 - exit 1 - fi - gh release download "${RELEASE_TAG}" -R "${GITHUB_REPOSITORY}" \ - --pattern '*.whl' --pattern openshell-checksums-sha256.txt --dir release - shopt -s nullglob - wheels=(release/*.whl) - if [[ "${#wheels[@]}" -ne 1 ]]; then - echo "Expected exactly one Python wheel on ${RELEASE_TAG}, found ${#wheels[@]}" >&2 - exit 1 - fi - wheel=$(basename "${wheels[0]}") - if [[ "${wheel}" != openshell-"${PYTHON_VERSION}"-*.whl ]]; then - echo "${wheel} is not an openshell ${PYTHON_VERSION} wheel" >&2 - exit 1 - fi - checksum=$(awk -v wheel="${wheel}" '$2 == wheel { print $1 " " $2 }' release/openshell-checksums-sha256.txt) - if [[ -z "${checksum}" ]]; then - echo "${wheel} is missing from the release checksums" >&2 - exit 1 - fi - (cd release && sha256sum -c - <<<"${checksum}") - mkdir dist - mv "release/${wheel}" dist/ - - - name: Publish wheel to PyPI - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3 - with: - skip-existing: true diff --git a/AGENTS.md b/AGENTS.md index 8866ead489..4a01e473e7 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -61,7 +61,7 @@ Do not rely on this file for a full inventory. The detailed public and contribut | `crates/openshell-supervisor-network/` | Network supervisor | Proxying, L7 enforcement, policy evaluation, and provider credential injection | | `crates/openshell-supervisor-process/` | Process supervisor | Process lifecycle, namespace, and bypass monitoring | | `crates/openshell-vfio/` | VFIO support | PCI and GPU passthrough preparation and lifecycle | -| `python/openshell/` | Python SDK | Python bindings and CLI packaging | +| `python/openshell/` | Python SDK (frozen) | Moved to ai-openshell/sdk-python; kept until removal | | `sdk/typescript/` | TypeScript SDK | Native Connect client, curated sandbox API, and generated protobuf types | | `proto/` | Protobuf definitions | gRPC service contracts | | `tests/testkit/` | E2E testkit | Support library and `#[testkit::test]` attribute for SDK-driven E2E suites | @@ -197,6 +197,11 @@ Follow `CONTRIBUTING.md` and `create-github-pr`. Authors without target-reposito - The Go SDK moved to [ai-openshell/sdk-go](https://github.com/ai-openshell/sdk-go) (module `github.com/ai-openshell/sdk-go`). Open SDK changes there. - `sdk/go/` is frozen until it is removed; Branch Checks fails PRs that change it. Proto changes do not need regenerated Go bindings. +## Python SDK (`python/openshell/`) + +- The Python SDK moved to [ai-openshell/sdk-python](https://github.com/ai-openshell/sdk-python), which publishes `openshell` to PyPI. Open SDK changes there. +- `python/` and the SDK build scripts `tasks/scripts/generate_python_proto.py` and `tasks/scripts/verify-python-wheel.py` are frozen until core removes them; Branch Checks fails PRs that change them. Put tests for core Python scripts next to the scripts, not under `python/`. + ## TypeScript SDK (`sdk/typescript/`) - Run `mise run sdk:ts:ci` for codegen, proto lint, Biome lint, type checking, unit tests, coverage, and build validation. diff --git a/CI.md b/CI.md index a1a1b8bc77..2dcd061230 100644 --- a/CI.md +++ b/CI.md @@ -440,7 +440,7 @@ without rerunning qualification. These artifacts have different embedded version from the qualified prerelease. Existing stable tags are never moved; a retry must resolve to the same qualified candidate. A retry rebuilds, then publishes only what is missing: it keeps published GHCR version tags, Helm charts, GitHub Release assets, -npm versions, and PyPI versions. Snap uploads are not skipped. +and npm versions. Snap uploads are not skipped. Stable image builds save multi-platform OCI archives as workflow artifacts without pushing to GHCR. Publication copies those archives, including their attestations, @@ -725,14 +725,13 @@ Each step that publishes to an external registry, store, or site lives in its ow | `.github/workflows/release-auto-tag.yml` | Weekdays at 14:00 Europe/Zurich, tags the next `-pre.N` on `main` when commits landed since the latest one, then dispatches Pre-release. It skips when the train has no `-pre.1` or its version is already stable, so push each train's `-pre.1` tag by hand. | | `.github/workflows/release-prerelease.yml` | Pre-release orchestrator, triggered by prerelease tag pushes or dispatched by Release Auto-Tag or manually. A tagless dispatch creates the next candidate on its branch; explicit tags select existing candidates. Builds, then publishes and qualifies in parallel. Qualification failure fails the run and sends the failure notification; published artifacts remain available. | | `.github/workflows/release-build.yml` | Shared version computation, binary and image builds, and package builds. Validates that the tag matches the caller's release kind. | -| `.github/workflows/release-publish.yml` | Shared artifact assembly, OCI image tags and Helm chart publication, and package publication. Stable releases also publish release-labeled public schemas to Buf (`BUF_TOKEN` required) and GitHub Releases, and call the PyPI, snap, npm, and Go SDK publishers. | +| `.github/workflows/release-publish.yml` | Shared artifact assembly, OCI image tags and Helm chart publication, and package publication. Stable releases also publish release-labeled public schemas to Buf (`BUF_TOKEN` required) and GitHub Releases, and call the snap, npm, and Go SDK publishers. The Python SDK is released from [ai-openshell/sdk-python](https://github.com/ai-openshell/sdk-python), so stable and prerelease GitHub Releases carry no wheel. | | `.github/workflows/release-notes.yml` | Shared prompt-driven release notes generation through Inference Hub, used by prerelease previews, notes-only previews, and stable releases. Stable releases reuse the promoted prerelease's preview when available. | | `.github/workflows/release-qualification.yml` | Reusable qualification suites and result aggregation. Runs security scans, conformance and feature integration, Docker and VM E2E, protobuf compatibility, and advisory compatibility review. | | `.github/workflows/snap-package.yml` | Builds snap and component artifacts for Release Dev, Release, and Pre-release without Store credentials or publication. | | `.github/workflows/snap-publish.yml` | Uploads existing snap and component artifacts directly to a Store channel without rebuilding. Release Dev uses `latest/edge`, Pre-release uses `latest/beta`, and Release uses `latest/stable` for the stable rebuild. Uploads queue per channel and architecture, so tagged beta and stable jobs recheck repository tags after earlier publication finishes and before updating their floating channels. Manual dispatch uploads the `snap-linux-*` artifacts from `artifact-run-id`. | | `.github/workflows/sdk-typescript-publish.yml` | Publishes the TypeScript SDK to GitHub Packages. Called by stable Release; manual dispatch publishes a given tag and npm version. | | `.github/workflows/sdk-go-tag.yml` | Creates the `sdk/go/vX.Y.Z` tag and asks the Go module proxy to fetch it. Called by stable Release; manual dispatch tags a given version and commit. | -| `.github/workflows/wheel-publish.yml` | Publishes the wheel attached to a stable GitHub Release to PyPI with Trusted Publishing in the `pypi` environment. Called by stable Release; manual dispatch publishes a given tag. | | `.github/workflows/release-canary.yml` | Smoke-tests published dev artifacts in the `macos`, `ubuntu-deb`, `ubuntu-snap-system-docker`, `fedora`, and `kubernetes` (kind + Helm) jobs. Each job reaches its gateway and creates, exercises, and deletes a sandbox. The `ubuntu-snap-system-docker` job verifies a compatible system Docker lifecycle, while `ubuntu-snap-docker-preflight` tests fail-fast behavior when Docker is absent or supplied by the Docker snap. The positive snap lane also runs a local policy containment check with the packaged prover. It runs automatically after `Release Dev` succeeds and supports manual dispatch (`gh workflow run release-canary.yml --ref `). See the `test-release-canary` skill for the playbook and local kind reproduction. | ## Required status contexts diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 3e800debdf..8cd5a323a5 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -382,7 +382,7 @@ These are the primary `mise` tasks for day-to-day development: | `crates/` | Rust crates | | `crates/openshell-policy-schema/` | Canonical authored policy DTOs and bounded YAML/JSON parser | | `crates/openshell-prover-cli/` | Standalone local policy boundary checker | -| `python/` | Python SDK and bindings | +| `python/` | Python SDK (frozen, moved to ai-openshell/sdk-python) | | `sdk/go/` | Go SDK (types, gRPC clients, converters) | | `sdk/typescript/` | TypeScript SDK (Connect client and generated protobuf bindings) | | `proto/` | Protocol buffer definitions and [public API conventions](proto/README.md) | diff --git a/python/openshell/rpm_gateway_config_migration_test.py b/deploy/rpm/migrate_gateway_config_test.py similarity index 100% rename from python/openshell/rpm_gateway_config_migration_test.py rename to deploy/rpm/migrate_gateway_config_test.py diff --git a/python/openshell/gateway_config_fixture_test.py b/e2e/configs/gateway/gateway_config_fixture_test.py similarity index 98% rename from python/openshell/gateway_config_fixture_test.py rename to e2e/configs/gateway/gateway_config_fixture_test.py index d7c6b8297b..9fc40a32c9 100644 --- a/python/openshell/gateway_config_fixture_test.py +++ b/e2e/configs/gateway/gateway_config_fixture_test.py @@ -11,7 +11,7 @@ import pytest import yaml -REPO_ROOT = Path(__file__).resolve().parents[2] +REPO_ROOT = Path(__file__).resolve().parents[3] FIXTURE_DIR = REPO_ROOT / "e2e/configs/gateway" TEST_GUEST_ROLE_PATH = ( REPO_ROOT diff --git a/mise.toml b/mise.toml index 10c964e956..7a99d5f50b 100644 --- a/mise.toml +++ b/mise.toml @@ -74,7 +74,7 @@ DOCKER_BUILDKIT = "1" [vars] # Python paths to include in formatting/linting -python_paths = "python/ tasks/scripts/*.py e2e/mcp-conformance/*.py e2e/kubernetes/app-listener/*.py deploy/sbom/*.py" +python_paths = "python/ tasks/scripts/*.py e2e/mcp-conformance/*.py e2e/kubernetes/app-listener/*.py deploy/sbom/*.py deploy/rpm/*.py e2e/configs/gateway/*.py" [task_config] includes = ["tasks/*.toml"] diff --git a/python/openshell/release_formula_test.py b/tasks/scripts/release_formula_test.py similarity index 100% rename from python/openshell/release_formula_test.py rename to tasks/scripts/release_formula_test.py diff --git a/python/release_tooling_test.py b/tasks/scripts/release_tooling_test.py similarity index 97% rename from python/release_tooling_test.py rename to tasks/scripts/release_tooling_test.py index d170839cca..cf913e31a9 100644 --- a/python/release_tooling_test.py +++ b/tasks/scripts/release_tooling_test.py @@ -9,7 +9,7 @@ def _load_release_module(): - path = Path(__file__).resolve().parents[1] / "tasks/scripts/release.py" + path = Path(__file__).resolve().parent / "release.py" spec = importlib.util.spec_from_file_location("openshell_release_tooling", path) assert spec is not None assert spec.loader is not None diff --git a/tasks/test.toml b/tasks/test.toml index 2839c1cf0c..23b7fd2792 100644 --- a/tasks/test.toml +++ b/tasks/test.toml @@ -8,6 +8,7 @@ description = "Run all tests (Rust + Python + TypeScript SDK)" depends = [ "test:rust", "test:python", + "test:python-scripts", "sdk:ts:test", "test:sbom", "test:install-sh", @@ -156,6 +157,11 @@ run = "tasks/scripts/test-postgres-test-runner.sh" run_windows = "echo Skipping test:postgres-runner: the Unix PostgreSQL test runner does not apply on Windows." hide = true +["test:python-scripts"] +description = "Test the release, RPM, and E2E gateway config tooling" +run = "uv run --no-project --with pytest --with pyyaml pytest -o \"python_files=*_test.py\" tasks/scripts/release_formula_test.py tasks/scripts/release_tooling_test.py deploy/rpm/ e2e/configs/gateway/" +hide = true + ["test:python"] description = "Run Python tests" depends = ["python:proto"]