Updated to add write permissions, checkout using secrets.RELEASE_PAT, and configure Git identity like other release workflows. Cherry picking previously worked because default GITHUB_TOKEN permissions were read-write back in April, but the default has since changed to read-only.
Co-authored-by: Kathy Wu <wukathy@google.com>
PiperOrigin-RevId: 956753686
Merge https://github.com/google/adk-python/pull/6172
Pin Action references in the credential-bearing release workflows
to their currently resolved immutable commit SHAs.
PiperOrigin-RevId: 950937818
Merge https://github.com/google/adk-python/pull/6229
Pin third-party GitHub Actions to specific commit SHAs in CI and release workflows to harden supply-chain security.
PiperOrigin-RevId: 949177003
Merge https://github.com/google/adk-python/pull/6113
## Summary
- Configure the discussion answering agents through `LLM_MODEL_NAME` instead of
hardcoding `gemini-3.5-flash`.
- Let the GitHub workflow override both the answering model and Vertex location
with repository variables.
- Downgrade the default model from `gemini-3.5-flash` to `gemini-2.5-flash` because
`gemini-3.5-flash` 404s on Vertex AI Search (#6104).
- Document the new knobs.
Fixes#6104
## Testing
- `git diff --check`
- `python3.12 -m py_compile contributing/samples/adk_team/adk_answering_agent/settings.py contributing/samples/adk_team/adk_answering_agent/agent.py contributing/samples/adk_team/adk_answering_agent/gemini_assistant/agent.py`
Co-authored-by: Kathy Wu <wukathy@google.com>
COPYBARA_INTEGRATE_REVIEW=https://github.com/google/adk-python/pull/6113 from Haihan-Jiang:codex/adk-python-answering-model-config aea24eab14eaf479b7d42f59f25a94e0baa713a5
PiperOrigin-RevId: 947224603
Expands the release-cut changelog curation so the release PR looks good
by default. curate_changelog.py now normalizes the newest section
(unescape HTML entities, de-link stray @mentions, drop duplicate
entries from the same change, lowercase each entry's leading word),
folds large releases under a <details> block (sized by
--fold-threshold / CHANGELOG_FOLD_THRESHOLD, default 12), and can emit
the curated section via --section-out. The release-cut workflow now
mirrors that section into the PR description, and its curation steps run
whenever a release PR exists (not only when newly created), so
regenerate runs stay curated too.
Co-authored-by: George Weale <gweale@google.com>
PiperOrigin-RevId: 944860270
This resolves a "Duplicate header: Authorization" error (HTTP 400) when
create-pull-request runs. actions/checkout@v6 persists credentials by default,
which conflicts with the token used by create-pull-request.
Co-authored-by: Yifan Wang <wanyif@google.com>
PiperOrigin-RevId: 943548154
This resolves a token conflict where actions/checkout persisted the default
GITHUB_TOKEN, causing subsequent git push operations by create-pull-request
(which uses RELEASE_PAT) to fail with a 400 Bad Request.
Co-authored-by: Yifan Wang <wanyif@google.com>
PiperOrigin-RevId: 943541293
The agent ran on a schedule with a write-scoped GitHub token while feeding
attacker-controlled issue title and body straight into its prompt, so a
crafted issue could steer its labeling and owner-assignment actions.
Removing the agent and its workflow removes that exposure.
Co-authored-by: George Weale <gweale@google.com>
PiperOrigin-RevId: 941289396
Add a CI job that runs the A2A test suite against a2a-sdk 0.3.x in addition to
the version resolved by the main test run, so the adk/a2a/_compat.py
compatibility shim stays verified against both SDK majors.
PiperOrigin-RevId: 940935952
scripts/compliance_checks.py documents and matches the very patterns it
forbids, so the compliance-checks hook (which scanned every .py file)
flagged itself and failed on every PR running pre-commit on all files.
Skip the dev-only scripts/ directory. Also clears pre-existing pyink and
end-of-file drift surfaced by the same all-files run.
Co-authored-by: George Weale <gweale@google.com>
PiperOrigin-RevId: 940618068
1. Enable caching for `setup-uv` in `continuous-integration.yml` and
`release-publish.yml` to speed up CI runs.
2. Secure JSON passing in `discussion_answering.yml` by using an environment
variable instead of writing it via inline bash heredoc to prevent potential
script injection.
Co-authored-by: Shangjie Chen <deanchen@google.com>
PiperOrigin-RevId: 940546688
After release-please opens the release PR, draft a Highlights section at the top
of the new CHANGELOG.md version and commit it to the PR branch, so releases lead
with what matters instead of the raw commit list. Drafting uses Gemini and falls
back to an empty Highlights template when unavailable, so it never blocks the
release.
Co-authored-by: George Weale <gweale@google.com>
PiperOrigin-RevId: 940206960
Move custom file compliance checks (logger pattern, future annotations,
cli imports, mTLS endpoints) from GHA inline bash scripts to a unified
python script (compliance_checks.py) and expose it as a local pre-commit hook.
Remove the compliance-check job from CI workflow.
Co-authored-by: Shangjie Chen <deanchen@google.com>
PiperOrigin-RevId: 940081615
Update workflows to ensure they only run on the main repository (google/adk-python)
and target main or v1 branches where applicable. This prevents workflows from
running on forks and restricts merge blocking to main branch.
Co-authored-by: Shangjie Chen <deanchen@google.com>
PiperOrigin-RevId: 940031708
Merges the redundant release pipelines for the main (v2+) and v1 branches, reducing 10 workflow files down to 4 highly-cohesive, parameterized files:
1. release-cut.yml: Consolidates release-cut and release-v1-cut, and directly integrates the release-please action (eliminating separate please workflows). Now supports both cutting a new candidate and manually regenerating/updating an existing changelog PR via action input.
2. release-cherry-pick.yml: Consolidates cherry-pick and release-v1-cherry-pick to target the active candidate dynamically based on branch input.
3. release-finalize.yml: Consolidates finalize and release-v1-finalize to handle candidate branch renaming and metadata updates dynamically.
4. release-publish.yml: Consolidates publish and release-v1-publish to build wheels via uv, handle PEP 440 pre-release version mapping dynamically for v1, and create merge-back PRs targeting the correct base branch (main or v1).
Deleted obsolete workflows: release-please.yml, release-v1-cut.yml, release-v1-please.yml, release-v1-finalize.yml, release-v1-publish.yml, release-v1-cherry-pick.yml.
Co-authored-by: Shangjie Chen <deanchen@google.com>
PiperOrigin-RevId: 937624141
Consolidates the two daily issue-cleaning background agents (`stale-bot.yml` and `issue-monitor.yml`) into a single, unified, parallelized workflow `issue-maintenance.yml`.
Both agents run once a day at 6:00 AM UTC. Merging them into parallel jobs within a single workflow:
1. Prevents GitHub Actions run history clutter by grouping the daily sweeps into exactly one daily run card.
2. Provides a clean, unified manual trigger (workflow_dispatch) console in the GitHub UI, allowing developers to run either or both agents with a simple dropdown and checkbox menu.
3. Eliminates duplicate YAML boilerplate.
Co-authored-by: Shangjie Chen <deanchen@google.com>
PiperOrigin-RevId: 936714448
Since we consolidated the mypy check into the unified continuous-integration.yml pipeline (running differential checks on PRs), the manual strict mypy.yml workflow is redundant and has never been triggered in the history of the repository.
Deleting this dead configuration to keep the Actions sidebar clean and avoid configuration rot.
Co-authored-by: Shangjie Chen <deanchen@google.com>
PiperOrigin-RevId: 936400372
Integrate the custom linter and compliance checks from check-file-contents.yml as a parallel 'compliance-check' job in continuous-integration.yml. This job is restricted to run only on pull_request events to preserve its git-diff based incremental analysis logic.
This change deletes the now redundant check-file-contents.yml file, further consolidating our GitHub Actions infrastructure and reducing status check clutter on PR pages.
Co-authored-by: Shangjie Chen <deanchen@google.com>
PiperOrigin-RevId: 936313070
Consolidate the pre-commit, mypy-new-errors, and python-unit-tests workflows into a single parallelized pipeline in continuous-integration.yml. This significantly reduces notification spam by reporting only one status card per push/pull request.
Co-authored-by: Shangjie Chen <deanchen@google.com>
PiperOrigin-RevId: 936280226
Merge https://github.com/google/adk-python/pull/6155
**Please ensure you have read the [contribution guide](https://github.com/google/adk-python/blob/main/CONTRIBUTING.md) before creating a pull request.**
### Link to Issue or Description of Change
**1. Link to an existing issue (if applicable):**
N/A
**2. Or, if no issue exists, describe the change:**
**Problem:**
The repository is missing Apache 2.0 license headers across 155 files. This is required by Google OSPO.
**Solution:**
Prepended the standard Apache 2.0 open-source license header to all flagged files. The copyright year was dynamically assigned based on each file's first commit year in git history.
### Testing Plan
_Please describe the tests that you ran to verify your changes. This is required for all PRs that are not small documentation or typo fixes._
**Unit Tests:**
- [ ] I have added or updated unit tests for my change.
- [x] All unit tests pass locally.
_Please include a summary of passed `pytest` results._
N/A - This PR only adds comments (license headers) to the top of files and contains zero functional code changes. No new tests are needed, and existing tests should pass as-is.
**Manual End-to-End (E2E) Tests:**
N/A - No functional code was changed.
### Checklist
- [x] I have read the [CONTRIBUTING.md](https://github.com/google/adk-python/blob/main/CONTRIBUTING.md) document.
- [x] I have performed a self-review of my own code.
- [ ] I have commented my code, particularly in hard-to-understand areas.
- [ ] I have added tests that prove my fix is effective or that my feature works.
- [x] New and existing unit tests pass locally with my changes.
- [ ] I have manually tested my changes end-to-end.
- [ ] Any dependent changes have been merged and published in downstream modules.
### Additional context
Co-authored-by: Shangjie Chen <deanchen@google.com>
COPYBARA_INTEGRATE_REVIEW=https://github.com/google/adk-python/pull/6155 from milenvk:fix-missing-licenses d2a264b9a812fd997daf975ec37996e6b4b7a042
PiperOrigin-RevId: 936165783
Hide the low-signal Code Refactoring section from the auto-changelog and
require a curated Highlights section, so releases lead with what matters.
Co-authored-by: George Weale <gweale@google.com>
PiperOrigin-RevId: 936105978
Update the "Release: Update ADK Web" workflow to use the `RELEASE_PAT`
secret instead of `GITHUB_TOKEN` so the PR is opened by the release bot.
Dynamically extract the bot's identity to configure the commit author
and committer, ensuring the commits pass the Google CLA check.
Co-authored-by: Yifan Wang <wanyif@google.com>
PiperOrigin-RevId: 933980559
This updates `actions/checkout`, `actions/setup-python`, and `astral-sh/setup-uv` to their latest major versions in the release-related GitHub Actions workflows.
Co-authored-by: Liang Wu <wuliang@google.com>
PiperOrigin-RevId: 933935472
Merge https://github.com/google/adk-python/pull/6098
## Summary
Two changes that reduce unit-test runtime without losing coverage:
1. **Enable `pytest-xdist` in CI** (`-n auto`). The ~7,300-test suite was running single-threaded even though `pytest-xdist` is already a declared dev dependency.
2. **Remove dead `llm_backend` parametrize** from 26 tests, which were running twice over identical code paths.
## Impact
| | Before | After |
|---|---|---|
| Wall-clock (full suite, local 12-core) | **121s** (71% CPU, single-core bound) | **72s** (622% CPU) → **~40% faster** |
| Executions from dead param | +26 redundant | 0 |
CI runners benefit proportionally to their core count; the parallelism win is the dominant factor.
## Why the `llm_backend` removal is safe
The `@pytest.mark.parametrize("llm_backend", ["GOOGLE_AI", "VERTEX"])` decorator on these 26 tests (24 in `test_instructions.py`, 2 in `test_llm_request.py`) did **nothing**:
- No test body referenced `llm_backend`.
- No fixture consumed it (the working pattern is the `env_variables` fixture in `conftest.py`, a different name that actually sets `GOOGLE_GENAI_USE_ENTERPRISE`).
- Both param values executed identical code under the same ambient env.
I scanned every backend-branching site in the source and confirmed the full call surface of these tests has **zero backend branching**:
- `flows/llm_flows/instructions.py` and `contents.py` — no variant checks.
- `models/llm_request.py::append_instructions` — pure data transform.
Real dual-backend FD-prep coverage (the env-driven path through `base_tool._get_declaration` → `_automatic_function_calling_util` / `_gemini_schema_util`) remains intact in `test_agent_tool.py`, which correctly uses the `env_variables` fixture to flip the variant.
## Test plan
- [x] `test_instructions.py` + `test_llm_request.py`: 60 passed (was 86 with duplicates; 26 redundant executions removed, all unique cases preserved).
- [x] Full suite under `-n auto`: 7160 passed, 0 new failures.
- [x] pyink + isort clean; pre-commit hooks pass.
> Note: `telemetry/test_functional.py::test_instrumented_with_opentelemetry_instrumentation_google_genai` fails locally in isolation on a clean `main` too (local env / optional `opentelemetry-instrumentation-google-genai`); pre-existing and unrelated to this PR.
Co-authored-by: Wei Sun (Jack) <weisun@google.com>
COPYBARA_INTEGRATE_REVIEW=https://github.com/google/adk-python/pull/6098 from google:perf/reduce-unittest-runtime 0baac8fb8642433bab779ea8cb20779431e25713
PiperOrigin-RevId: 931335891
Merge https://github.com/google/adk-python/pull/5391
## Summary
- Add `if: github.repository == 'google/adk-python'` guard to 3 workflows that lack this protection: v2-sync, issue-monitor, and copybara-pr-handler
- These workflows use secrets unavailable on forks (RELEASE_PAT, ADK_TRIAGE_AGENT, GOOGLE_API_KEY), causing daily failures on forks
## Context
Other scheduled/repo-specific workflows (triage.yml, stale-bot.yml, upload-adk-docs-to-vertex-ai-search.yml) already have this guard. These 3 were missing it, causing errors on forks every day.
## Testing Plan
- Verified that the added condition matches the existing pattern used in triage.yml, stale-bot.yml, and upload-adk-docs-to-vertex-ai-search.yml
- On forks, the job will be skipped (same behavior as the already-protected workflows)
- On google/adk-python, the workflows will continue to run as before since the condition evaluates to true
Co-authored-by: George Weale <gweale@google.com>
COPYBARA_INTEGRATE_REVIEW=https://github.com/google/adk-python/pull/5391 from Wu-Jiayang:fix/workflow-fork-protection 6601a67cd1b74b2d50820edd7944b4ab1d080466
PiperOrigin-RevId: 931242443
Merge https://github.com/google/adk-python/pull/5272
### Link to Issue or Description of Change
**1. Link to an existing issue (if applicable):**
- Related: #5271
**2. Or, if no issue exists, describe the change:**
**Problem:**
The release analyzer workflow interpolated `workflow_dispatch` string inputs directly into the shell command used in `run:`. That let shell metacharacters in `start_tag` or `end_tag` be parsed by bash before Python started.
**Solution:**
Move the dispatch inputs into environment variables and build the Python argument list in bash using an array before invoking the analyzer. This keeps the input values as data instead of shell syntax.
### Testing Plan
**Unit Tests:**
- [ ] I have added or updated unit tests for my change.
- [ ] All unit tests pass locally.
There is no repo unit-test harness for this workflow YAML.
**Manual Validation:**
- Parsed the updated workflow YAML successfully.
- In Linux Docker, the pre-patch rendered command `python -m adk_release_analyzer.main --start-tag v1.0.0; touch /tmp/gh-before-proof #` created the proof file.
- In Linux Docker, the patched bash-array form received the same malicious value as a single argv element:
- `["--start-tag", "v1.0.0; touch /tmp/gh-after-proof #"]`
- The patched form did not create the proof file.
### Checklist
- [x] I have read the [CONTRIBUTING.md](https://github.com/google/adk-python/blob/main/CONTRIBUTING.md) document.
- [x] I have performed a self-review of my own code.
- [ ] I have commented my code, particularly in hard-to-understand areas.
- [ ] I have added tests that prove my fix is effective or that my feature works.
- [ ] New and existing unit tests pass locally with my changes.
- [ ] I have manually tested my changes end-to-end.
- [x] Any dependent changes have been merged and published in downstream modules.
### Additional context
This is a small workflow hardening change intended to remove shell interpretation of `workflow_dispatch` string inputs while preserving the existing analyzer behavior.
Co-authored-by: George Weale <gweale@google.com>
COPYBARA_INTEGRATE_REVIEW=https://github.com/google/adk-python/pull/5272 from petrmarinec:fix-release-workflow-input-handling 5e24baee21ab023693d6bad7d92516db47ddafb4
PiperOrigin-RevId: 930894541
Merge https://github.com/google/adk-python/pull/6086
## Summary
- Adds `.github/workflows/block-merge.yml`, an always-failing check that keeps the GitHub merge button disabled on every PR.
- Maintainers land changes internally and Copybara syncs them back to this repo; PRs are not merged through the GitHub UI.
- The job runs standalone (no `needs:` dependents) so it does **not** block or cancel other CI checks — they still run and report normally.
On the PR page the check appears as:
> **Do Not Merge on GitHub / Do not merge — maintainers land changes via Copybara**
with the annotation:
> Do NOT merge this pull request on GitHub. A maintainer will land the change internally, and Copybara will sync it back to this repository automatically.
## Follow-up (manual, GitHub UI)
After this merges, create a branch ruleset to require the check:
1. Settings → Rules → Rulesets → **New branch ruleset**
2. Name: `Block GitHub Merge`, Enforcement: **Active**
3. Target branches → **Include default branch**
4. Rules → **Require status checks to pass** → add check **`Do not merge — maintainers land changes via Copybara`**
5. **Create**
The check name appears in the picker after this workflow runs once; otherwise type it manually.
## Test plan
- [ ] Confirm the merge-block check appears and fails on this PR
- [ ] Confirm other CI checks still run and report independently
- [ ] After ruleset is added, confirm the merge button is grayed out
Co-authored-by: Wei Sun (Jack) <weisun@google.com>
COPYBARA_INTEGRATE_REVIEW=https://github.com/google/adk-python/pull/6086 from google:ci/block-github-merge 587a03a5137c6255429dfa8be4e59abbb9dc258b
PiperOrigin-RevId: 930808152
Merge https://github.com/google/adk-python/pull/6053
## What the patch does
`pr-triage.yml` in `google/adk-python` runs on `pull_request_target` and mounts `ADK_TRIAGE_AGENT` and `GOOGLE_API_KEY` while the triage agent processes untrusted fork PR content.
This patch adds a fork guard: automated `pull_request_target` runs only when `head.repo.full_name == github.repository`. Maintainers can still trigger via `workflow_dispatch`.
**Pull request:** COLE_SEU_LINK_AQUI
## How it works
- **Before:** CLA-signed fork PR could auto-trigger privileged triage agent with API secrets in environment.
- **After:** External fork PRs no longer auto-run secret-backed triage; `workflow_dispatch` preserved.
## Writing effort
Modest — coordinated `if:` guard in `.github/workflows/pr-triage.yml`.
## Security impact
Compelling proactive hardening: prevents untrusted fork PR content from reaching privileged LLM CI with secrets.
No live exploit was performed. Local trust-boundary simulation only.
## Project scope
`google/adk-python` is OT1 in Google OSS repository tier.
## Relation to prior submissions
Proactive patch; pivots from REPORT-002 OSS VRP GHA class. **This is the security patch PR**, not a duplicate VRP report.
## Diff access
COLE_SEU_LINK_AQUI/files
COPYBARA_INTEGRATE_REVIEW=https://github.com/google/adk-python/pull/6053 from DVHRMNTCBSL:security/pr-analyze-fork-guard 7ec1ef0bd145f8367630c128328d19fba13bc631
PiperOrigin-RevId: 930315612
George Weale