release-checkpoint.yml

name: Release checkpoint

# Publishes langgraph-checkpoint-aerospike to PyPI.
#
# Both workspace packages are versioned and released together, so a single
# `v*` tag drives the release: this workflow and release-store.yml both fire
# on the same tag and publish their respective package. The packages live in
# one repo only to keep a user's import surface small; they are not meant to
# be released independently.
#
# This is a separate file from release-store.yml because PyPI trusted
# publishing pins each project to a specific workflow filename. Configure the
# langgraph-checkpoint-aerospike trusted publisher on PyPI with this repo,
# workflow `release-checkpoint.yml`, and the `pypi` environment.

on:
  push:
    tags:
      - "v*"

permissions:
  contents: read

jobs:
  validate:
    name: Validate release
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Verify tag matches pyproject.toml version
        shell: bash
        run: |
          set -euo pipefail

          tag="${GITHUB_REF_NAME}"
          expected="${tag#v}"

          actual="$(python3 - <<'PY'
          import tomllib

          with open("packages/langgraph-checkpoint-aerospike/pyproject.toml", "rb") as f:
              print(tomllib.load(f)["project"]["version"])
          PY
          )"

          if [ "${tag}" = "${expected}" ]; then
            echo "::error::Release tag must start with 'v' (for example, v${actual})."
            exit 1
          fi

          if [ "${expected}" != "${actual}" ]; then
            echo "::error::Tag ${tag} implies version ${expected}, but packages/langgraph-checkpoint-aerospike/pyproject.toml has ${actual}."
            exit 1
          fi

  test:
    name: Tests (Python ${{ matrix.python-version }})
    needs: validate
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.13"]

    services:
      aerospike:
        image: aerospike/aerospike-server:8.1
        ports:
          - 3000:3000
        # The CE image ships with default-ttl=0, which disables nsup and makes
        # the server reject any write that carries a TTL. Our tests always pass
        # a TTL, so enable nsup by setting a non-zero default-ttl here.
        env:
          DEFAULT_TTL: 30d

    env:
      AEROSPIKE_HOST: localhost
      AEROSPIKE_PORT: "3000"
      AEROSPIKE_NAMESPACE: test

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install uv (and Python ${{ matrix.python-version }})
        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          enable-cache: true
          python-version: ${{ matrix.python-version }}

      - name: Sync dependencies
        run: uv sync

      - name: Ruff (lint)
        run: uv run ruff check .

      - name: Ruff (format check)
        run: uv run ruff format --check .

      - name: Mypy
        run: uv run mypy

      - name: Deptry (langgraph-checkpoint-aerospike)
        run: uv run deptry packages/langgraph-checkpoint-aerospike --config packages/langgraph-checkpoint-aerospike/pyproject.toml

      - name: Wait for Aerospike to accept connections
        run: |
          for i in $(seq 1 30); do
            if (echo > /dev/tcp/127.0.0.1/3000) >/dev/null 2>&1; then
              echo "Aerospike is reachable on port 3000"
              exit 0
            fi
            echo "Waiting for Aerospike... ($i/30)"
            sleep 1
          done
          echo "Aerospike never became reachable"
          exit 1

      - name: Run tests
        run: uv run pytest -v

  build:
    name: Build langgraph-checkpoint-aerospike
    needs: test
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install uv
        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          enable-cache: true

      - name: Build sdist and wheel
        run: uv build --package langgraph-checkpoint-aerospike

      - name: Upload distributions
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: dist-langgraph-checkpoint-aerospike
          path: dist/

  publish:
    name: Publish langgraph-checkpoint-aerospike to PyPI
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/p/langgraph-checkpoint-aerospike
    permissions:
      id-token: write

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
        with:
          egress-policy: audit

      - name: Download distributions
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: dist-langgraph-checkpoint-aerospike
          path: dist/

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1