Sync midstream to upstream

.github/workflows/_test.yml

@@ -23,6 +23,11 @@ on:
         required: false
         default: false
         type: boolean
+      with-coverage:
+        description: "Whether to run tests with coverage reporting"
+        required: false
+        default: false
+        type: boolean
 
 defaults:
   run:
@@ -89,8 +94,23 @@ jobs:
             poetry install --with dev
           fi
 
-      - name: Run pre-commit hooks
-        run: poetry run make pre_commit
+      - name: Run pytest with coverage
+        if: inputs.with-coverage
+        run: poetry run pytest --cov=nemoguardrails tests/ --cov-report=xml:coverage.xml -v
 
-      - name: Run pytest
+      - name: Run pytest without coverage
+        if: inputs.with-coverage == false
         run: poetry run pytest -v
+
+      - name: Upload coverage to Codecov
+        if: inputs.with-coverage
+        uses: codecov/codecov-action@v5
+        with:
+          directory: ./coverage/reports/
+          env_vars: PYTHON
+          fail_ci_if_error: true
+          files: ./coverage.xml
+          flags: python
+          name: codecov-umbrella
+          token: ${{ secrets.CODECOV_TOKEN }}
+          verbose: true

.github/workflows/latest-deps-tests.yml

@@ -9,13 +9,13 @@ jobs:
   latest-deps-tests-matrix:
     strategy:
       matrix:
-        os: [Ubuntu]
+        os: [Ubuntu, macOS, Windows]
         python-version: ["3.10", "3.11", "3.12", "3.13"]
         include:
           - os: Ubuntu
             image: ubuntu-latest
           - os: macOS
-            image: macos-15
+            image: macos-latest
           - os: Windows
             image: windows-latest
       fail-fast: false

.github/workflows/lint.yml

@@ -0,0 +1,54 @@
+name: Lint
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - develop
+  workflow_dispatch:
+
+env:
+  POETRY_VERSION: 1.8.2
+  PYTHON_VERSION: "3.11"
+
+jobs:
+  lint:
+    name: Lint Code
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+
+      - name: Get full Python version
+        id: full-python-version
+        run: echo "version=$(python -c "import sys; print('-'.join(str(v) for v in sys.version_info))")" >> $GITHUB_OUTPUT
+
+      - name: Bootstrap poetry
+        run: |
+          curl -sSL https://install.python-poetry.org | POETRY_VERSION=${{ env.POETRY_VERSION }} python -
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
+
+      - name: Configure poetry
+        run: poetry config virtualenvs.in-project true
+
+      - name: Set up cache
+        uses: actions/cache@v4
+        id: cache
+        with:
+          path: .venv
+          key: venv-${{ runner.os }}-${{ steps.full-python-version.outputs.version }}-${{ hashFiles('**/poetry.lock') }}
+
+      - name: Ensure cache is healthy
+        if: steps.cache.outputs.cache-hit == 'true'
+        run: timeout 10s poetry run pip --version || rm -rf .venv
+
+      - name: Install dependencies
+        run: poetry install --with dev
+
+      - name: Run pre-commit hooks
+        run: poetry run make pre_commit

.github/workflows/pr-tests-skip.yml

@@ -0,0 +1,14 @@
+name: Skip PR Tests
+
+on:
+  pull_request:
+    paths:
+      - "**/*.md"
+      - ".github/**"
+
+jobs:
+  pr-tests-summary:
+    name: PR Tests Summary
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo "Tests skipped (no code changes)"

.github/workflows/pr-tests.yml

@@ -2,8 +2,8 @@ name: PR Tests
 
 on:
   pull_request:
-    # we don't ignore markdkowns to run pre-commits
     paths-ignore:
+      - "**/*.md"
       - ".github/**"
 
 jobs:
@@ -15,12 +15,16 @@ jobs:
         include:
           - os: Ubuntu
             image: ubuntu-latest
+          - python-version: "3.11"
+            with-coverage: true
       fail-fast: false
     uses: ./.github/workflows/_test.yml
+    secrets: inherit
     with:
       os: ${{ matrix.os }}
       image: ${{ matrix.image }}
       python-version: ${{ matrix.python-version }}
+      with-coverage: ${{ matrix.with-coverage || false }}
   pr-tests-summary:
     name: PR Tests Summary
     needs: pr-tests-matrix

.github/workflows/publish-pypi-approval.yml

@@ -18,35 +18,35 @@ jobs:
       id-token: write
 
     steps:
-      - name: Checkout repository for tag detection
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Detect version tag and extract info
+      - name: Detect version tag from workflow event
         id: version
         run: |
-          COMMIT_SHA="${{ github.event.workflow_run.head_sha }}"
+          HEAD_BRANCH="${{ github.event.workflow_run.head_branch }}"
+
+          echo "Workflow triggered by: $HEAD_BRANCH"
 
-          TAG_NAME=$(git tag --points-at "$COMMIT_SHA" | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+' | head -1)
+          if [[ "$HEAD_BRANCH" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            TAG_NAME="$HEAD_BRANCH"
+            VERSION="${TAG_NAME#v}"
 
-          if [ -z "$TAG_NAME" ]; then
-            echo "❌ No version tag found at commit $COMMIT_SHA"
-            echo "Available tags at this commit:"
-            git tag --points-at "$COMMIT_SHA" || echo "  (none)"
+            echo "version=${VERSION}" >> $GITHUB_OUTPUT
+            echo "tag=${TAG_NAME}" >> $GITHUB_OUTPUT
+            echo "artifact_name=${TAG_NAME}-build" >> $GITHUB_OUTPUT
+
+            echo "✅ Detected version tag: $TAG_NAME"
+            echo "   Version: $VERSION"
+            echo "   Artifact: ${TAG_NAME}-build"
+          else
+            echo "❌ Not triggered by a version tag: $HEAD_BRANCH"
+            echo "This workflow should only run for version tags (vX.Y.Z)"
             exit 1
           fi
 
-          VERSION="${TAG_NAME#v}"
-          echo "version=${VERSION}" >> $GITHUB_OUTPUT
-          echo "tag=${TAG_NAME}" >> $GITHUB_OUTPUT
-          echo "artifact_name=${TAG_NAME}-build" >> $GITHUB_OUTPUT
-          echo "✅ Detected version tag: $TAG_NAME"
-
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
           ref: ${{ steps.version.outputs.tag }}
+          fetch-depth: 0
 
       - name: Validate version matches tag
         run: |

.github/workflows/test-docker.yml

@@ -3,35 +3,48 @@ name: Test Docker Image
 # TODO: set docker auth
 on:
   workflow_dispatch:
-# on:
-#   push:
-#     tags:
-#       - "v*"
-
-env:
-  IMAGE: nemoguardrails
-  TEST_TAG: ${{ env.IMAGE }}:test
-  LATEST_TAG: ${{ env.IMAGE }}:latest
+  schedule:
+    - cron: "0 0 * * 0"
+  push:
+    tags:
+      - "v*"
+  pull_request:
+    paths:
+      - "Dockerfile"
+      - "pyproject.toml"
+      - "poetry.lock"
+      - ".github/workflows/test-docker.yml"
 
 jobs:
   docker:
     runs-on: ubuntu-latest
+    env:
+      IMAGE: nemoguardrails
     steps:
       #
       # Checkout the code
       - name: Checkout
         uses: actions/checkout@v4
 
-      # Extract the tag version and set Docker tags
-      - name: Get git tag and set Docker tags
+      # Get runner architecture
+      - name: Get runner architecture
+        id: runner-arch
+        run: echo "arch=$(uname -m)" >> $GITHUB_OUTPUT
+
+      - name: Set Docker tags
         run: |
-          VERSION=${GITHUB_REF#refs/tags/v}
-          echo "VERSION=$VERSION" >> $GITHUB_ENV
-          echo "VERSION_TAG=${{ env.IMAGE }}:$VERSION" >> $GITHUB_ENV
+          ARCH=${{ steps.runner-arch.outputs.arch }}
+          echo "TEST_TAG=${{ env.IMAGE }}:${{ github.sha }}-$ARCH" >> $GITHUB_ENV
 
-      # Build the Docker image
-      - name: Build the Docker image
-        run: docker build . --file Dockerfile --tag ${{ env.TEST_TAG }} --tag ${{ env.VERSION_TAG }}
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Build image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: Dockerfile
+          load: true
+          tags: ${{ env.TEST_TAG }}
 
       # Start the container in detached mode
       - name: Start container

.pre-commit-config.yaml

@@ -5,16 +5,17 @@ repos:
       - id: check-yaml
       - id: end-of-file-fixer
       - id: trailing-whitespace
-  - repo: https://github.com/pycqa/isort
-    rev: 5.12.0
+
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    # Ruff version.
+    rev: v0.14.6
     hooks:
-      - id: isort
-        args: [ "--profile", "black" ]
-        name: isort (python)
-  - repo: https://github.com/psf/black
-    rev: 23.3.0
-    hooks:
-      - id: black
+      # Run the linter.
+      - id: ruff
+        args: [--fix]
+      # Run the formatter.
+      - id: ruff-format
+
   - repo: https://github.com/Lucas-C/pre-commit-hooks
     rev: v1.4.2
     hooks:
@@ -32,9 +33,3 @@ repos:
         language: system
         types: [python]
         pass_filenames: false
-# Deactivating this for now.
-#  - repo: https://github.com/pycqa/pylint
-#    rev: v2.17.0
-#    hooks:
-#      - id: pylint
-#        language_version: python3.10