mirror of
https://github.com/hwchase17/langchain.git
synced 2026-07-01 14:47:02 +00:00
51578289bb
Adds a manual release workflow input, `skip-prior-published-package-checks`, for core releases. The workflow dispatch dropdown supports: - `none` - `anthropic` - `openai` - `all` When a partner is selected, that matrix entry records an explicit skipped step and does not run the prior-published package test. The default remains `none`, so existing release behavior is unchanged unless the release operator opts into a skip. AI-agent assistance was used to prepare this workflow update.
915 lines
38 KiB
YAML
915 lines
38 KiB
YAML
# Builds and publishes LangChain packages to PyPI.
|
|
#
|
|
# Manually triggered, though can be used as a reusable workflow (workflow_call).
|
|
#
|
|
# Handles version bumping, building, and publishing to PyPI with authentication.
|
|
|
|
name: "🚀 Package Release"
|
|
# Run title resolves dropdown values to the published package name (e.g.
|
|
# `core` -> `langchain-core`, `openai` -> `langchain-openai`). Falls back to
|
|
# the raw input for override and `workflow_call` cases, which already pass
|
|
# a full path. Three dropdown values don't follow `langchain-{name}`:
|
|
# `langchain` -> `langchain-classic`, `langchain_v1` -> `langchain`,
|
|
# `standard-tests` -> `langchain-tests`.
|
|
run-name: >-
|
|
Release ${{ inputs.working-directory-override ||
|
|
(startsWith(inputs.working-directory, 'libs/') && inputs.working-directory) ||
|
|
(inputs.working-directory == 'langchain' && 'langchain-classic') ||
|
|
(inputs.working-directory == 'langchain_v1' && 'langchain') ||
|
|
(inputs.working-directory == 'standard-tests' && 'langchain-tests') ||
|
|
format('langchain-{0}', inputs.working-directory) }} ${{
|
|
inputs.release-version }}
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
working-directory:
|
|
required: true
|
|
type: string
|
|
description: "From which folder this pipeline executes"
|
|
release-version:
|
|
required: false
|
|
type: string
|
|
default: ""
|
|
description: "Expected package version. If provided, must match pyproject.toml."
|
|
allow-prereleases:
|
|
required: false
|
|
type: boolean
|
|
default: false
|
|
description: "Pass `--prerelease=allow` to wheel-install steps so
|
|
transitive prerelease deps (e.g. langgraph-checkpoint>=4.1.0a3 pulled
|
|
in by an alpha langgraph) resolve. Use only when the release itself
|
|
is a prerelease and at least one dep is also a prerelease."
|
|
# `workflow_call` callers must pass an exact lowercase value: `none` or a
|
|
# partner name from the `test-prior-published-packages-against-new-core`
|
|
# matrix (or `all`). Unrecognized values fail safe (the check still runs).
|
|
# Keep this list in sync with that matrix and the `workflow_dispatch`
|
|
# `options` below.
|
|
skip-prior-published-package-checks:
|
|
required: false
|
|
type: string
|
|
default: "none"
|
|
description: "Prior published partner check to skip for core releases:
|
|
none, anthropic, openai, or all."
|
|
workflow_dispatch:
|
|
inputs:
|
|
working-directory:
|
|
required: true
|
|
type: choice
|
|
description: "From which folder this pipeline executes"
|
|
default: "langchain_v1"
|
|
# Short names only — `EFFECTIVE_WORKING_DIR` below re-adds the `libs/`
|
|
# or `libs/partners/` prefix. When adding a new option, also update the
|
|
# non-partner allowlist in `EFFECTIVE_WORKING_DIR` if it isn't a partner
|
|
# package (partners are the default branch).
|
|
options:
|
|
- core
|
|
- langchain
|
|
- langchain_v1
|
|
- text-splitters
|
|
- standard-tests
|
|
- model-profiles
|
|
- anthropic
|
|
- chroma
|
|
- deepseek
|
|
- exa
|
|
- fireworks
|
|
- groq
|
|
- huggingface
|
|
- mistralai
|
|
- nomic
|
|
- ollama
|
|
- openai
|
|
- openrouter
|
|
- perplexity
|
|
- qdrant
|
|
- xai
|
|
working-directory-override:
|
|
required: false
|
|
type: string
|
|
description: "Manual override — takes precedence over dropdown (e.g.
|
|
libs/partners/partner-xyz)"
|
|
release-version:
|
|
required: true
|
|
type: string
|
|
default: "0.1.0"
|
|
description: "New version of package being released"
|
|
dangerous-nonmaster-release:
|
|
required: false
|
|
type: boolean
|
|
default: false
|
|
description: "Release from a non-master branch (danger!) - Only use for hotfixes"
|
|
allow-prereleases:
|
|
required: false
|
|
type: boolean
|
|
default: false
|
|
description: "Pass `--prerelease=allow` to wheel-install steps so
|
|
transitive prerelease deps (e.g. langgraph-checkpoint>=4.1.0a3 pulled
|
|
in by an alpha langgraph) resolve. Use only when the release itself
|
|
is a prerelease and at least one dep is also a prerelease."
|
|
skip-prior-published-package-checks:
|
|
required: false
|
|
type: choice
|
|
default: none
|
|
description: "Prior published partner check to skip for core releases"
|
|
options:
|
|
- none
|
|
- anthropic
|
|
- openai
|
|
- all
|
|
|
|
env:
|
|
PYTHON_VERSION: "3.11"
|
|
UV_FROZEN: "true"
|
|
UV_NO_SYNC: "true"
|
|
# Resolves to a full path. Accepts either:
|
|
# - `working-directory-override` as a full path (e.g. `libs/partners/partner-xyz`)
|
|
# - `working-directory` as a full path (from `workflow_call` callers)
|
|
# - `working-directory` as a short dropdown name (from `workflow_dispatch`)
|
|
EFFECTIVE_WORKING_DIR: >-
|
|
${{
|
|
inputs.working-directory-override
|
|
|| (startsWith(inputs.working-directory, 'libs/') && inputs.working-directory)
|
|
|| (contains(fromJSON('["core","langchain","langchain_v1","text-splitters","standard-tests","model-profiles"]'), inputs.working-directory) && format('libs/{0}', inputs.working-directory))
|
|
|| format('libs/partners/{0}', inputs.working-directory)
|
|
}}
|
|
|
|
permissions:
|
|
contents: read # Job-level overrides grant write only where needed (mark-release)
|
|
|
|
jobs:
|
|
# Build the distribution package and extract version info
|
|
# Runs in isolated environment with minimal permissions for security
|
|
build:
|
|
name: 📦 Build distribution
|
|
if: github.ref == 'refs/heads/master' || inputs.dangerous-nonmaster-release
|
|
environment: Release
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
|
|
outputs:
|
|
pkg-name: ${{ steps.check-version.outputs.pkg-name }}
|
|
version: ${{ steps.check-version.outputs.version }}
|
|
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
|
|
|
- name: Set up Python + uv
|
|
uses: "./.github/actions/uv_setup"
|
|
with:
|
|
python-version: ${{ env.PYTHON_VERSION }}
|
|
enable-cache: "false"
|
|
|
|
- name: Summarize release bypasses
|
|
if: >-
|
|
inputs.dangerous-nonmaster-release || inputs.allow-prereleases ||
|
|
inputs.skip-prior-published-package-checks != 'none'
|
|
env:
|
|
ALLOW_PRERELEASES: ${{ inputs.allow-prereleases }}
|
|
DANGEROUS_NONMASTER_RELEASE: ${{ inputs.dangerous-nonmaster-release }}
|
|
SKIP_PRIOR_PUBLISHED_PACKAGE_CHECKS: ${{ inputs.skip-prior-published-package-checks }}
|
|
run: |
|
|
echo "::warning::Release bypass input(s) enabled. See job summary."
|
|
{
|
|
echo "## ⚠️ Release bypasses enabled"
|
|
echo
|
|
echo "One or more release safety bypasses were selected for this run:"
|
|
echo
|
|
if [ "$DANGEROUS_NONMASTER_RELEASE" = "true" ]; then
|
|
echo "- \`dangerous-nonmaster-release\`: release jobs may run from a non-\`master\` ref."
|
|
fi
|
|
if [ "$ALLOW_PRERELEASES" = "true" ]; then
|
|
echo "- \`allow-prereleases\`: install checks use \`--prerelease=allow\`."
|
|
fi
|
|
if [ -n "$SKIP_PRIOR_PUBLISHED_PACKAGE_CHECKS" ] && [ "$SKIP_PRIOR_PUBLISHED_PACKAGE_CHECKS" != "none" ]; then
|
|
echo "- \`skip-prior-published-package-checks\`: \`$SKIP_PRIOR_PUBLISHED_PACKAGE_CHECKS\`."
|
|
fi
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
- name: Check version
|
|
id: check-version
|
|
shell: python
|
|
working-directory: ${{ env.EFFECTIVE_WORKING_DIR }}
|
|
env:
|
|
RELEASE_VERSION_INPUT: ${{ inputs.release-version }}
|
|
run: |
|
|
import os
|
|
import re
|
|
import sys
|
|
import tomllib
|
|
import urllib.error
|
|
import urllib.request
|
|
|
|
with open("pyproject.toml", "rb") as f:
|
|
data = tomllib.load(f)
|
|
|
|
pkg_name = data["project"]["name"]
|
|
version = data["project"]["version"]
|
|
requested_version = os.environ.get("RELEASE_VERSION_INPUT", "").strip()
|
|
|
|
|
|
def normalize(v):
|
|
# Lightweight PEP 440 comparison key: lowercase and drop the `-`,
|
|
# `_`, or `.` separators that precede a pre/post/dev segment so that
|
|
# e.g. `0.1.0-rc1` and `0.1.0rc1` compare equal. Full canonicalization
|
|
# lives in `packaging`, which isn't installed in this bare release step.
|
|
return re.sub(r"[-_.]+(?=[a-z])", "", v.lower())
|
|
|
|
|
|
if requested_version and normalize(requested_version) != normalize(version):
|
|
print(
|
|
f"::error::Requested release version {requested_version!r} does "
|
|
f"not match {pkg_name} pyproject.toml version {version!r}."
|
|
)
|
|
sys.exit(1)
|
|
|
|
# Query the per-version endpoint so PyPI applies PEP 440 normalization
|
|
# (e.g. `0.1.0-rc1` and `0.1.0rc1` resolve to the same release): HTTP 200
|
|
# means the version is already published, 404 means it's available
|
|
# (including the first-ever release of a new package). Only the status
|
|
# code is used, so a malicious or malformed response body can't mislead us.
|
|
url = f"https://pypi.org/pypi/{pkg_name}/{version}/json"
|
|
try:
|
|
with urllib.request.urlopen(url, timeout=10):
|
|
already_published = True
|
|
except urllib.error.HTTPError as err:
|
|
if err.code == 404:
|
|
already_published = False
|
|
else:
|
|
# Fail closed: an unexpected status means we can't verify.
|
|
print(
|
|
f"::error::PyPI returned HTTP {err.code} checking whether "
|
|
f"{pkg_name}=={version} exists; cannot verify, aborting."
|
|
)
|
|
sys.exit(1)
|
|
except urllib.error.URLError as err:
|
|
# Fail closed: if PyPI is unreachable we must not assume the version
|
|
# is free, or we risk re-publishing an existing release.
|
|
print(
|
|
f"::error::Could not reach PyPI to verify {pkg_name}=={version} "
|
|
f"({err.reason}); cannot verify, aborting."
|
|
)
|
|
sys.exit(1)
|
|
|
|
if already_published:
|
|
print(f"::error::{pkg_name}=={version} already exists on PyPI.")
|
|
sys.exit(1)
|
|
|
|
|
|
with open(os.environ["GITHUB_OUTPUT"], "a") as f:
|
|
f.write(f"pkg-name={pkg_name}\n")
|
|
f.write(f"version={version}\n")
|
|
|
|
# We want to keep this build stage *separate* from the release stage,
|
|
# so that there's no sharing of permissions between them.
|
|
# (Release stage has trusted publishing and GitHub repo contents write access,
|
|
# which the build stage must not have access to.)
|
|
#
|
|
# Otherwise, a malicious `build` step (e.g. via a compromised dependency)
|
|
# could get access to our GitHub or PyPI credentials.
|
|
#
|
|
# Per the trusted publishing GitHub Action:
|
|
# > It is strongly advised to separate jobs for building [...]
|
|
# > from the publish job.
|
|
# https://github.com/pypa/gh-action-pypi-publish#non-goals
|
|
- name: Build project for distribution
|
|
run: uv build
|
|
working-directory: ${{ env.EFFECTIVE_WORKING_DIR }}
|
|
|
|
- name: Upload build
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
|
with:
|
|
name: dist
|
|
path: ${{ env.EFFECTIVE_WORKING_DIR }}/dist/
|
|
release-notes:
|
|
name: 📝 Generate release notes
|
|
# release-notes must run before publishing because its check-tags step
|
|
# validates version/tag state — do not remove this dependency.
|
|
needs:
|
|
- build
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
outputs:
|
|
release-body: ${{ steps.generate-release-body.outputs.release-body }}
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
|
with:
|
|
repository: langchain-ai/langchain
|
|
path: langchain
|
|
sparse-checkout: | # this only grabs files for relevant dir
|
|
${{ env.EFFECTIVE_WORKING_DIR }}
|
|
ref: ${{ github.ref }} # this scopes to just ref'd branch
|
|
fetch-depth: 0 # this fetches entire commit history
|
|
- name: Check tags
|
|
id: check-tags
|
|
shell: bash
|
|
working-directory: langchain/${{ env.EFFECTIVE_WORKING_DIR }}
|
|
env:
|
|
PKG_NAME: ${{ needs.build.outputs.pkg-name }}
|
|
VERSION: ${{ needs.build.outputs.version }}
|
|
run: |
|
|
# Handle regular versions and pre-release versions differently
|
|
if [[ "$VERSION" == *"-"* ]]; then
|
|
# This is a pre-release version (contains a hyphen)
|
|
# Extract the base version without the pre-release suffix
|
|
BASE_VERSION=${VERSION%%-*}
|
|
# Look for the latest release of the same base version
|
|
REGEX="^$PKG_NAME==$BASE_VERSION\$"
|
|
PREV_TAG=$(git tag --sort=-creatordate | (grep -P "$REGEX" || true) | head -1)
|
|
|
|
# If no exact base version match, look for the latest release of any kind
|
|
if [ -z "$PREV_TAG" ]; then
|
|
REGEX="^$PKG_NAME==\\d+\\.\\d+\\.\\d+\$"
|
|
PREV_TAG=$(git tag --sort=-creatordate | (grep -P "$REGEX" || true) | head -1)
|
|
fi
|
|
else
|
|
# Regular version handling
|
|
PREV_TAG="$PKG_NAME==${VERSION%.*}.$(( ${VERSION##*.} - 1 ))"; [[ "${VERSION##*.}" -eq 0 ]] && PREV_TAG=""
|
|
|
|
# backup case if releasing e.g. 0.3.0, looks up last release
|
|
# note if last release (chronologically) was e.g. 0.1.47 it will get
|
|
# that instead of the last 0.2 release
|
|
if [ -z "$PREV_TAG" ]; then
|
|
REGEX="^$PKG_NAME==\\d+\\.\\d+\\.\\d+\$"
|
|
echo $REGEX
|
|
PREV_TAG=$(git tag --sort=-creatordate | (grep -P $REGEX || true) | head -1)
|
|
fi
|
|
fi
|
|
|
|
# if PREV_TAG is empty or came out to 0.0.0, let it be empty
|
|
if [ -z "$PREV_TAG" ] || [ "$PREV_TAG" = "$PKG_NAME==0.0.0" ]; then
|
|
echo "No previous tag found - first release"
|
|
else
|
|
# confirm prev-tag actually exists in git repo with git tag
|
|
GIT_TAG_RESULT=$(git tag -l "$PREV_TAG")
|
|
if [ -z "$GIT_TAG_RESULT" ]; then
|
|
echo "Previous tag $PREV_TAG not found in git repo"
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
|
|
TAG="${PKG_NAME}==${VERSION}"
|
|
if [ "$TAG" == "$PREV_TAG" ]; then
|
|
echo "No new version to release"
|
|
exit 1
|
|
fi
|
|
echo tag="$TAG" >> $GITHUB_OUTPUT
|
|
echo prev-tag="$PREV_TAG" >> $GITHUB_OUTPUT
|
|
- name: Generate release body
|
|
id: generate-release-body
|
|
working-directory: langchain
|
|
env:
|
|
WORKING_DIR: ${{ env.EFFECTIVE_WORKING_DIR }}
|
|
PKG_NAME: ${{ needs.build.outputs.pkg-name }}
|
|
TAG: ${{ steps.check-tags.outputs.tag }}
|
|
PREV_TAG: ${{ steps.check-tags.outputs.prev-tag }}
|
|
run: |
|
|
PREAMBLE="Changes since $PREV_TAG"
|
|
# if PREV_TAG is empty or 0.0.0, then we are releasing the first version
|
|
if [ -z "$PREV_TAG" ] || [ "$PREV_TAG" = "$PKG_NAME==0.0.0" ]; then
|
|
PREAMBLE="Initial release"
|
|
PREV_TAG=$(git rev-list --max-parents=0 HEAD)
|
|
fi
|
|
{
|
|
echo 'release-body<<EOF'
|
|
echo $PREAMBLE
|
|
echo
|
|
git log --format="%s" "$PREV_TAG"..HEAD -- $WORKING_DIR
|
|
echo EOF
|
|
} >> "$GITHUB_OUTPUT"
|
|
|
|
pre-release-checks:
|
|
name: ✅ Pre-release checks
|
|
needs:
|
|
- build
|
|
- release-notes
|
|
environment: Release
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
timeout-minutes: 20
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
|
|
|
# We explicitly *don't* set up caching here. This ensures our tests are
|
|
# maximally sensitive to catching breakage.
|
|
#
|
|
# For example, here's a way that caching can cause a falsely-passing test:
|
|
# - Make the langchain package manifest no longer list a dependency package
|
|
# as a requirement. This means it won't be installed by `pip install`,
|
|
# and attempting to use it would cause a crash.
|
|
# - That dependency used to be required, so it may have been cached.
|
|
# When restoring the venv packages from cache, that dependency gets included.
|
|
# - Tests pass, because the dependency is present even though it wasn't specified.
|
|
# - The package is published, and it breaks on the missing dependency when
|
|
# used in the real world.
|
|
|
|
- name: Set up Python + uv
|
|
uses: "./.github/actions/uv_setup"
|
|
id: setup-python
|
|
with:
|
|
python-version: ${{ env.PYTHON_VERSION }}
|
|
enable-cache: "false"
|
|
|
|
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
|
|
with:
|
|
name: dist
|
|
path: ${{ env.EFFECTIVE_WORKING_DIR }}/dist/
|
|
|
|
- name: Import dist package
|
|
shell: bash
|
|
working-directory: ${{ env.EFFECTIVE_WORKING_DIR }}
|
|
env:
|
|
PKG_NAME: ${{ needs.build.outputs.pkg-name }}
|
|
VERSION: ${{ needs.build.outputs.version }}
|
|
PRERELEASE_FLAG: ${{ inputs.allow-prereleases && '--prerelease=allow' || '' }}
|
|
# Install directly from the locally-built wheel (no index resolution needed).
|
|
# `PRERELEASE_FLAG` is empty by default; opt-in via the `allow-prereleases`
|
|
# workflow input lets transitive prerelease deps resolve during alpha
|
|
# release cycles. Stable-release safety is still enforced by the
|
|
# `Check for prerelease versions` step below.
|
|
run: |
|
|
uv venv
|
|
VIRTUAL_ENV=.venv uv pip install $PRERELEASE_FLAG dist/*.whl
|
|
|
|
# Replace all dashes in the package name with underscores,
|
|
# since that's how Python imports packages with dashes in the name.
|
|
# also remove _official suffix
|
|
IMPORT_NAME="$(echo "$PKG_NAME" | sed s/-/_/g | sed s/_official//g)"
|
|
|
|
uv run python -c "import $IMPORT_NAME; print(dir($IMPORT_NAME))"
|
|
|
|
- name: Import test dependencies
|
|
run: uv sync --group test
|
|
working-directory: ${{ env.EFFECTIVE_WORKING_DIR }}
|
|
|
|
# Overwrite the local version of the package with the built version
|
|
- name: Import published package (again)
|
|
working-directory: ${{ env.EFFECTIVE_WORKING_DIR }}
|
|
shell: bash
|
|
env:
|
|
PKG_NAME: ${{ needs.build.outputs.pkg-name }}
|
|
VERSION: ${{ needs.build.outputs.version }}
|
|
PRERELEASE_FLAG: ${{ inputs.allow-prereleases && '--prerelease=allow' || '' }}
|
|
run: |
|
|
VIRTUAL_ENV=.venv uv pip install $PRERELEASE_FLAG dist/*.whl
|
|
|
|
- name: Check for prerelease versions
|
|
# Block release if any dependencies allow prerelease versions
|
|
# (unless this is itself a prerelease version)
|
|
working-directory: ${{ env.EFFECTIVE_WORKING_DIR }}
|
|
run: |
|
|
uv run python $GITHUB_WORKSPACE/.github/scripts/check_prerelease_dependencies.py pyproject.toml
|
|
|
|
- name: Run unit tests
|
|
run: make tests
|
|
working-directory: ${{ env.EFFECTIVE_WORKING_DIR }}
|
|
|
|
- name: Get minimum versions
|
|
# Find the minimum published versions that satisfies the given constraints
|
|
working-directory: ${{ env.EFFECTIVE_WORKING_DIR }}
|
|
id: min-version
|
|
run: |
|
|
VIRTUAL_ENV=.venv uv pip install packaging requests
|
|
python_version="$(uv run python --version | awk '{print $2}')"
|
|
min_versions="$(uv run python $GITHUB_WORKSPACE/.github/scripts/get_min_versions.py pyproject.toml release $python_version)"
|
|
echo "min-versions=$min_versions" >> "$GITHUB_OUTPUT"
|
|
echo "min-versions=$min_versions"
|
|
|
|
- name: Run unit tests with minimum dependency versions
|
|
if: ${{ steps.min-version.outputs.min-versions != '' }}
|
|
env:
|
|
MIN_VERSIONS: ${{ steps.min-version.outputs.min-versions }}
|
|
PRERELEASE_FLAG: ${{ inputs.allow-prereleases && '--prerelease=allow' || '' }}
|
|
run: |
|
|
VIRTUAL_ENV=.venv uv pip install $PRERELEASE_FLAG --force-reinstall --editable .
|
|
VIRTUAL_ENV=.venv uv pip install $PRERELEASE_FLAG --force-reinstall $MIN_VERSIONS
|
|
make tests PYTEST_EXTRA="-q -k 'not test_serdes'"
|
|
working-directory: ${{ env.EFFECTIVE_WORKING_DIR }}
|
|
|
|
- name: Import integration test dependencies
|
|
run: uv sync --group test --group test_integration
|
|
working-directory: ${{ env.EFFECTIVE_WORKING_DIR }}
|
|
|
|
- name: Run integration tests
|
|
# Uses the Makefile's `integration_tests` target for the specified package
|
|
if: ${{ startsWith(env.EFFECTIVE_WORKING_DIR, 'libs/partners/') }}
|
|
env:
|
|
AI21_API_KEY: ${{ secrets.AI21_API_KEY }}
|
|
GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
|
|
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
|
|
MISTRAL_API_KEY: ${{ secrets.MISTRAL_API_KEY }}
|
|
TOGETHER_API_KEY: ${{ secrets.TOGETHER_API_KEY }}
|
|
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
|
|
AZURE_OPENAI_API_VERSION: ${{ secrets.AZURE_OPENAI_API_VERSION }}
|
|
AZURE_OPENAI_API_BASE: ${{ secrets.AZURE_OPENAI_API_BASE }}
|
|
AZURE_OPENAI_API_KEY: ${{ secrets.AZURE_OPENAI_API_KEY }}
|
|
AZURE_OPENAI_CHAT_DEPLOYMENT_NAME: ${{ secrets.AZURE_OPENAI_CHAT_DEPLOYMENT_NAME }}
|
|
AZURE_OPENAI_LEGACY_CHAT_DEPLOYMENT_NAME: ${{ secrets.AZURE_OPENAI_LEGACY_CHAT_DEPLOYMENT_NAME }}
|
|
AZURE_OPENAI_LLM_DEPLOYMENT_NAME: ${{ secrets.AZURE_OPENAI_LLM_DEPLOYMENT_NAME }}
|
|
AZURE_OPENAI_EMBEDDINGS_DEPLOYMENT_NAME: ${{ secrets.AZURE_OPENAI_EMBEDDINGS_DEPLOYMENT_NAME }}
|
|
NVIDIA_API_KEY: ${{ secrets.NVIDIA_API_KEY }}
|
|
GOOGLE_SEARCH_API_KEY: ${{ secrets.GOOGLE_SEARCH_API_KEY }}
|
|
GOOGLE_CSE_ID: ${{ secrets.GOOGLE_CSE_ID }}
|
|
GROQ_API_KEY: ${{ secrets.GROQ_API_KEY }}
|
|
HUGGINGFACEHUB_API_TOKEN: ${{ secrets.HUGGINGFACEHUB_API_TOKEN }}
|
|
EXA_API_KEY: ${{ secrets.EXA_API_KEY }}
|
|
NOMIC_API_KEY: ${{ secrets.NOMIC_API_KEY }}
|
|
WATSONX_APIKEY: ${{ secrets.WATSONX_APIKEY }}
|
|
WATSONX_PROJECT_ID: ${{ secrets.WATSONX_PROJECT_ID }}
|
|
ASTRA_DB_API_ENDPOINT: ${{ secrets.ASTRA_DB_API_ENDPOINT }}
|
|
ASTRA_DB_APPLICATION_TOKEN: ${{ secrets.ASTRA_DB_APPLICATION_TOKEN }}
|
|
ASTRA_DB_KEYSPACE: ${{ secrets.ASTRA_DB_KEYSPACE }}
|
|
ES_URL: ${{ secrets.ES_URL }}
|
|
ES_CLOUD_ID: ${{ secrets.ES_CLOUD_ID }}
|
|
ES_API_KEY: ${{ secrets.ES_API_KEY }}
|
|
MONGODB_ATLAS_URI: ${{ secrets.MONGODB_ATLAS_URI }}
|
|
UPSTAGE_API_KEY: ${{ secrets.UPSTAGE_API_KEY }}
|
|
FIREWORKS_API_KEY: ${{ secrets.FIREWORKS_API_KEY }}
|
|
XAI_API_KEY: ${{ secrets.XAI_API_KEY }}
|
|
DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
|
|
PPLX_API_KEY: ${{ secrets.PPLX_API_KEY }}
|
|
OLLAMA_API_KEY: ${{ secrets.OLLAMA_API_KEY }}
|
|
OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
|
|
LANGCHAIN_TESTS_USER_AGENT: ${{ secrets.LANGCHAIN_TESTS_USER_AGENT }}
|
|
run: make integration_tests
|
|
working-directory: ${{ env.EFFECTIVE_WORKING_DIR }}
|
|
|
|
test-pypi-publish:
|
|
name: 🧪 Publish to TestPyPI
|
|
# release-notes must run before publishing because its check-tags step
|
|
# validates version/tag state — do not remove this dependency.
|
|
needs:
|
|
- build
|
|
- release-notes
|
|
- pre-release-checks
|
|
environment: Release
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
# This permission is used for trusted publishing:
|
|
# https://blog.pypi.org/posts/2023-04-20-introducing-trusted-publishers/
|
|
#
|
|
# Trusted publishing has to also be configured on PyPI for each package:
|
|
# https://docs.pypi.org/trusted-publishers/adding-a-publisher/
|
|
id-token: write
|
|
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
|
|
|
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
|
|
with:
|
|
name: dist
|
|
path: ${{ env.EFFECTIVE_WORKING_DIR }}/dist/
|
|
|
|
- name: Publish to test PyPI
|
|
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
|
|
with:
|
|
packages-dir: ${{ env.EFFECTIVE_WORKING_DIR }}/dist/
|
|
verbose: true
|
|
print-hash: true
|
|
repository-url: https://test.pypi.org/legacy/
|
|
# We overwrite any existing distributions with the same name and version.
|
|
# This is *only for CI use* and is *extremely dangerous* otherwise!
|
|
# https://github.com/pypa/gh-action-pypi-publish#tolerating-release-package-file-duplicates
|
|
skip-existing: true
|
|
# Temp workaround since attestations are on by default as of gh-action-pypi-publish v1.11.0
|
|
attestations: false
|
|
|
|
# Test select published packages against new core
|
|
# Done when code changes are made to langchain-core
|
|
test-prior-published-packages-against-new-core:
|
|
name: 🔄 Test prior partners against new core
|
|
# Installs the new core with old partners: Installs the new unreleased core
|
|
# alongside the previously published partner packages and runs unit and integration tests
|
|
needs:
|
|
- build
|
|
- release-notes
|
|
- test-pypi-publish
|
|
- pre-release-checks
|
|
environment: Release
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
strategy:
|
|
matrix:
|
|
# When adding a partner, also update the `skip-prior-published-package-checks`
|
|
# input (the `workflow_dispatch` `options` list and the `workflow_call`
|
|
# description) so the per-partner skip remains selectable.
|
|
partner: [ anthropic, openai ]
|
|
fail-fast: false # Continue testing other partners if one fails
|
|
env:
|
|
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
|
|
ANTHROPIC_FILES_API_IMAGE_ID: ${{ secrets.ANTHROPIC_FILES_API_IMAGE_ID }}
|
|
ANTHROPIC_FILES_API_PDF_ID: ${{ secrets.ANTHROPIC_FILES_API_PDF_ID }}
|
|
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
|
|
AZURE_OPENAI_API_VERSION: ${{ secrets.AZURE_OPENAI_API_VERSION }}
|
|
AZURE_OPENAI_API_BASE: ${{ secrets.AZURE_OPENAI_API_BASE }}
|
|
AZURE_OPENAI_API_KEY: ${{ secrets.AZURE_OPENAI_API_KEY }}
|
|
AZURE_OPENAI_CHAT_DEPLOYMENT_NAME: ${{ secrets.AZURE_OPENAI_CHAT_DEPLOYMENT_NAME }}
|
|
AZURE_OPENAI_LEGACY_CHAT_DEPLOYMENT_NAME: ${{ secrets.AZURE_OPENAI_LEGACY_CHAT_DEPLOYMENT_NAME }}
|
|
AZURE_OPENAI_LLM_DEPLOYMENT_NAME: ${{ secrets.AZURE_OPENAI_LLM_DEPLOYMENT_NAME }}
|
|
AZURE_OPENAI_EMBEDDINGS_DEPLOYMENT_NAME: ${{ secrets.AZURE_OPENAI_EMBEDDINGS_DEPLOYMENT_NAME }}
|
|
LANGCHAIN_TESTS_USER_AGENT: ${{ secrets.LANGCHAIN_TESTS_USER_AGENT }}
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
|
|
|
# We implement this conditional as Github Actions does not have good support
|
|
# for conditionally needing steps. https://github.com/actions/runner/issues/491
|
|
# TODO: this seems to be resolved upstream, so we can probably remove this workaround
|
|
- name: Check if libs/core
|
|
run: |
|
|
if [ "${{ startsWith(env.EFFECTIVE_WORKING_DIR, 'libs/core') }}" != "true" ]; then
|
|
echo "Not in libs/core. Exiting successfully."
|
|
exit 0
|
|
fi
|
|
|
|
- name: Set up Python + uv
|
|
if: startsWith(env.EFFECTIVE_WORKING_DIR, 'libs/core')
|
|
uses: "./.github/actions/uv_setup"
|
|
with:
|
|
python-version: ${{ env.PYTHON_VERSION }}
|
|
enable-cache: "false"
|
|
|
|
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
|
|
if: startsWith(env.EFFECTIVE_WORKING_DIR, 'libs/core')
|
|
with:
|
|
name: dist
|
|
path: ${{ env.EFFECTIVE_WORKING_DIR }}/dist/
|
|
|
|
- name: Skip prior published ${{ matrix.partner }} check
|
|
if: >-
|
|
startsWith(env.EFFECTIVE_WORKING_DIR, 'libs/core') &&
|
|
(inputs.skip-prior-published-package-checks == matrix.partner ||
|
|
inputs.skip-prior-published-package-checks == 'all')
|
|
run: |
|
|
echo "Skipping prior published ${{ matrix.partner }} check as requested."
|
|
|
|
- name: Test against ${{ matrix.partner }}
|
|
if: >-
|
|
startsWith(env.EFFECTIVE_WORKING_DIR, 'libs/core') &&
|
|
inputs.skip-prior-published-package-checks != matrix.partner &&
|
|
inputs.skip-prior-published-package-checks != 'all'
|
|
env:
|
|
PARTNER: ${{ matrix.partner }}
|
|
PRERELEASE_FLAG: ${{ inputs.allow-prereleases && '--prerelease=allow' || '' }}
|
|
run: |
|
|
PACKAGE_NAME="langchain-$PARTNER"
|
|
|
|
# Identify the latest non-yanked published package release, excluding pre-releases.
|
|
# Fail closed (matching the `Check version` step) so a PyPI outage or a
|
|
# missing release aborts with a clear message rather than an empty version.
|
|
LATEST_PACKAGE_VERSION="$(PACKAGE_NAME="$PACKAGE_NAME" python - <<'PY'
|
|
import json
|
|
import os
|
|
import re
|
|
import sys
|
|
import urllib.error
|
|
import urllib.request
|
|
|
|
package_name = os.environ["PACKAGE_NAME"]
|
|
url = f"https://pypi.org/pypi/{package_name}/json"
|
|
try:
|
|
with urllib.request.urlopen(url, timeout=10) as response:
|
|
data = json.load(response)
|
|
except urllib.error.HTTPError as err:
|
|
print(
|
|
f"::error::PyPI returned HTTP {err.code} listing {package_name} "
|
|
f"releases; cannot determine latest version, aborting.",
|
|
file=sys.stderr,
|
|
)
|
|
sys.exit(1)
|
|
except urllib.error.URLError as err:
|
|
print(
|
|
f"::error::Could not reach PyPI to list {package_name} releases "
|
|
f"({err.reason}); cannot determine latest version, aborting.",
|
|
file=sys.stderr,
|
|
)
|
|
sys.exit(1)
|
|
|
|
versions: list[tuple[int, int, int, str]] = []
|
|
for version, files in data["releases"].items():
|
|
if not re.fullmatch(r"\d+\.\d+\.\d+", version):
|
|
continue
|
|
if not files or all(file.get("yanked", False) for file in files):
|
|
continue
|
|
versions.append((*map(int, version.split(".")), version))
|
|
|
|
if not versions:
|
|
print(f"::error::No non-yanked final releases found for {package_name}", file=sys.stderr)
|
|
sys.exit(1)
|
|
|
|
print(max(versions)[3])
|
|
PY
|
|
)"
|
|
|
|
# Belt-and-suspenders: a bare assignment masks the heredoc's exit status
|
|
# in some shells, so guard explicitly rather than relying on `set -e`.
|
|
if [ -z "$LATEST_PACKAGE_VERSION" ]; then
|
|
echo "::error::Could not determine latest published $PACKAGE_NAME version; aborting."
|
|
exit 1
|
|
fi
|
|
|
|
LATEST_PACKAGE_TAG="$PACKAGE_NAME==$LATEST_PACKAGE_VERSION"
|
|
echo "Latest non-yanked package tag: $LATEST_PACKAGE_TAG"
|
|
|
|
# Ensure the PyPI release maps to a source tag before running tests.
|
|
git ls-remote --exit-code --tags origin "refs/tags/$LATEST_PACKAGE_TAG"
|
|
|
|
# Shallow-fetch just that single tag
|
|
git fetch --depth=1 origin tag "$LATEST_PACKAGE_TAG"
|
|
|
|
# Checkout the latest package files
|
|
rm -rf "$GITHUB_WORKSPACE/libs/partners/$PARTNER"/*
|
|
rm -rf $GITHUB_WORKSPACE/libs/standard-tests/*
|
|
cd $GITHUB_WORKSPACE/libs/
|
|
git checkout "$LATEST_PACKAGE_TAG" -- standard-tests/
|
|
git checkout "$LATEST_PACKAGE_TAG" -- "partners/$PARTNER/"
|
|
cd "partners/$PARTNER"
|
|
|
|
# Print as a sanity check
|
|
echo "Version number from pyproject.toml: "
|
|
cat pyproject.toml | grep "version = "
|
|
|
|
# Run tests
|
|
uv sync --group test --group test_integration
|
|
uv pip install $PRERELEASE_FLAG ../../core/dist/*.whl
|
|
make test
|
|
make integration_tests
|
|
|
|
# Test external packages that depend on langchain-core/langchain against the new release
|
|
# Only runs for core and langchain_v1 releases to catch breaking changes before publish
|
|
test-dependents:
|
|
name: "🐍 Test dependent: ${{ matrix.package.path }} (Python ${{
|
|
matrix.python-version }})"
|
|
needs:
|
|
- build
|
|
- release-notes
|
|
- test-pypi-publish
|
|
- pre-release-checks
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
# Only run for core or langchain_v1 releases.
|
|
# Job-level 'if' does not support env context, so EFFECTIVE_WORKING_DIR is
|
|
# unavailable; must use inputs directly and match both forms: short dropdown
|
|
# names (workflow_dispatch, e.g. 'core') and full 'libs/' paths
|
|
# (workflow_call / working-directory-override).
|
|
if: >-
|
|
contains(fromJSON('["core","langchain_v1"]'),
|
|
inputs.working-directory-override || inputs.working-directory) ||
|
|
startsWith(inputs.working-directory-override || inputs.working-directory,
|
|
'libs/core') || startsWith(inputs.working-directory-override ||
|
|
inputs.working-directory, 'libs/langchain_v1')
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
python-version: [ "3.11", "3.13" ]
|
|
package:
|
|
- name: deepagents
|
|
repo: langchain-ai/deepagents
|
|
path: libs/deepagents
|
|
# No API keys needed for now - deepagents `make test` only runs unit tests
|
|
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
|
with:
|
|
path: langchain
|
|
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
|
with:
|
|
repository: ${{ matrix.package.repo }}
|
|
path: ${{ matrix.package.name }}
|
|
|
|
- name: Set up Python + uv
|
|
uses: "./langchain/.github/actions/uv_setup"
|
|
with:
|
|
python-version: ${{ matrix.python-version }}
|
|
enable-cache: "false"
|
|
|
|
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
|
|
with:
|
|
name: dist
|
|
path: dist/
|
|
|
|
- name: Install ${{ matrix.package.name }} with local packages
|
|
# External dependents don't have [tool.uv.sources] pointing to this repo,
|
|
# so we install the package normally then override with the built wheel.
|
|
env:
|
|
PRERELEASE_FLAG: ${{ inputs.allow-prereleases && '--prerelease=allow' || '' }}
|
|
run: |
|
|
cd ${{ matrix.package.name }}/${{ matrix.package.path }}
|
|
|
|
# Install the package with test dependencies
|
|
uv sync --group test
|
|
|
|
# Override with the built wheel from this release
|
|
uv pip install $PRERELEASE_FLAG $GITHUB_WORKSPACE/dist/*.whl
|
|
|
|
- name: Run ${{ matrix.package.name }} tests
|
|
run: |
|
|
cd ${{ matrix.package.name }}/${{ matrix.package.path }}
|
|
make test
|
|
|
|
publish:
|
|
name: 🚀 Publish to PyPI
|
|
# Publishes the package to PyPI
|
|
needs:
|
|
- build
|
|
- release-notes
|
|
- test-pypi-publish
|
|
- pre-release-checks
|
|
- test-dependents
|
|
- test-prior-published-packages-against-new-core
|
|
# Run if all needed jobs succeeded or were skipped (test-dependents and
|
|
# test-prior-published-packages-against-new-core only run for core/langchain_v1)
|
|
if: ${{ !cancelled() && !failure() }}
|
|
environment: Release
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
# This permission is used for trusted publishing:
|
|
# https://blog.pypi.org/posts/2023-04-20-introducing-trusted-publishers/
|
|
#
|
|
# Trusted publishing has to also be configured on PyPI for each package:
|
|
# https://docs.pypi.org/trusted-publishers/adding-a-publisher/
|
|
id-token: write
|
|
|
|
defaults:
|
|
run:
|
|
working-directory: ${{ env.EFFECTIVE_WORKING_DIR }}
|
|
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
|
|
|
- name: Set up Python + uv
|
|
uses: "./.github/actions/uv_setup"
|
|
with:
|
|
python-version: ${{ env.PYTHON_VERSION }}
|
|
enable-cache: "false"
|
|
|
|
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
|
|
with:
|
|
name: dist
|
|
path: ${{ env.EFFECTIVE_WORKING_DIR }}/dist/
|
|
|
|
- name: Publish package distributions to PyPI
|
|
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
|
|
with:
|
|
packages-dir: ${{ env.EFFECTIVE_WORKING_DIR }}/dist/
|
|
verbose: true
|
|
print-hash: true
|
|
# Temp workaround since attestations are on by default as of gh-action-pypi-publish v1.11.0
|
|
attestations: false
|
|
|
|
mark-release:
|
|
name: 🏷️ Tag GitHub release
|
|
# Marks the GitHub release with the new version tag
|
|
needs:
|
|
- build
|
|
- release-notes
|
|
- test-pypi-publish
|
|
- pre-release-checks
|
|
- publish
|
|
# Run if all needed jobs succeeded or were skipped
|
|
if: ${{ !cancelled() && !failure() }}
|
|
environment: Release
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
# This permission is needed by `ncipollo/release-action` to
|
|
# create the GitHub release/tag
|
|
contents: write
|
|
|
|
defaults:
|
|
run:
|
|
working-directory: ${{ env.EFFECTIVE_WORKING_DIR }}
|
|
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
|
|
|
- name: Set up Python + uv
|
|
uses: "./.github/actions/uv_setup"
|
|
with:
|
|
python-version: ${{ env.PYTHON_VERSION }}
|
|
enable-cache: "false"
|
|
|
|
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
|
|
with:
|
|
name: dist
|
|
path: ${{ env.EFFECTIVE_WORKING_DIR }}/dist/
|
|
|
|
- name: Create Tag
|
|
uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1
|
|
with:
|
|
# JS actions ignore `defaults.run.working-directory`, so this glob is
|
|
# resolved from the repo root. Point it at the package's `dist/`
|
|
# (where `download-artifact` placed the wheels) instead of a bare
|
|
# `dist/*`, which never matched and attached no assets to releases.
|
|
artifacts: "${{ env.EFFECTIVE_WORKING_DIR }}/dist/*"
|
|
token: ${{ secrets.GITHUB_TOKEN }}
|
|
generateReleaseNotes: false
|
|
tag: ${{needs.build.outputs.pkg-name}}==${{ needs.build.outputs.version }}
|
|
body: ${{ needs.release-notes.outputs.release-body }}
|
|
commit: ${{ github.sha }}
|
|
makeLatest: ${{ needs.build.outputs.pkg-name == 'langchain-core'}}
|