Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
164 changes: 164 additions & 0 deletions .github/workflows/integration.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,164 @@
name: Integration Tests

on:
push:
branches: [main]
pull_request:
branches: [main]
workflow_dispatch:
inputs:
agent_url:
description: 'AxonFlow Agent URL (defaults to staging)'
required: false
default: 'https://staging-eu.getaxonflow.com'

env:
# Note: github.event.inputs only available on workflow_dispatch, defaults used otherwise
AXONFLOW_AGENT_URL: ${{ github.event.inputs.agent_url || 'https://staging-eu.getaxonflow.com' }}
AXONFLOW_CLIENT_ID: ${{ secrets.AXONFLOW_CLIENT_ID || 'demo-client' }}
AXONFLOW_CLIENT_SECRET: ${{ secrets.AXONFLOW_CLIENT_SECRET || 'demo-secret' }}

jobs:
contract-tests:
name: Contract Tests
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: '3.11'

- name: Install dependencies
run: pip install -e ".[dev]"

- name: Run contract tests
run: pytest tests/test_contract.py -v --no-cov

integration-tests:
Comment on lines +23 to +39

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 4 months ago

To resolve the problem, add an explicit permissions section at the root of the workflow file (.github/workflows/integration.yml). This ensures all jobs in the workflow are run with the minimum necessary privileges on the GITHUB_TOKEN. The best practice is to set permissions: { contents: read } unless specific jobs need something else (e.g., writing pull requests or issues). In this workflow, all jobs only need to read code, so adding the following near the top of the file is appropriate:

permissions:
  contents: read

This line should be inserted after the name: Integration Tests and before the on: block (typically at line 2). No further changes are needed, as none of the jobs appear to need broader permissions.


Suggested changeset 1
.github/workflows/integration.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -1,4 +1,6 @@
 name: Integration Tests
+permissions:
+  contents: read
 
 on:
   push:
EOF
@@ -1,4 +1,6 @@
name: Integration Tests
permissions:
contents: read

on:
push:
Copilot is powered by AI and may make mistakes. Always verify output.
name: Integration Tests
runs-on: ubuntu-latest
# Only run on main branch or manual dispatch with secrets configured
if: github.event_name == 'workflow_dispatch' || (github.ref == 'refs/heads/main' && github.event_name == 'push')
needs: contract-tests
steps:
- uses: actions/checkout@v4

- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: '3.11'

- name: Install dependencies
run: pip install -e ".[dev,all]"

- name: Run integration tests
env:
RUN_INTEGRATION_TESTS: '1'
AXONFLOW_LICENSE_KEY: ${{ secrets.AXONFLOW_LICENSE_KEY }}
run: pytest tests/test_integration.py -v --no-cov
continue-on-error: true # Don't fail build if staging is down

demo-scripts:
Comment on lines +40 to +63

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 4 months ago

To fix the problem, add a permissions key at the root level of the workflow file (just below the name: and before the on: block). This root-level permissions block will apply to all jobs, unless a job-level override is specified. The majority of jobs shown do not perform any actions that require write access, so the minimum permission of contents: read is appropriate, as suggested by CodeQL. This grants read-only access to repository contents, which is sufficient for typical test and validation workflows.

  • Add the following block near the top of the file:
    permissions:
      contents: read
    
  • This should go after the name: Integration Tests line (line 1) and before the on: block (line 3).
  • No extra imports or dependencies are required.

Suggested changeset 1
.github/workflows/integration.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -1,4 +1,6 @@
 name: Integration Tests
+permissions:
+  contents: read
 
 on:
   push:
EOF
@@ -1,4 +1,6 @@
name: Integration Tests
permissions:
contents: read

on:
push:
Copilot is powered by AI and may make mistakes. Always verify output.
name: Demo Scripts Validation
runs-on: ubuntu-latest
needs: contract-tests
steps:
- uses: actions/checkout@v4

- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: '3.11'

- name: Install dependencies
run: pip install -e ".[dev,all]"

- name: Validate quickstart.py syntax
run: python -m py_compile examples/quickstart.py

- name: Validate gateway_mode.py syntax
run: python -m py_compile examples/gateway_mode.py

- name: Validate openai_integration.py syntax
run: python -m py_compile examples/openai_integration.py

- name: Run quickstart (dry-run mode)
run: |
python -c "
import asyncio
from examples.quickstart import main
# Verify module imports correctly
print('quickstart.py imports successfully')
"

- name: Run gateway_mode (dry-run mode)
run: |
python -c "
import asyncio
from examples.gateway_mode import main, blocked_example
# Verify module imports correctly
print('gateway_mode.py imports successfully')
"

community-stack-tests:
Comment on lines +64 to +105

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 4 months ago

To fix this issue, we should add a permissions block to the demo-scripts job in .github/workflows/integration.yml that restricts the GITHUB_TOKEN permissions to the minimum required for the steps listed. Since all the steps only require reading repository contents (for actions/checkout) and do not write to GitHub, the minimal permission of contents: read is sufficient.

This addition should be made at the same indentation level as runs-on (i.e., a job-level key, not inside steps). No additional methods/imports/definitions are needed.


Suggested changeset 1
.github/workflows/integration.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -62,6 +62,8 @@
 
   demo-scripts:
     name: Demo Scripts Validation
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     needs: contract-tests
     steps:
EOF
@@ -62,6 +62,8 @@

demo-scripts:
name: Demo Scripts Validation
permissions:
contents: read
runs-on: ubuntu-latest
needs: contract-tests
steps:
Copilot is powered by AI and may make mistakes. Always verify output.
name: Community Stack E2E
runs-on: ubuntu-latest
if: github.event_name == 'workflow_dispatch'
needs: [contract-tests, demo-scripts]
services:
agent:
image: ghcr.io/getaxonflow/axonflow-agent:latest
ports:
- 8080:8080
env:
AXONFLOW_MODE: community
AXONFLOW_DEBUG: 'true'
options: >-
--health-cmd "wget --spider -q http://localhost:8080/health || exit 1"
--health-interval 10s
--health-timeout 5s
--health-retries 5
steps:
- uses: actions/checkout@v4

- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: '3.11'

- name: Install dependencies
run: pip install -e ".[dev,all]"

- name: Wait for agent to be ready
run: |
for i in {1..30}; do
if curl -s http://localhost:8080/health | grep -q healthy; then
echo "Agent is ready!"
exit 0
fi
echo "Waiting for agent... ($i/30)"
sleep 2
done
echo "Agent failed to start"
exit 1

- name: Run SDK against community stack
env:
AXONFLOW_AGENT_URL: 'http://localhost:8080'
AXONFLOW_CLIENT_ID: 'test-client'
AXONFLOW_CLIENT_SECRET: 'test-secret'
RUN_INTEGRATION_TESTS: '1'
run: |
# Run integration tests against local community stack
pytest tests/test_integration.py -v --no-cov

- name: Run demo scripts against community stack
env:
AXONFLOW_AGENT_URL: 'http://localhost:8080'
AXONFLOW_CLIENT_ID: 'test-client'
AXONFLOW_CLIENT_SECRET: 'test-secret'
run: |
# Run quickstart demo
python examples/quickstart.py || echo "Quickstart completed (may fail without LLM)"
Comment on lines +106 to +164

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 4 months ago

The best way to fix the problem is to add a permissions key at the top level of the workflow (recommended), or individually to any jobs that require a unique set of permissions. For this workflow, there is no evidence of any requirement for write access -- the workflow only runs tests and scripts using repository code and secrets. Therefore, the global default permissions: contents: read should be set at the top level, immediately after the name line, to ensure all jobs run with the minimum required permissions, following the principle of least privilege.

Steps:

  • Add a line such as permissions: followed by contents: read as mapping to the root level (after the name).
  • No further code or import changes are required.

Suggested changeset 1
.github/workflows/integration.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -1,4 +1,6 @@
 name: Integration Tests
+permissions:
+  contents: read
 
 on:
   push:
EOF
@@ -1,4 +1,6 @@
name: Integration Tests
permissions:
contents: read

on:
push:
Copilot is powered by AI and may make mistakes. Always verify output.
33 changes: 33 additions & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,39 @@ All notable changes to the AxonFlow Python SDK will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [0.2.0] - 2025-12-15

### Added

- **Contract Testing Suite** - Validates SDK models against real API responses
- 19 contract tests covering all response types
- JSON fixtures for health, query, blocked, plan, and policy responses
- Prevents API/SDK mismatches before release

- **Integration Test Workflow** - GitHub Actions CI for live testing
- Contract tests run on every PR
- Integration tests against staging (on merge to main)
- Demo script validation
- Community stack E2E tests (manual trigger)

- **Fixture-Based Test Infrastructure**
- `tests/fixtures/` directory with recorded API responses
- `load_json_fixture()` helper in conftest.py
- Fallback to mock data for backwards compatibility

- **Fixture Recording Script**
- `scripts/record_fixtures.py` for capturing live API responses

### Changed

- Refactored `tests/conftest.py` with fixture loading utilities
- Added `fixture_*` prefixed fixtures that load from JSON files

### Fixed

- Ensured all edge cases for datetime parsing are covered in contract tests
- Validated handling of nanosecond timestamps from API

## [0.1.0] - 2025-12-04

### Added
Expand Down
2 changes: 1 addition & 1 deletion axonflow/__init__.py
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,7 @@
TokenUsage,
)

__version__ = "0.1.0"
__version__ = "0.2.0"
__all__ = [
# Main client
"AxonFlow",
Expand Down
3 changes: 2 additions & 1 deletion pyproject.toml
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"

[project]
name = "axonflow"
version = "0.1.0"
version = "0.2.0"
description = "AxonFlow Python SDK - Enterprise AI Governance in 3 Lines of Code"
readme = "README.md"
license = {text = "MIT"}
Expand Down Expand Up @@ -142,6 +142,7 @@ ignore = [
[tool.ruff.lint.per-file-ignores]
"tests/**/*.py" = ["S101", "S105", "S106", "ANN", "PLR2004", "ARG", "PLC0415", "PT011", "PT012", "TC002", "UP035", "F401", "F841", "EM101", "TRY301"]
"examples/**/*.py" = ["T201", "ANN", "S106", "ERA001", "BLE001", "PLC0415", "F541"]
"scripts/**/*.py" = ["T201", "ANN", "S106", "BLE001", "UP045", "DTZ005", "PTH123"]

[tool.ruff.lint.isort]
known-first-party = ["axonflow"]
Expand Down
Loading