Surface SDK auth warnings for revoked/deleted API keys #31
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: FR PR Tests | |
| on: | |
| pull_request: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: fr-pr-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| secret-scan: | |
| name: Secret Policy Check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out code | |
| uses: actions/checkout@v4 | |
| - name: Fail on hardcoded secrets or credentials | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| # LLM providers: OpenAI, OpenRouter, Anthropic, Groq, Google AI, FortifyRoot | |
| # Cloud: AWS access key IDs, GCP service account JSON, GitHub PATs | |
| key_patterns='(sk-(proj-)?[A-Za-z0-9_-]{20,}|sk-or-v1-[A-Za-z0-9]{20,}|sk-ant-[A-Za-z0-9_-]{20,}|gsk_[A-Za-z0-9_-]{20,}|AIzaSy[A-Za-z0-9_-]{33}|AKIA[A-Z0-9]{16}|fr_sk_[A-Za-z0-9_-]{30,}|ghp_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{22,})' | |
| json_patterns='("type"[[:space:]]*:[[:space:]]*"service_account")' | |
| regex="(${key_patterns}|${json_patterns})" | |
| if git grep -nI -E "$regex" -- . \ | |
| ':(exclude)*.lock' \ | |
| ':(exclude)*.env.example' \ | |
| ':(exclude)*.env.*.example' \ | |
| ':(exclude).github/workflows/*' \ | |
| ':(exclude)packages/opentelemetry-instrumentation-anthropic/tests/cassettes/test_bedrock_with_raw_response/*'; then | |
| echo "::error::Potential hardcoded secret or credential detected. Remove it and use placeholders or GitHub Secrets." | |
| exit 1 | |
| fi | |
| echo "No hardcoded secrets or credentials detected." | |
| fr-tests: | |
| needs: secret-scan | |
| name: FR Tests (py${{ matrix.python-version }}) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 45 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: ["3.10", "3.11", "3.12", "3.13"] | |
| steps: | |
| - name: Check out code | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v6 | |
| - name: Run FR-marked test suite | |
| env: | |
| HAYSTACK_TELEMETRY_ENABLED: "False" | |
| run: bash ./scripts/run-tests.sh --fr | |
| - name: Upload FR test reports | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: fr-test-reports-py${{ matrix.python-version }} | |
| path: reports/test-run/ | |
| if-no-files-found: ignore | |
| non-fr-tests: | |
| needs: secret-scan | |
| name: Non-FR Tests (py${{ matrix.python-version }}) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 60 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: ["3.10", "3.11", "3.12", "3.13"] | |
| steps: | |
| - name: Check out code | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v6 | |
| - name: Run non-FR test suite (upstream UT + VCR) | |
| env: | |
| HAYSTACK_TELEMETRY_ENABLED: "False" | |
| run: bash ./scripts/run-tests.sh -- -m "not fr" | |
| - name: Upload test reports | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: non-fr-test-reports-py${{ matrix.python-version }} | |
| path: reports/test-run/ | |
| if-no-files-found: ignore |