Merge branch 'main' into users/johanb/CodeReviewSkill

Author: nikhilNava

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,87 @@
+name: Bug report
+description: Something is not working correctly.
+labels: "S: needs triage, type: bug"
+
+body:
+  - type: markdown
+    attributes:
+      value: >-
+        Hi there!
+
+        We'd appreciate it if you could search on existing issues prior to filing
+        a bug report.
+
+        We get a lot of duplicate tickets and have limited maintainer capacity to triage
+        them. Thanks!
+
+  - type: textarea
+    attributes:
+      label: Description
+      description: >-
+        A clear and concise description of what the bug is.
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: Expected behavior
+      description: >-
+        A clear and concise description of what you expected to happen.
+
+  - type: input
+    attributes:
+      label: SDK Version
+      description: e.g., 1.0.0
+    validations:
+      required: true
+
+  - type: input
+    attributes:
+      label: Python Version
+      description: e.g., Python 3.10, Python 3.11, Python 3.12
+    validations:
+      required: true
+
+  - type: input
+    attributes:
+      label: OS
+      description: e.g., Windows 11, macOS 14, Ubuntu 22.04
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: How to Reproduce
+      description: Please provide steps to reproduce this bug.
+      placeholder: |
+        1. Go to '...'
+        2. Run '...'
+        3. An error occurs.
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: Output
+      description: >-
+        Provide the output of the steps above, including the commands
+        themselves and any error messages/traceback.
+
+        If you want to present output from multiple commands, please prefix
+        the line containing the command with $ . Please also ensure that
+        the "How to reproduce" section contains matching instructions for
+        reproducing this.
+
+  - type: textarea
+    attributes:
+      label: Screenshots
+      description: >-
+        If applicable, add screenshots to help explain your problem.
+
+  - type: checkboxes
+    attributes:
+      label: Code of Conduct
+      options:
+        - label: >-
+            I agree to follow the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
+          required: true

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,66 @@
+name: Feature request
+description: Suggest an idea for this project.
+labels: "S: needs triage, type: feature"
+
+body:
+  - type: markdown
+    attributes:
+      value: >-
+        Hi there!
+
+        Thanks for taking the time to suggest a new feature! Please search existing
+        issues first to make sure this hasn't already been requested.
+
+  - type: textarea
+    attributes:
+      label: Is your feature request related to a problem?
+      description: >-
+        A clear and concise description of what the problem is.
+      placeholder: "Ex. When I try X [...]"
+    validations:
+      required: true
+
+  - type: dropdown
+    attributes:
+      label: Priority
+      description: What priority would you assign to this feature?
+      options:
+        - High
+        - Medium
+        - Low
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: Describe the solution you'd like
+      description: >-
+        A clear and concise description of what you want to happen.
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: Describe alternatives you've considered
+      description: >-
+        A clear and concise description of any alternative solutions or features you've considered.
+
+  - type: textarea
+    attributes:
+      label: Available workarounds
+      description: >-
+        Are there any available workarounds in case this feature does not get picked up?
+
+  - type: textarea
+    attributes:
+      label: Additional context
+      description: >-
+        Add any other context or screenshots about the feature request here.
+
+  - type: checkboxes
+    attributes:
+      label: Code of Conduct
+      options:
+        - label: >-
+            I agree to follow the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
+          required: true

.github/ISSUE_TEMPLATE/feature_request.md

@@ -105,7 +105,10 @@ jobs:
 
     - name: Install the project
       run: uv lock && uv sync --locked --all-extras --dev
-    
+
+    - name: Verify centralized version constraints
+      run: python scripts/verify_constraints.py
+
     - name: Check linting
       run: |
         uv run --frozen ruff check . --preview

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,24 @@
+# Dependency Review - blocks PRs that introduce known-vulnerable dependencies
+name: Dependency Review
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Dependency Review
+        uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: high
+          comment-summary-in-pr: always
+          deny-licenses: GPL-3.0-only, AGPL-3.0-only

.github/workflows/ci.yml

@@ -0,0 +1,35 @@
+# Pre-commit hooks for Agent365-python
+# Install: pip install pre-commit && pre-commit install
+# Run manually: pre-commit run --all-files
+
+repos:
+  # Gitleaks - detect secrets in code
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.18.4
+    hooks:
+      - id: gitleaks
+
+  # Whitespace fixes
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.6.0
+    hooks:
+      - id: trailing-whitespace
+        args: [--markdown-linebreak-ext=md]
+      - id: end-of-file-fixer
+      - id: mixed-line-ending
+        args: [--fix=lf]
+      - id: check-merge-conflict
+      - id: check-yaml
+        args: [--allow-multiple-documents]
+      - id: check-json
+      - id: check-toml
+      - id: check-ast
+
+  # Python specific - using Ruff (matches CI settings)
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.4.4
+    hooks:
+      - id: ruff
+        args: [--fix, --line-length=100]
+      - id: ruff-format
+        args: [--line-length=100]

.github/workflows/dependency-review.yml

@@ -136,6 +136,34 @@ libraries/
    - MCP (Model Context Protocol) integration
    - Framework-specific adapters for tool execution
 
+### Centralized Dependency Version Management
+
+This monorepo uses uv's `constraint-dependencies` feature to centralize version constraints:
+
+**How it works:**
+1. **Root pyproject.toml** defines version constraints for all external packages
+2. **Package pyproject.toml** files declare dependencies by name only (no version)
+3. **uv** applies root constraints during dependency resolution
+
+**Adding a new dependency:**
+1. Add the package name to your package's `dependencies` array
+2. Add the version constraint to root `pyproject.toml` `constraint-dependencies`
+3. Run `uv lock && uv sync`
+
+**Updating a dependency version:**
+1. Edit the constraint in root `pyproject.toml` only
+2. Run `uv lock && uv sync`
+3. All packages automatically use the new version
+
+**Internal workspace dependencies:**
+- Package pyproject.toml files list internal deps by name only (e.g., `microsoft-agents-a365-runtime`)
+- Root pyproject.toml `[tool.uv.sources]` maps them to `{ workspace = true }` for local development
+- At build time, `setup.py` injects exact version matches (e.g., `== 1.2.3`) for published packages
+- This ensures all SDK packages require the exact same version of each other
+
+**CI Enforcement:** The `scripts/verify_constraints.py` script runs in CI to prevent
+accidental reintroduction of version constraints in package files.
+
 ### Test Organization
 
 Tests mirror the library structure:

.pre-commit-config.yaml

@@ -2,7 +2,8 @@
 
 [![PyPI](https://img.shields.io/pypi/v/microsoft-agents-a365-observability-core?label=PyPI&logo=pypi)](https://pypi.org/search/?q=microsoft-agents-a365)
 [![PyPI Downloads](https://img.shields.io/pypi/dm/microsoft-agents-a365-observability-core?label=Downloads&logo=pypi)](https://pypi.org/search/?q=microsoft-agents-a365)
-[![Build Status](https://img.shields.io/github/actions/workflow/status/microsoft/Agent365-python/.github/workflows/ci.yml?branch=main&label=Build&logo=github)](https://github.com/microsoft/Agent365-python/actions)
+[![CI - Build, Test, and Publish SDKs](https://github.com/microsoft/Agent365-python/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/microsoft/Agent365-python/actions/workflows/ci.yml)
+[![CodeQL](https://github.com/microsoft/Agent365-python/actions/workflows/github-code-scanning/codeql/badge.svg?branch=main)](https://github.com/microsoft/Agent365-python/actions/workflows/github-code-scanning/codeql)
 [![License](https://img.shields.io/github/license/microsoft/Agent365-python?label=License)](LICENSE.md)
 [![Python Version](https://img.shields.io/badge/Python-3.10%2B-3776AB?logo=python)](https://www.python.org/)
 [![Contributors](https://img.shields.io/github/contributors/microsoft/Agent365-python?label=Contributors&logo=github)](https://github.com/microsoft/Agent365-python/graphs/contributors)