Merge remote-tracking branch 'origin/main' into fix-thought-signature-pruning

Author: its-amann

.github/workflows/analyze-releases-for-adk-docs-updates.yml

@@ -37,6 +37,7 @@ on:
 
 jobs:
   analyze-new-release-for-adk-docs-updates:
+    if: github.repository == 'google/adk-python'
     runs-on: ubuntu-latest
     permissions:
       contents: read

.github/workflows/block-merge.yml

@@ -16,10 +16,12 @@ name: Do Not Merge on GitHub
 
 on:
   pull_request:
+    branches: [main]
     types: [opened, reopened, synchronize]
 
 jobs:
   block-merge:
+    if: github.repository == 'google/adk-python'
     name: maintainers will submit via Copybara
     runs-on: ubuntu-latest
     steps:

.github/workflows/continuous-integration.yml

@@ -149,128 +149,4 @@ jobs:
             --ignore=tests/unittests/artifacts/test_artifact_service.py \
             --ignore=tests/unittests/tools/google_api_tool/test_googleapi_to_openapi_converter.py
 
-  # 4. Custom file content compliance checks (PR only)
-  compliance-check:
-    name: File Content Compliance
-    runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request'
-    steps:
-      - name: Checkout Code
-        uses: actions/checkout@v6
-        with:
-          # Fetch full history (depth: 0) instead of shallow clone (depth: 2) to ensure
-          # git diff origin/${base_ref}...HEAD can reliably find the merge base,
-          # preventing fatal git errors on deep PRs or when the target branch has progressed.
-          fetch-depth: 0
-
-      - name: Check for logger pattern in all changed Python files
-        run: |
-          git fetch origin ${GITHUB_BASE_REF}
-          CHANGED_FILES=$(git diff --diff-filter=ACMR --name-only origin/${GITHUB_BASE_REF}...HEAD | grep -E '\.py$' || true)
-          if [ -n "$CHANGED_FILES" ]; then
-            echo "Changed Python files to check:"
-            echo "$CHANGED_FILES"
-            echo ""
-
-            # Check for 'logger = logging.getLogger(__name__)' in changed .py files.
-            set +e
-            FILES_WITH_FORBIDDEN_LOGGER=$(grep -lE 'logger = logging\.getLogger\(__name__\)' $CHANGED_FILES)
-            GREP_EXIT_CODE=$?
-            set -e
-
-            if [ $GREP_EXIT_CODE -eq 0 ]; then
-              echo "❌ Found forbidden use of 'logger = logging.getLogger(__name__)'. Please use 'logger = logging.getLogger('google_adk.' + __name__)' instead."
-              echo "The following files contain the forbidden pattern:"
-              echo "$FILES_WITH_FORBIDDEN_LOGGER"
-              exit 1
-            elif [ $GREP_EXIT_CODE -eq 1 ]; then
-              echo "✅ No instances of 'logger = logging.getLogger(__name__)' found in changed Python files."
-            fi
-          else
-            echo "✅ No relevant Python files found."
-          fi
-
-      - name: Check for import pattern in certain changed Python files
-        run: |
-          git fetch origin ${GITHUB_BASE_REF}
-          CHANGED_FILES=$(git diff --diff-filter=ACMR --name-only origin/${GITHUB_BASE_REF}...HEAD | grep -E '\.py$' | grep -v -E '__init__.py$|version.py$|tests/.*|contributing/samples/' || true)
-          if [ -n "$CHANGED_FILES" ]; then
-            echo "Changed Python files to check:"
-            echo "$CHANGED_FILES"
-            echo ""
-
-            # Use grep -L to find files that DO NOT contain the pattern.
-            FILES_MISSING_IMPORT=$(grep -L 'from __future__ import annotations' $CHANGED_FILES || true)
 
-            if [ -z "$FILES_MISSING_IMPORT" ]; then
-              echo "✅ All modified Python files include 'from __future__ import annotations'."
-              exit 0
-            else
-              echo "❌ The following files are missing 'from __future__ import annotations':"
-              echo "$FILES_MISSING_IMPORT"
-              echo "This import is required to allow forward references in type annotations without quotes."
-              exit 1
-            fi
-          else
-            echo "✅ No relevant Python files found."
-          fi
-
-      - name: Check for import from cli package in certain changed Python files
-        run: |
-          git fetch origin ${GITHUB_BASE_REF}
-          CHANGED_FILES=$(git diff --diff-filter=ACMR --name-only origin/${GITHUB_BASE_REF}...HEAD | grep -E '\.py$' | grep -v -E 'cli/.*|src/google/adk/tools/apihub_tool/apihub_toolset.py|tests/.*|contributing/samples/' || true)
-          if [ -n "$CHANGED_FILES" ]; then
-            echo "Changed Python files to check:"
-            echo "$CHANGED_FILES"
-            echo ""
-
-            set +e
-            FILES_WITH_FORBIDDEN_IMPORT=$(grep -lE '^from.*\bcli\b.*import.*$' $CHANGED_FILES)
-            GREP_EXIT_CODE=$?
-            set -e
-
-            if [[ $GREP_EXIT_CODE -eq 0 ]]; then
-              echo "❌ Do not import from the cli package outside of the cli package. If you need to reuse the code elsewhere, please move the code outside of the cli package."
-              echo "The following files contain the forbidden pattern:"
-              echo "$FILES_WITH_FORBIDDEN_IMPORT"
-              exit 1
-            else
-              echo "✅ No instances of importing from the cli package found in relevant changed Python files."
-            fi
-          else
-            echo "✅ No relevant Python files found."
-          fi
-
-      - name: Check for hardcoded googleapis.com endpoints
-        run: |
-          git fetch origin ${GITHUB_BASE_REF}
-          CHANGED_FILES=$(git diff --diff-filter=ACMR --name-only origin/${GITHUB_BASE_REF}...HEAD | grep -E '\.py$' || true)
-          if [ -n "$CHANGED_FILES" ]; then
-            echo "Checking for hardcoded endpoints in: $CHANGED_FILES"
-
-            # 1. Identify files containing any googleapis.com URL.
-            set +e
-            FILES_WITH_ENDPOINTS=$(grep -lE 'https?://[a-zA-Z0-9.-]+\.googleapis\.com' $CHANGED_FILES)
-
-            # 2. From those, identify files that are MISSING the required mTLS version.
-            if [ -n "$FILES_WITH_ENDPOINTS" ]; then
-              FILES_MISSING_MTLS=$(grep -L '.mtls.googleapis.com' $FILES_WITH_ENDPOINTS)
-            fi
-            set -e
-
-            if [ -n "$FILES_MISSING_MTLS" ]; then
-              echo "❌ Found hardcoded googleapis.com endpoints without mTLS support."
-              echo "The following files must define both standard and mTLS (.mtls.googleapis.com) endpoints"
-              echo "to support dynamic endpoint selection as required by security policy:"
-              echo "$FILES_MISSING_MTLS"
-              echo ""
-              echo "To fix this, please follow these steps:"
-              echo "1. Initialize an AuthorizedSession with your credentials."
-              echo "2. Use 'mtls.has_default_client_cert_source() from google-auth' to check for available client certificates."
-              echo "3. If certificates are present, use 'session.configure_mtls_channel()'."
-              echo "4. Dynamically select the '.mtls.' variant of the endpoint when mTLS is active."
-              exit 1
-            else
-              echo "✅ All hardcoded endpoints have corresponding mTLS definitions or no endpoints found."
-            fi
-          fi

.github/workflows/discussion_answering.yml

@@ -26,8 +26,10 @@ permissions:
 jobs:
   agent-answer-questions:
     if: >-
+      github.repository == 'google/adk-python' && (
       (github.event_name == 'discussion' && github.event.discussion.category.name == 'Q&A') ||
       (github.event_name == 'discussion_comment' && contains(github.event.comment.body, '@adk-bot') && github.event.sender.login != 'adk-bot')
+      )
     runs-on: ubuntu-latest
 
     steps:

.github/workflows/release-cherry-pick.yml

@@ -34,6 +34,7 @@ on:
 
 jobs:
   cherry-pick:
+    if: github.repository == 'google/adk-python'
     runs-on: ubuntu-latest
     steps:
       - name: Determine Branch Configurations

.github/workflows/release-cut.yml

@@ -47,6 +47,7 @@ permissions:
 
 jobs:
   cut-or-regenerate:
+    if: github.repository == 'google/adk-python'
     runs-on: ubuntu-latest
     steps:
       - name: Determine Branch Configurations

.github/workflows/release-finalize.yml

@@ -29,7 +29,7 @@ permissions:
 
 jobs:
   finalize:
-    if: github.event.pull_request.merged == true
+    if: github.event.pull_request.merged == true && github.repository == 'google/adk-python'
     runs-on: ubuntu-latest
     steps:
       - name: Check for release-please PR

.github/workflows/release-publish.yml

@@ -26,6 +26,7 @@ permissions:
 
 jobs:
   publish:
+    if: github.repository == 'google/adk-python'
     runs-on: ubuntu-latest
     steps:
       - name: Validate branch

.github/workflows/release-update-adk-web.yaml

@@ -28,6 +28,7 @@ on:
 
 jobs:
   update-frontend:
+    if: github.repository == 'google/adk-python'
     runs-on: ubuntu-latest
     permissions:
       contents: write

.pre-commit-config.yaml

@@ -56,6 +56,11 @@ repos:
         language: script
         files: ^src/google/adk/.*\.py$
         pass_filenames: false
+      - id: compliance-checks
+        name: ADK Compliance Checks
+        entry: scripts/compliance_checks.py
+        language: script
+        files: \.py$
   - repo: https://github.com/executablebooks/mdformat
     rev: 0.7.22
     hooks: