test.yml

name: Test

on:
  pull_request:
  push:
    branches:
      - "main"

jobs:
  test:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.13"

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"

      - name: Run tests
        run: |
          python -m pytest tests/ -v --cov=claude_agent_sdk --cov-report=xml

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4.6.0 (sha-pinned)
        with:
          file: ./coverage.xml
          fail_ci_if_error: false

  test-e2e:
    # Skip on forks since they can't mint the OIDC token used for Claude API auth
    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ${{ matrix.os }}
    needs: test # Run after unit tests pass
    permissions:
      contents: read
      # Required to mint the OIDC token exchanged for a Claude API access
      # token (workload identity federation)
      id-token: write
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.13"

      - name: Install Claude Code (Linux/macOS)
        if: runner.os == 'Linux' || runner.os == 'macOS'
        # `shell: bash` runs with -eo pipefail. Without pipefail the step takes
        # its status from `bash`, which exits 0 on an empty script, so a failed
        # `curl` leaves the CLI uninstalled and the step green.
        shell: bash
        run: |
          curl -fsSL https://claude.ai/install.sh | bash
          echo "$HOME/.local/bin" >> $GITHUB_PATH

      - name: Install Claude Code (Windows)
        if: runner.os == 'Windows'
        run: |
          irm https://claude.ai/install.ps1 | iex
          $claudePath = "$env:USERPROFILE\.local\bin"
          echo "$claudePath" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
        shell: pwsh

      - name: Verify Claude Code installation
        run: claude -v

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"

      - name: Set up Claude API auth (workload identity federation)
        uses: ./.github/actions/setup-claude-auth

      - name: Run end-to-end tests with real API
        env:
          ANTHROPIC_FEDERATION_RULE_ID: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
          ANTHROPIC_ORGANIZATION_ID: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
          ANTHROPIC_SERVICE_ACCOUNT_ID: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
        run: |
          python -m pytest e2e-tests/ -v -m e2e

  test-e2e-docker:
    # Skip on forks since they can't mint the OIDC token used for Claude API auth
    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubuntu-latest
    needs: test # Run after unit tests pass
    permissions:
      contents: read
      # Required to mint the OIDC token exchanged for a Claude API access
      # token (workload identity federation)
      id-token: write
    # Run e2e tests in Docker to catch container-specific issues like #406

    steps:
      - uses: actions/checkout@v4

      - name: Build Docker test image
        run: docker build -f Dockerfile.test -t claude-sdk-test .

      - name: Set up Claude API auth (workload identity federation)
        uses: ./.github/actions/setup-claude-auth

      - name: Run e2e tests in Docker
        env:
          ANTHROPIC_FEDERATION_RULE_ID: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
          ANTHROPIC_ORGANIZATION_ID: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
          ANTHROPIC_SERVICE_ACCOUNT_ID: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
        # Bind-mount the identity token file so the background refresher on
        # the host keeps the in-container copy fresh too
        run: |
          docker run --rm \
            -e ANTHROPIC_FEDERATION_RULE_ID \
            -e ANTHROPIC_ORGANIZATION_ID \
            -e ANTHROPIC_SERVICE_ACCOUNT_ID \
            -e ANTHROPIC_IDENTITY_TOKEN_FILE=/run/claude-identity-token \
            -v "$ANTHROPIC_IDENTITY_TOKEN_FILE:/run/claude-identity-token:ro" \
            claude-sdk-test python -m pytest e2e-tests/ -v -m e2e

  test-examples:
    # Skip on forks since they can't mint the OIDC token used for Claude API auth
    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubuntu-latest
    needs: test-e2e # Run after e2e tests
    permissions:
      contents: read
      # Required to mint the OIDC token exchanged for a Claude API access
      # token (workload identity federation)
      id-token: write

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.13"

      - name: Install Claude Code (Linux)
        if: runner.os == 'Linux'
        # `shell: bash` runs with -eo pipefail; see the note in the test job.
        shell: bash
        run: |
          curl -fsSL https://claude.ai/install.sh | bash
          echo "$HOME/.local/bin" >> $GITHUB_PATH

      - name: Install Claude Code (Windows)
        if: runner.os == 'Windows'
        run: |
          irm https://claude.ai/install.ps1 | iex
          $claudePath = "$env:USERPROFILE\.local\bin"
          echo "$claudePath" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
        shell: pwsh

      - name: Verify Claude Code installation
        run: claude -v

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e .

      - name: Set up Claude API auth (workload identity federation)
        uses: ./.github/actions/setup-claude-auth

      - name: Run example scripts (Linux)
        if: runner.os == 'Linux'
        env:
          ANTHROPIC_FEDERATION_RULE_ID: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
          ANTHROPIC_ORGANIZATION_ID: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
          ANTHROPIC_SERVICE_ACCOUNT_ID: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
          PYTHONUNBUFFERED: "1"
        run: |
          python examples/quick_start.py
          timeout 300 python examples/streaming_mode.py all
          timeout 120 python examples/hooks.py PreToolUse
          timeout 120 python examples/hooks.py DecisionFields

      - name: Run example scripts (Windows)
        if: runner.os == 'Windows'
        env:
          ANTHROPIC_FEDERATION_RULE_ID: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
          ANTHROPIC_ORGANIZATION_ID: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
          ANTHROPIC_SERVICE_ACCOUNT_ID: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
          PYTHONUNBUFFERED: "1"
        run: |
          python examples/quick_start.py
          $job = Start-Job { python examples/streaming_mode.py all }
          Wait-Job $job -Timeout 300 | Out-Null
          Stop-Job $job
          Receive-Job $job

          $job = Start-Job { python examples/hooks.py PreToolUse }
          Wait-Job $job -Timeout 120 | Out-Null
          Stop-Job $job
          Receive-Job $job

          $job = Start-Job { python examples/hooks.py DecisionFields }
          Wait-Job $job -Timeout 120 | Out-Null
          Stop-Job $job
          Receive-Job $job
        shell: pwsh