feat(skills): Allow opt-in session state injection in skill instructions #9792
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "Check file contents" | |
| on: | |
| pull_request: | |
| paths: | |
| - '**.py' | |
| permissions: | |
| contents: read | |
| jobs: | |
| check-file-contents: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 2 | |
| - name: Check for logger pattern in all changed Python files | |
| run: | | |
| git fetch origin ${GITHUB_BASE_REF} | |
| CHANGED_FILES=$(git diff --diff-filter=ACMR --name-only origin/${GITHUB_BASE_REF}...HEAD | grep -E '\.py$' || true) | |
| if [ -n "$CHANGED_FILES" ]; then | |
| echo "Changed Python files to check:" | |
| echo "$CHANGED_FILES" | |
| echo "" | |
| # Check for 'logger = logging.getLogger(__name__)' in changed .py files. | |
| # The grep command will exit with a non-zero status code if the pattern is not found. | |
| # We invert the exit code with ! so the step succeeds if the pattern is NOT found. | |
| set +e | |
| FILES_WITH_FORBIDDEN_LOGGER=$(grep -lE 'logger = logging\.getLogger\(__name__\)' $CHANGED_FILES) | |
| GREP_EXIT_CODE=$? | |
| set -e | |
| # grep exits with 0 if matches are found, 1 if no matches are found. | |
| # A non-zero exit code other than 1 indicates an error. | |
| if [ $GREP_EXIT_CODE -eq 0 ]; then | |
| echo "❌ Found forbidden use of 'logger = logging.getLogger(__name__)'. Please use 'logger = logging.getLogger('google_adk.' + __name__)' instead." | |
| echo "The following files contain the forbidden pattern:" | |
| echo "$FILES_WITH_FORBIDDEN_LOGGER" | |
| exit 1 | |
| elif [ $GREP_EXIT_CODE -eq 1 ]; then | |
| echo "✅ No instances of 'logger = logging.getLogger(__name__)' found in changed Python files." | |
| fi | |
| else | |
| echo "✅ No relevant Python files found." | |
| fi | |
| - name: Check for import pattern in certain changed Python files | |
| run: | | |
| git fetch origin ${GITHUB_BASE_REF} | |
| CHANGED_FILES=$(git diff --diff-filter=ACMR --name-only origin/${GITHUB_BASE_REF}...HEAD | grep -E '\.py$' | grep -v -E '__init__.py$|version.py$|tests/.*|contributing/samples/' || true) | |
| if [ -n "$CHANGED_FILES" ]; then | |
| echo "Changed Python files to check:" | |
| echo "$CHANGED_FILES" | |
| echo "" | |
| # Use grep -L to find files that DO NOT contain the pattern. | |
| # This command will output a list of non-compliant files. | |
| FILES_MISSING_IMPORT=$(grep -L 'from __future__ import annotations' $CHANGED_FILES || true) | |
| # Check if the list of non-compliant files is empty | |
| if [ -z "$FILES_MISSING_IMPORT" ]; then | |
| echo "✅ All modified Python files include 'from __future__ import annotations'." | |
| exit 0 | |
| else | |
| echo "❌ The following files are missing 'from __future__ import annotations':" | |
| echo "$FILES_MISSING_IMPORT" | |
| echo "This import is required to allow forward references in type annotations without quotes." | |
| exit 1 | |
| fi | |
| else | |
| echo "✅ No relevant Python files found." | |
| fi | |
| - name: Check for import from cli package in certain changed Python files | |
| run: | | |
| git fetch origin ${GITHUB_BASE_REF} | |
| CHANGED_FILES=$(git diff --diff-filter=ACMR --name-only origin/${GITHUB_BASE_REF}...HEAD | grep -E '\.py$' | grep -v -E 'cli/.*|src/google/adk/tools/apihub_tool/apihub_toolset.py|tests/.*|contributing/samples/' || true) | |
| if [ -n "$CHANGED_FILES" ]; then | |
| echo "Changed Python files to check:" | |
| echo "$CHANGED_FILES" | |
| echo "" | |
| set +e | |
| FILES_WITH_FORBIDDEN_IMPORT=$(grep -lE '^from.*\bcli\b.*import.*$' $CHANGED_FILES) | |
| GREP_EXIT_CODE=$? | |
| set -e | |
| if [[ $GREP_EXIT_CODE -eq 0 ]]; then | |
| echo "❌ Do not import from the cli package outside of the cli package. If you need to reuse the code elsewhere, please move the code outside of the cli package." | |
| echo "The following files contain the forbidden pattern:" | |
| echo "$FILES_WITH_FORBIDDEN_IMPORT" | |
| exit 1 | |
| else | |
| echo "✅ No instances of importing from the cli package found in relevant changed Python files." | |
| fi | |
| else | |
| echo "✅ No relevant Python files found." | |
| fi | |
| - name: Check for hardcoded googleapis.com endpoints | |
| run: | | |
| git fetch origin ${GITHUB_BASE_REF} | |
| CHANGED_FILES=$(git diff --diff-filter=ACMR --name-only origin/${GITHUB_BASE_REF}...HEAD | grep -E '\.py$' || true) | |
| if [ -n "$CHANGED_FILES" ]; then | |
| echo "Checking for hardcoded endpoints in: $CHANGED_FILES" | |
| # 1. Identify files containing any googleapis.com URL. | |
| set +e | |
| FILES_WITH_ENDPOINTS=$(grep -lE 'https?://[a-zA-Z0-9.-]+\.googleapis\.com' $CHANGED_FILES) | |
| # 2. From those, identify files that are MISSING the required mTLS version. | |
| if [ -n "$FILES_WITH_ENDPOINTS" ]; then | |
| FILES_MISSING_MTLS=$(grep -L '.mtls.googleapis.com' $FILES_WITH_ENDPOINTS) | |
| fi | |
| set -e | |
| if [ -n "$FILES_MISSING_MTLS" ]; then | |
| echo "❌ Found hardcoded googleapis.com endpoints without mTLS support." | |
| echo "The following files must define both standard and mTLS (.mtls.googleapis.com) endpoints" | |
| echo "to support dynamic endpoint selection as required by security policy:" | |
| echo "$FILES_MISSING_MTLS" | |
| echo "" | |
| echo "To fix this, please follow these steps:" | |
| echo "1. Initialize an AuthorizedSession with your credentials." | |
| echo "2. Use 'mtls.has_default_client_cert_source() from google-auth' to check for available client certificates." | |
| echo "3. If certificates are present, use 'session.configure_mtls_channel()'." | |
| echo "4. Dynamically select the '.mtls.' variant of the endpoint when mTLS is active." | |
| exit 1 | |
| else | |
| echo "✅ All hardcoded endpoints have corresponding mTLS definitions or no endpoints found." | |
| fi | |
| fi |