feat: add OpenAI Agents SDK support to OpenInference mapper #804
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Secure Integration test | |
| on: | |
| pull_request_target: | |
| branches: main | |
| # workflow_call entry — TRUST INVARIANT. | |
| # | |
| # Lets another workflow in this repo reuse the integ tests against an | |
| # arbitrary `ref` while keeping AWS_*. The collaborator check below is | |
| # short-circuited on this path because the only caller (release.yml) is | |
| # workflow_dispatch-gated, which already requires repo write access. | |
| # | |
| # Before adding another caller, check all of: | |
| # 1. Cannot be triggered by an unauthenticated user or a fork | |
| # (no pull_request; no pull_request_target without an auth gate; | |
| # no push from non-main branches). | |
| # 2. Cannot be coerced into a fork-PR ref. validate-call-ref below is | |
| # the runtime guard, but condition 1 should make that unnecessary. | |
| # 3. STRANDS_INTEG_TEST_ROLE is scoped to least privilege. | |
| workflow_call: | |
| inputs: | |
| ref: | |
| required: true | |
| type: string | |
| jobs: | |
| validate-call-ref: | |
| name: Validate workflow_call ref | |
| if: inputs.ref != '' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| # Reject ref shapes that could check out untrusted code: | |
| # `refs/pull/*` (fork-PR merge refs) and `owner:branch` (cross-repo | |
| # refs) fail; plain branches and SHAs pass. | |
| steps: | |
| - name: Reject untrusted-shaped refs | |
| env: | |
| REF: ${{ inputs.ref }} | |
| run: | | |
| set -euo pipefail | |
| case "$REF" in | |
| refs/pull/*|*:*) | |
| echo "::error::workflow_call ref '$REF' looks like a fork PR or cross-repo ref." | |
| exit 1 | |
| ;; | |
| esac | |
| echo "ref '$REF' passed shape check." | |
| authorization-check: | |
| name: Check access | |
| needs: [validate-call-ref] | |
| # `needs` only runs after non-skipped predecessors. validate-call-ref is | |
| # skipped on pull_request_target (inputs.ref is empty), so use | |
| # `if: always()` to ensure this still runs there. On workflow_call, | |
| # validate-call-ref must have succeeded. | |
| if: | | |
| always() && | |
| (needs.validate-call-ref.result == 'success' || needs.validate-call-ref.result == 'skipped') | |
| # Kept within what the workflow_call caller (release.yml's `integ` job) | |
| # grants — a called workflow's job cannot request more than the caller. | |
| # The collaborator lookup only needs repo read. | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| runs-on: ubuntu-latest | |
| outputs: | |
| approval-env: ${{ steps.collab-check.outputs.result }} | |
| steps: | |
| - name: Collaborator Check | |
| uses: actions/github-script@v9 | |
| id: collab-check | |
| env: | |
| # Only a workflow_call caller (release.yml) sets this; empty on | |
| # pull_request_target. When set, skip the collaborator lookup — the | |
| # caller is workflow_dispatch-gated and already requires write access. | |
| CALL_REF: ${{ inputs.ref }} | |
| with: | |
| result-encoding: string | |
| script: | | |
| if (process.env.CALL_REF) { | |
| console.log("workflow_call path (release); skipping collaborator check.") | |
| return "auto-approve" | |
| } | |
| try { | |
| const permissionResponse = await github.rest.repos.getCollaboratorPermissionLevel({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| username: context.payload.pull_request.user.login, | |
| }); | |
| const permission = permissionResponse.data.permission; | |
| const hasWriteAccess = ['write', 'admin'].includes(permission); | |
| if (!hasWriteAccess) { | |
| console.log(`User ${context.payload.pull_request.user.login} does not have write access to the repository (permission: ${permission})`); | |
| return "manual-approval" | |
| } else { | |
| console.log(`Verifed ${context.payload.pull_request.user.login} has write access. Auto Approving PR Checks.`) | |
| return "auto-approve" | |
| } | |
| } catch (error) { | |
| console.log(`${context.payload.pull_request.user.login} does not have write access. Requiring Manual Approval to run PR Checks.`) | |
| return "manual-approval" | |
| } | |
| check-access-and-checkout: | |
| name: Run integration tests | |
| runs-on: ubuntu-latest | |
| needs: authorization-check | |
| if: always() && needs.authorization-check.result == 'success' | |
| environment: ${{ needs.authorization-check.outputs.approval-env }} | |
| permissions: | |
| id-token: write | |
| pull-requests: read | |
| contents: read | |
| steps: | |
| - name: Configure Credentials | |
| uses: aws-actions/configure-aws-credentials@v6 | |
| with: | |
| role-to-assume: ${{ secrets.STRANDS_INTEG_TEST_ROLE }} | |
| aws-region: us-east-1 | |
| mask-aws-account-id: true | |
| - name: Checkout head commit | |
| uses: actions/checkout@v7 | |
| with: | |
| # On workflow_call (release) use the pinned ref; on | |
| # pull_request_target pull the PR head from the forked repo. | |
| ref: ${{ inputs.ref || github.event.pull_request.head.sha }} | |
| persist-credentials: false # Don't persist credentials for subsequent actions | |
| # Opt back into fork-PR checkout, blocked by default in checkout@v7. | |
| # Safe here: the authorization-check job gates external contributors | |
| # behind the manual-approval environment before this job runs. | |
| allow-unsafe-pr-checkout: true | |
| - name: Set up Python | |
| uses: actions/setup-python@v7 | |
| with: | |
| python-version: '3.10' | |
| - name: Install dependencies | |
| run: | | |
| pip install --no-cache-dir hatch | |
| - name: Run integration tests | |
| env: | |
| AWS_REGION: us-east-1 | |
| AWS_REGION_NAME: us-east-1 | |
| STRANDS_TEST_API_KEYS_SECRET_NAME: ${{ secrets.STRANDS_TEST_API_KEYS_SECRET_NAME }} | |
| id: tests | |
| run: | | |
| hatch test tests_integ |