trace-adapters-tests.yml

name: trace-adapters tests

on:
  pull_request:
    paths:
      - "packages/agentrust-trace-adapters/**"
      - "integrations/decisionassure/**"
      - "integrations/otel-genai/**"
      - "integrations/langchain/**"
      - "integrations/llamaindex/**"
      - "integrations/google-adk/**"
      - "integrations/openshell/**"
      - "integrations/openai-agents/**"
      - ".github/workflows/trace-adapters-tests.yml"
  push:
    branches: [main]
    paths:
      - "packages/agentrust-trace-adapters/**"
      - "integrations/decisionassure/**"
      - "integrations/otel-genai/**"
      - "integrations/langchain/**"
      - "integrations/llamaindex/**"
      - "integrations/google-adk/**"
      - "integrations/openshell/**"
      - "integrations/openai-agents/**"
      - ".github/workflows/trace-adapters-tests.yml"

permissions:
  contents: read

jobs:
  unit:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ["3.11", "3.12", "3.13"]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ matrix.python-version }}
      - name: Test against the released TRACE model
        working-directory: packages/agentrust-trace-adapters
        run: |
          pip install --require-hashes -r ../../requirements/adapters.txt
          pip install --no-deps .
          python -m pytest tests -q

  # The job that would have caught the defect this package was written to prevent.
  # The adapter it replaces emitted records failing TrustRecord validation on seven
  # counts, and nothing here validated its output.
  adapter-output-validates:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"
      - name: Build a record with the DecisionAssure adapter and validate it
        run: |
          # The local package goes in with --no-deps; its dependency comes
          # from the lock, so nothing here resolves against PyPI.
          pip install --require-hashes -r requirements/adapters.txt
          pip install --no-deps ./packages/agentrust-trace-adapters
          python - <<'PY'
          import importlib.util, json
          from agentrust_trace.models import TrustRecord

          spec = importlib.util.spec_from_file_location(
              "da", "integrations/decisionassure/da_to_trace.py"
          )
          da = importlib.util.module_from_spec(spec)
          spec.loader.exec_module(da)

          record = da.map_trace(
              {"trace_id": "t-1", "final_decision": "ALLOW",
               "steps": [{"tool": "pay"}], "data_class": "pii"},
              subject="spiffe://example.org/agent/da-1",
              policy_bundle=b'{"rules":["deny-egress"]}',
              workload_digest="sha256:" + "c" * 64,
              jwk={"kty": "OKP", "crv": "Ed25519",
                   "x": "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo"},
              model_provider="anthropic", model_id="claude-sonnet-4-6",
          )
          parsed = TrustRecord.model_validate(record)

          # The three signals the downgrade rests on. A refactor that made any of
          # them settable would pass the schema and lose the argument.
          assert parsed.runtime.platform == "software-only", parsed.runtime.platform
          assert parsed.appraisal.status == "none", parsed.appraisal.status
          assert parsed.origin and parsed.origin.kind == "third-party-control-plane"
          assert "transparency" not in record, "unanchored records omit transparency"
          print(json.dumps(record, indent=2))
          PY

  otel-genai-adapter:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"
      - name: Test the OTel GenAI adapter
        run: |
          # The local package goes in with --no-deps; its dependency comes
          # from the lock, so nothing here resolves against PyPI.
          pip install --require-hashes -r requirements/adapters.txt
          pip install --no-deps ./packages/agentrust-trace-adapters
          python -m pytest integrations/otel-genai/test_otel_to_trace.py -q

      # Pydantic AI needs no adapter of its own: it instruments through
      # OpenTelemetry and emits the GenAI conventions this adapter already maps.
      # Verified against the released package rather than asserted (issue #96).
      - name: Test released Pydantic AI coverage
        run: |
          pip install --require-hashes -r requirements/sdk-pydantic-ai.txt
          python -m pytest integrations/otel-genai/test_pydantic_ai_interop.py -q

  openshell-adapter:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"
      - name: Test OpenShell evidence mapping against released TRACE
        run: |
          # The local package goes in with --no-deps; its dependency comes
          # from the lock, so nothing here resolves against PyPI.
          pip install --require-hashes -r requirements/adapters.txt
          pip install --no-deps ./packages/agentrust-trace-adapters
          python -m pytest packages/agentrust-trace-adapters/tests/test_openshell.py integrations/openshell/test_demo.py -q
          python integrations/openshell/demo/build_signed_record.py --output /tmp/signed-record.json

  langchain-adapter:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"
      - name: Test evidence rules without framework extras
        run: |
          # Keep the record builder and honesty rules usable without installing
          # an agent framework. Framework interoperability is a separate gate.
          pip install --require-hashes -r requirements/adapters-no-framework.txt
          python -m pytest \
            integrations/langchain/test_langchain_to_trace.py \
            integrations/llamaindex/test_llamaindex_to_trace.py \
            -q
      - name: Test released LangChain and LangGraph interoperability
        run: |
          pip install --require-hashes -r requirements/sdk-langchain.txt
          python -m pytest integrations/langchain/test_langgraph_interop.py -q

  llamaindex-workflow-adapter:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"
      - name: Test released FunctionAgent workflow observation
        run: |
          pip install -r integrations/llamaindex/requirements-interop.txt
          python -m pytest integrations/llamaindex -q

  openai-agents-adapter:
    # Two passes, on purpose. The first proves record construction and the
    # honesty rules work without the SDK installed; the second runs a real
    # released agent, which is what catches a renamed span field before it
    # silently empties a transcript.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"
      - name: Test the record rules without the SDK
        run: |
          pip install --require-hashes -r requirements/adapters-trace-090.txt
          python -m pytest integrations/openai-agents/test_openai_agents_to_trace.py -q
      - name: Test released OpenAI Agents SDK interoperability
        run: |
          pip install --require-hashes -r requirements/sdk-openai-agents.txt
          python -m pytest integrations/openai-agents -q

  google-adk-adapter:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"
      - name: Test evidence rules without Google ADK
        run: |
          pip install --require-hashes -r requirements/adapters-trace-090.txt
          python -m pytest integrations/google-adk/test_google_adk_to_trace.py -q
      - name: Test released Google ADK interoperability and evidence rules
        run: |
          pip install --require-hashes -r requirements/sdk-google-adk.txt
          python -m pytest \
            integrations/google-adk/test_google_adk_to_trace.py \
            integrations/google-adk/test_google_adk_interop.py \
            -q