check-file-contents.yml

name: "Check file contents"

on:
  pull_request:
    paths:
      - '**.py'

permissions:
  contents: read

jobs:
  check-file-contents:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v6
        with:
          fetch-depth: 2

      - name: Check for logger pattern in all changed Python files
        run: |
          git fetch origin ${GITHUB_BASE_REF}
          CHANGED_FILES=$(git diff --diff-filter=ACMR --name-only origin/${GITHUB_BASE_REF}...HEAD | grep -E '\.py$' || true)
          if [ -n "$CHANGED_FILES" ]; then
            echo "Changed Python files to check:"
            echo "$CHANGED_FILES"
            echo ""

            # Check for 'logger = logging.getLogger(__name__)' in changed .py files.
            # The grep command will exit with a non-zero status code if the pattern is not found.
            # We invert the exit code with ! so the step succeeds if the pattern is NOT found.
            set +e
            FILES_WITH_FORBIDDEN_LOGGER=$(grep -lE 'logger = logging\.getLogger\(__name__\)' $CHANGED_FILES)
            GREP_EXIT_CODE=$?
            set -e

            # grep exits with 0 if matches are found, 1 if no matches are found.
            # A non-zero exit code other than 1 indicates an error.
            if [ $GREP_EXIT_CODE -eq 0 ]; then
              echo "❌ Found forbidden use of 'logger = logging.getLogger(__name__)'. Please use 'logger = logging.getLogger('google_adk.' + __name__)' instead."
              echo "The following files contain the forbidden pattern:"
              echo "$FILES_WITH_FORBIDDEN_LOGGER"
              exit 1
            elif [ $GREP_EXIT_CODE -eq 1 ]; then
              echo "✅ No instances of 'logger = logging.getLogger(__name__)' found in changed Python files."
            fi
          else
            echo "✅ No relevant Python files found."
          fi

      - name: Check for import pattern in certain changed Python files
        run: |
          git fetch origin ${GITHUB_BASE_REF}
          CHANGED_FILES=$(git diff --diff-filter=ACMR --name-only origin/${GITHUB_BASE_REF}...HEAD | grep -E '\.py$' | grep -v -E '__init__.py$|version.py$|tests/.*|contributing/samples/' || true)
          if [ -n "$CHANGED_FILES" ]; then
            echo "Changed Python files to check:"
            echo "$CHANGED_FILES"
            echo ""

            # Use grep -L to find files that DO NOT contain the pattern.
            # This command will output a list of non-compliant files.
            FILES_MISSING_IMPORT=$(grep -L 'from __future__ import annotations' $CHANGED_FILES || true)

            # Check if the list of non-compliant files is empty
            if [ -z "$FILES_MISSING_IMPORT" ]; then
              echo "✅ All modified Python files include 'from __future__ import annotations'."
              exit 0
            else
              echo "❌ The following files are missing 'from __future__ import annotations':"
              echo "$FILES_MISSING_IMPORT"
              echo "This import is required to allow forward references in type annotations without quotes."
              exit 1
            fi
          else
            echo "✅ No relevant Python files found."
          fi

      - name: Check for import from cli package in certain changed Python files
        run: |
          git fetch origin ${GITHUB_BASE_REF}
          CHANGED_FILES=$(git diff --diff-filter=ACMR --name-only origin/${GITHUB_BASE_REF}...HEAD | grep -E '\.py$' | grep -v -E 'cli/.*|src/google/adk/tools/apihub_tool/apihub_toolset.py|tests/.*|contributing/samples/' || true)
          if [ -n "$CHANGED_FILES" ]; then
            echo "Changed Python files to check:"
            echo "$CHANGED_FILES"
            echo ""

            set +e
            FILES_WITH_FORBIDDEN_IMPORT=$(grep -lE '^from.*\bcli\b.*import.*$' $CHANGED_FILES)
            GREP_EXIT_CODE=$?
            set -e

            if [[ $GREP_EXIT_CODE -eq 0 ]]; then
              echo "❌ Do not import from the cli package outside of the cli package. If you need to reuse the code elsewhere, please move the code outside of the cli package."
              echo "The following files contain the forbidden pattern:"
              echo "$FILES_WITH_FORBIDDEN_IMPORT"
              exit 1
            else
              echo "✅ No instances of importing from the cli package found in relevant changed Python files."
            fi
          else
            echo "✅ No relevant Python files found."
          fi

      - name: Check for hardcoded googleapis.com endpoints
        run: |
          git fetch origin ${GITHUB_BASE_REF}
          CHANGED_FILES=$(git diff --diff-filter=ACMR --name-only origin/${GITHUB_BASE_REF}...HEAD | grep -E '\.py$' || true)
          if [ -n "$CHANGED_FILES" ]; then
            echo "Checking for hardcoded endpoints in: $CHANGED_FILES"

            # 1. Identify files containing any googleapis.com URL.
            set +e
            FILES_WITH_ENDPOINTS=$(grep -lE 'https?://[a-zA-Z0-9.-]+\.googleapis\.com' $CHANGED_FILES)

            # 2. From those, identify files that are MISSING the required mTLS version.
            if [ -n "$FILES_WITH_ENDPOINTS" ]; then
              FILES_MISSING_MTLS=$(grep -L '.mtls.googleapis.com' $FILES_WITH_ENDPOINTS)
            fi
            set -e

            if [ -n "$FILES_MISSING_MTLS" ]; then
              echo "❌ Found hardcoded googleapis.com endpoints without mTLS support."
              echo "The following files must define both standard and mTLS (.mtls.googleapis.com) endpoints"
              echo "to support dynamic endpoint selection as required by security policy:"
              echo "$FILES_MISSING_MTLS"
              echo ""
              echo "To fix this, please follow these steps:"
              echo "1. Initialize an AuthorizedSession with your credentials."
              echo "2. Use 'mtls.has_default_client_cert_source() from google-auth' to check for available client certificates."
              echo "3. If certificates are present, use 'session.configure_mtls_channel()'."
              echo "4. Dynamically select the '.mtls.' variant of the endpoint when mTLS is active."
              exit 1
            else
              echo "✅ All hardcoded endpoints have corresponding mTLS definitions or no endpoints found."
            fi
          fi