python-windows.yml

name: Python Windows

on:
  push:
    branches: [main]
  pull_request:

# Superseded PR commits need no runner time; main pushes keep distinct groups.
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

jobs:
  python-suites:
    # Recent full runs spend 21-23 minutes in per-file pytest processes.
    # Three round-robin partitions take roughly 7-8 minutes each before setup.
    # Separate runners retain filesystem/process isolation between partitions.
    runs-on: windows-2025
    timeout-minutes: 40
    strategy:
      fail-fast: false
      matrix:
        shard: [0, 1, 2]
    env:
      AMADEUS_E2E_NO_TTS: "1"
      TTS_DEVICE: "cpu"
      WORK_WORKTREE_ISOLATION: "0"

    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v7
        with:
          python-version: "3.12.10"
      - name: Install pinned uv
        run: python -m pip install uv==0.12.8
      # Some Python suites execute the repository's JavaScript contracts.
      - uses: actions/setup-node@v7
        with:
          node-version: "22.21.1"
      - name: Install pinned Pi runtime for native integration tests
        working-directory: agent_host/pi_runtime
        run: npm ci --ignore-scripts
      - name: Install locked environment (T1 + dev tooling)
        shell: bash
        run: uv sync --locked --extra dev
      - name: Verify environment
        run: uv run --locked --no-sync python tools/verify_python_environment.py --profile ci
      - name: Run Python suites
        run: >-
          uv run --locked --no-sync python -X utf8 tools/run_tests.py
          --shard-count 3 --shard-index ${{ matrix.shard }}

  checks-and-smoke:
    runs-on: windows-2025
    timeout-minutes: 40
    env:
      AMADEUS_E2E_NO_TTS: "1"
      TTS_DEVICE: "cpu"
      WORK_WORKTREE_ISOLATION: "0"

    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-python@v7
        with:
          python-version: "3.12.10"

      - name: Install pinned uv
        run: python -m pip install uv==0.12.8

      - uses: actions/setup-node@v7
        with:
          node-version: "22.21.1"
          cache: npm
          cache-dependency-path: electron/package-lock.json

      - name: Install locked environment (T1 + dev tooling)
        shell: bash
        run: uv sync --locked --extra dev

      - name: Verify environment
        run: uv run --locked --no-sync python tools/verify_python_environment.py --profile ci

      - name: Check the minimal extension authoring environment
        shell: bash
        run: |
          uv export --locked --only-group extension-authoring --no-emit-project --no-header --output-file tools/requirements-extension-authoring.txt
          git diff --exit-code -- tools/requirements-extension-authoring.txt
          python -m venv build/extension-authoring-env
          build/extension-authoring-env/Scripts/python.exe -m pip install --require-hashes -r tools/requirements-extension-authoring.txt
          build/extension-authoring-env/Scripts/python.exe -I tools/extension_package.py profile --format text
          for package in examples/extensions/*/src/*/amadeus-extension.json; do
            build/extension-authoring-env/Scripts/python.exe -I tools/extension_package.py check-package "$(dirname "$package")" --format text
          done
          # Build only the repository reference packages using the locked Host build tools.
          # The minimal checker environment itself remains free of build/runtime dependencies.
          for project in examples/extensions/*/pyproject.toml; do
            uv build --wheel --offline --no-build-isolation --python .venv/Scripts/python.exe --out-dir build/extension-examples "$(dirname "$project")"
          done
          for wheel in build/extension-examples/*.whl; do
            build/extension-authoring-env/Scripts/python.exe -I tools/extension_package.py check-wheel "$wheel" --format text
          done

      - name: Check source and architecture views
        # bash (not pwsh): Actions runs bash with -e, so a ruff failure must
        # fail the step instead of being masked by the next command's exit 0.
        shell: bash
        run: |
          uv run --locked --no-sync python -m ruff check .
          uv run --locked --no-sync python tools/architecture/generate_views.py --check
          uv run --locked --no-sync python tools/architecture/generate_readme_overview.py --check

      - name: Audit Python dependencies
        # Accepted until the already-green suite is qualified on pytest 9.
        run: >-
          uv run --locked --no-sync python -m pip_audit --local --progress-spinner off
          --ignore-vuln PYSEC-2026-1845

      - name: Build Electron model-less smoke target
        working-directory: electron
        shell: bash
        run: |
          npm ci
          npm run build

      - name: Run offline extension author journeys
        run: >-
          uv run --locked --no-sync python -X utf8 tools/probes/extension_author_journey.py

      - name: Run plugin store UI journey with real reference wheels
        shell: pwsh
        run: |
          $authorRun = Get-ChildItem -LiteralPath build/extension-author-journey -Directory | Sort-Object LastWriteTime -Descending | Select-Object -First 1
          if (!$authorRun) { throw 'Author journey wheel directory is missing' }
          $wheelDirectory = Join-Path $authorRun.FullName 'wheels'
          uv run --locked --no-sync python -X utf8 tools/probes/extension_catalog_journey.py --execute --store-ui --wheels $wheelDirectory
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

      - name: Prepare shipping-shell extension fixture
        shell: pwsh
        run: |
          $authorRun = Get-ChildItem -LiteralPath build/extension-author-journey -Directory | Sort-Object LastWriteTime -Descending | Select-Object -First 1
          if (!$authorRun) { throw 'Author journey wheel directory is missing' }
          $prepared = uv run --locked --no-sync python -X utf8 tools/probes/extension_catalog_journey.py --execute --store-ui --prepare-only --failure-fixture --wheels (Join-Path $authorRun.FullName 'wheels')
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          $fixture = ($prepared | ConvertFrom-Json).fixture
          if (!$fixture) { throw 'Release fixture was not prepared' }
          Add-Content -LiteralPath $env:GITHUB_ENV -Value "EXTENSION_RELEASE_FIXTURE=$fixture"

      - name: Run Electron model-less smoke
        run: >-
          uv run --locked --no-sync python -X utf8 tools\smoke_electron_model_less.py
          --report-dir build\electron-smoke
          --extension-fixture "${{ env.EXTENSION_RELEASE_FIXTURE }}" --extension-failures

      - name: Build actual Windows executable
        working-directory: electron
        env:
          CSC_IDENTITY_AUTO_DISCOVERY: 'false'
        run: npx electron-builder --config electron-builder-code-only.cjs --win --x64 --dir --publish never

      - name: Launch packaged frontend with supplied Python runtime
        run: >-
          uv run --locked --no-sync python -X utf8 tools\smoke_electron_model_less.py
          --packaged-executable electron\build\win-unpacked\amadeus-desktop.exe
          --report-dir build\electron-packaged-smoke
          --extension-fixture "${{ env.EXTENSION_RELEASE_FIXTURE }}" --extension-failures

      - uses: actions/checkout@v7
        with:
          repository: Code-Amadeus/Amadeus-Extensions
          ref: e2fc0e93fa7cfd9bf98e378cac6e158f14181b9a
          path: build/catalog-demo-protocol
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/checkout@v7
        with:
          ref: 1840c8e4f646992ddaebea3139c8895f29743a8f
          path: build/catalog-demo-host
          fetch-depth: 0
          persist-credentials: false
      - name: Qualify packaged catalog publication and recovery roundtrip
        shell: pwsh
        run: |
          python -m venv build/catalog-demo-checker
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          build/catalog-demo-checker/Scripts/python.exe -m pip install --require-hashes -r build/catalog-demo-host/tools/requirements-extension-authoring.txt
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          $authorRun = Get-ChildItem -LiteralPath build/extension-author-journey -Directory | Sort-Object LastWriteTime -Descending | Select-Object -First 1
          if (!$authorRun) { throw 'Author journey wheels missing' }
          uv run --locked --no-sync python -X utf8 tools/probes/extension_store_demo.py --execute --protocol-repo build/catalog-demo-protocol --checker-host build/catalog-demo-host --checker-python build/catalog-demo-checker/Scripts/python.exe --wheels (Join-Path $authorRun.FullName 'wheels') --packaged-executable electron/build/win-unpacked/amadeus-desktop.exe --report-dir build/catalog-publication-smoke
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

      - name: Upload Electron smoke diagnostics
        if: failure()
        uses: actions/upload-artifact@v6
        with:
          name: electron-model-less-smoke-${{ github.run_id }}
          path: |
            build/extension-author-journey/**/report.json
            build/extension-author-journey/**/*-report.json
            build/extension-author-journey/**/*.log
            build/extension-catalog-journey/**/report.json
            build/extension-catalog-journey/**/*-runtime.json
            build/extension-catalog-journey/**/*.png
            build/extension-catalog-journey/**/*.log
            build/electron-smoke/**
            build/electron-packaged-smoke/**
            build/catalog-publication-smoke/**/report.json
            build/catalog-publication-smoke/**/*-report.json
            build/catalog-publication-smoke/**/publication.json
            build/catalog-publication-smoke/**/result.json
            build/catalog-publication-smoke/**/*.png
          if-no-files-found: ignore

  # Preserve the branch-protection check name. A failed, cancelled or skipped
  # prerequisite must fail this gate, rather than leave a skipped required job.
  cpu-model-less:
    needs: [python-suites, checks-and-smoke]
    if: ${{ always() }}
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    steps:
      - name: Require all suites and smoke checks
        env:
          SUITES_RESULT: ${{ needs.python-suites.result }}
          SMOKE_RESULT: ${{ needs.checks-and-smoke.result }}
        run: test "$SUITES_RESULT" = success && test "$SMOKE_RESULT" = success

  # Windows clean-install proof of the single-.venv T1 → T4 ladder: the same
  # .venv is upgraded in place, torch flips to the +cu124 build, and no second
  # venv (e.g. .venv_cu124) is ever created.
  single-venv-ladder:
    runs-on: windows-2025
    timeout-minutes: 40
    env:
      AMADEUS_E2E_NO_TTS: "1"
      TTS_DEVICE: "cpu"
      WORK_WORKTREE_ISOLATION: "0"

    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-python@v7
        with:
          python-version: "3.12.10"

      - name: Install pinned uv
        run: python -m pip install uv==0.12.8

      - name: T1 core
        shell: bash
        run: |
          uv sync --locked
          uv run --locked --no-sync python tools/verify_python_environment.py --profile cpu
          uv run --locked --no-sync python -c "import importlib.util as u; assert all(u.find_spec(n) is None for n in ('torch', 'torchaudio', 'pyaudio', 'silero_vad', 'onnxruntime'))"
      - name: T2 voice
        shell: bash
        run: |
          uv sync --locked --extra voice --extra dev
          uv run --locked --no-sync python tools/verify_python_environment.py --profile voice
          uv run --locked --no-sync python -c "import importlib.util as u; assert u.find_spec('torch') is None"
          uv run --locked --no-sync python -m pytest -q tests/test_mic_descriptor.py tests/test_playback_device_recovery.py tests/test_tts_contract.py tests/test_tts_fish_audio_backend.py tests/test_tts_cache_backend_boundary.py tests/test_aec_native_smoke.py
      - name: T3 vad
        shell: bash
        run: |
          uv sync --locked --extra voice --extra vad --extra torch-cpu
          uv run --locked --no-sync python tools/verify_python_environment.py --profile vad-cpu
      - name: T4 embedded
        run: uv sync --locked --extra voice --extra vad --extra local-cu124 --extra dev

      - name: Assert single venv and cu124 torch
        shell: bash
        run: |
          test ! -d .venv_cu124 && test ! -d .venv_pt251 || { echo "second venv created"; exit 1; }
          uv run --locked --no-sync python -c "import torch; assert torch.__version__.endswith('+cu124'), torch.__version__; print('torch', torch.__version__)"
          # cu124 wheel presence (build target), not a CUDA device: hosted runners have no GPU.
          uv run --locked --no-sync python tools/verify_python_environment.py --profile cu124

      - name: Verify local-model offline boundary with qualified libraries
        run: >-
          uv run --locked --no-sync python -m unittest discover
          -s tests -p test_local_model_loading.py -v

      - name: Exercise dependency-gated model contracts on the cu124 baseline
        env:
          AMADEUS_E2E_NO_TTS: "0"
        run: >-
          uv run --locked --no-sync python -m pytest -q -rs
          tests/test_gpt_sovits_checkpoint_loading.py
          tests/test_local_tts_device_context.py
          tests/test_local_tts_semantic_guard.py
          tests/test_local_tts_reference_cache.py
          tests/test_t2s_cuda_graph_sync_policy.py
          tests/test_t2s_static_kv_mask.py
          tests/test_t2s_nested_kv.py

      - name: Return to T3 vad and T1 core
        shell: bash
        run: |
          uv sync --locked --extra voice --extra vad --extra torch-cpu
          uv run --locked --no-sync python tools/verify_python_environment.py --profile vad-cpu
          uv sync --locked
          uv run --locked --no-sync python tools/verify_python_environment.py --profile cpu
          uv run --locked --no-sync python -c "import importlib.util as u; assert all(u.find_spec(n) is None for n in ('torch', 'torchaudio', 'pyaudio', 'silero_vad', 'onnxruntime', 'qwen_asr'))"

      - name: Upload wheelhouse diagnostics
        if: failure()
        uses: actions/upload-artifact@v6
        with:
          name: ladder-${{ github.run_id }}
          path: |
            uv.lock
          if-no-files-found: ignore