release: jamjet Python SDK 0.11.0 (governance, sessions/memory, Team,… #424
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUST_BACKTRACE: 1 | |
| jobs: | |
| # ── Rust ──────────────────────────────────────────────────────────── | |
| rust-lint: | |
| name: Rust lint | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: runtime | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: rustfmt, clippy | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| workspaces: runtime -> target | |
| - name: Create web/dist placeholder for rust-embed | |
| run: mkdir -p ../web/dist && echo '<!DOCTYPE html><html><body></body></html>' > ../web/dist/index.html | |
| - name: fmt | |
| run: cargo fmt --all -- --check | |
| - name: clippy | |
| # Note: NOT `-D warnings`. New clippy versions regularly introduce lints | |
| # that flag existing code (e.g. 1.95 added stricter collapsible_match); | |
| # treating those as errors makes every clippy bump a tax. We keep clippy | |
| # as informational and rely on review + targeted #[allow] for real issues. | |
| run: cargo clippy --workspace --all-features | |
| rust-test: | |
| name: Rust tests | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: runtime | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| workspaces: runtime -> target | |
| - name: Create web/dist placeholder for rust-embed | |
| run: mkdir -p ../web/dist && echo '<!DOCTYPE html><html><body></body></html>' > ../web/dist/index.html | |
| - name: Test | |
| run: cargo test --workspace | |
| # ── Python SDK ────────────────────────────────────────────────────── | |
| python-lint: | |
| name: Python lint | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: sdk/python | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.12" | |
| - run: pip install uv | |
| - run: uv sync --all-extras | |
| - run: uv run ruff format --check . | |
| - run: uv run ruff check . | |
| # mypy is scoped to jamjet.cloud (the actively-maintained surface). | |
| # Framework-level type issues in jamjet/llm/* and similar legacy modules | |
| # are tracked separately; treating them as CI blockers would prevent any | |
| # cloud-related PR from merging. | |
| - run: uv run mypy jamjet/cloud | |
| python-test: | |
| name: Python tests | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: sdk/python | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.12" | |
| - run: pip install uv | |
| - run: uv sync --all-extras | |
| - run: uv run pytest --tb=short | |
| # ── Java SDK ──────────────────────────────────────────────────────── | |
| java-test: | |
| name: Java SDK tests | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: sdk/java | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-java@v5 | |
| with: | |
| java-version: "21" | |
| distribution: temurin | |
| cache: maven | |
| - name: Build and test | |
| run: mvn test -q --no-transfer-progress | |
| # ── Security audit ────────────────────────────────────────────────── | |
| rust-audit: | |
| name: Rust dependency audit | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: runtime | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| workspaces: runtime -> target | |
| - name: Install cargo-audit | |
| run: cargo install cargo-audit --locked | |
| - name: Audit dependencies | |
| run: | | |
| # --deny unsound: fail on CVEs/unsound advisories (not on unmaintained warnings) | |
| # --ignore RUSTSEC-2023-0071: rsa Marvin Attack — no upstream fix available yet; | |
| # we use rsa only as a transitive dep of tonic, not for key operations. | |
| cargo audit --deny unsound \ | |
| --ignore RUSTSEC-2023-0071 | |
| python-audit: | |
| name: Python dependency audit | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: sdk/python | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.12" | |
| - run: pip install --upgrade pip | |
| - run: pip install uv pip-audit | |
| - run: uv sync --all-extras | |
| - name: Audit dependencies | |
| run: | | |
| # Ignored vulns (re-evaluate periodically): | |
| # CVE-2026-4539 — pygments AdlLexer regex DoS, no upstream fix. | |
| # CVE-2026-3219 — pip tar/zip handling; pip is a build-time tool, not | |
| # a runtime dep. We upgrade pip above to mitigate, and ignore here so | |
| # the audit doesn't fail on pip-audit's own venv pinning. | |
| pip-audit --desc \ | |
| --ignore-vuln CVE-2026-4539 \ | |
| --ignore-vuln CVE-2026-3219 | |
| secret-scan: | |
| name: Secret scanning | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: TruffleHog scan | |
| uses: trufflesecurity/trufflehog@main | |
| with: | |
| path: ./ | |
| # pull_request: compare PR base SHA to PR head SHA | |
| # push: compare previous SHA to current SHA (fallback to parent of HEAD) | |
| base: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || (github.event.before != '0000000000000000000000000000000000000000' && github.event.before || format('{0}^', github.sha)) }} | |
| head: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} | |
| extra_args: --only-verified | |
| # ── Build check ───────────────────────────────────────────────────── | |
| build: | |
| name: Build release binary | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: runtime | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| workspaces: runtime -> target | |
| - name: Create web/dist placeholder for rust-embed | |
| run: mkdir -p ../web/dist && echo '<!DOCTYPE html><html><body></body></html>' > ../web/dist/index.html | |
| - run: cargo build --release --workspace | |
| # ── Wheel build check ─────────────────────────────────────────────── | |
| wheel-check: | |
| name: Wheel build check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.12" | |
| - name: Install build | |
| run: pip install build | |
| - name: Build wheel | |
| run: python -m build --wheel | |
| working-directory: sdk/python | |
| - name: Smoke-test wheel installs | |
| run: | | |
| pip install sdk/python/dist/*.whl | |
| jamjet --help |