ag-ui/.github/workflows/unit-typescript-sdk.yml at main · ag-ui-protocol/ag-ui · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
name: unit

on:
  push:
    branches: [main]
    paths:
      - "sdks/typescript/**"
      - "typescript-sdk/**"
      - "integrations/**"
      - "middlewares/**"
      - "pnpm-lock.yaml"
      - "pnpm-workspace.yaml"
      - "package.json"
      - "nx.json"
      - ".github/workflows/unit-typescript-sdk.yml"
  pull_request:
    branches: [main]
    paths:
      - "sdks/typescript/**"
      - "typescript-sdk/**"
      - "integrations/**"
      - "middlewares/**"
      - "pnpm-lock.yaml"
      - "pnpm-workspace.yaml"
      - "package.json"
      - "nx.json"
      - ".github/workflows/unit-typescript-sdk.yml"

permissions:
  contents: read

jobs:
  typescript:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false

      - name: Detect fork PR
        id: fork-check
        run: |
          if [[ "$GITHUB_EVENT_NAME" == "pull_request" && \
                "$PR_HEAD_REPO" != "$GITHUB_REPOSITORY" ]]; then
            echo "prefix=fork-" >> "$GITHUB_OUTPUT"
          else
            echo "prefix=" >> "$GITHUB_OUTPUT"
          fi
        env:
          # Passed via env rather than interpolated into the script: a fork's repo
          # name is attacker-controlled text. GITHUB_EVENT_NAME and
          # GITHUB_REPOSITORY are Actions built-ins, so nothing is expanded here.
          PR_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
        with:
          node-version-file: ".node-version"

      - name: Install pnpm
        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86  # v6.0.10
        with:
          version: 10.33.4

      - name: Setup pnpm cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
        with:
          path: ~/.local/share/pnpm/store
          key: ${{ steps.fork-check.outputs.prefix }}${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ steps.fork-check.outputs.prefix }}${{ runner.os }}-pnpm-store-

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Test Build
        run: pnpm run build

      # A verification build must not rewrite tracked files (PNI-303): the proto
      # generator is pinned via config.protocVersion and tsdown's exports
      # rewriting is committed in canonical order, so any drift here is a bug.
      - name: Verify build leaves the worktree clean
        run: git diff --exit-code

      - name: Run tests
        run: pnpm run test

  # The lane above runs against the SDK version the lockfile pins. The
  # aws-strands package declares an open-ended `@strands-agents/sdk` peer, and
  # consumers install it prebuilt, so they can be running a newer SDK than the
  # one this repository compiles against.
  #
  # That gap is load-bearing for this integration. The adapter decides what to
  # carry onto each per-thread agent from a table checked against
  # `keyof AgentConfig`, and that check happens here, at build time, against the
  # pinned type. It can say nothing about a field a later release adds, so a new
  # field is dropped in silence on exactly the versions the peer range
  # advertises as supported.
  #
  # This lane closes it by resolving the newest published SDK and running the
  # package's own suite and typecheck against it. A red build here means the SDK
  # gained something the adapter has not been taught.
  aws-strands-typescript-latest:
    name: aws-strands-typescript-latest
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
        with:
          node-version-file: ".node-version"

      - name: Install pnpm
        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86  # v6.0.10
        with:
          version: 10.33.4

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build workspace dependencies
        run: pnpm exec nx build @ag-ui/aws-strands

      - name: Install the newest published Strands SDK
        working-directory: integrations/aws-strands/typescript
        # pnpm, not npm: this is a pnpm workspace and this package depends on
        # its siblings through the `workspace:` protocol, which npm refuses
        # with EUNSUPPORTEDPROTOCOL.
        #
        # This rewrites package.json and the lockfile. That is deliberate and
        # confined to the runner: the whole point of the lane is to report on a
        # version the repository has not adopted, so it does not also assert
        # that those files are untouched afterwards. Nothing is committed.
        run: |
          set -euo pipefail
          pnpm add -D "@strands-agents/sdk@latest"
          pnpm list @strands-agents/sdk --depth 0

      - name: Typecheck against the newest release
        working-directory: integrations/aws-strands/typescript
        run: pnpm exec tsc --noEmit

      - name: Run tests against the newest release
        working-directory: integrations/aws-strands/typescript
        run: pnpm exec vitest run