Merge https://github.com/google/adk-python/pull/6098
## Summary
Two changes that reduce unit-test runtime without losing coverage:
1. **Enable `pytest-xdist` in CI** (`-n auto`). The ~7,300-test suite was running single-threaded even though `pytest-xdist` is already a declared dev dependency.
2. **Remove dead `llm_backend` parametrize** from 26 tests, which were running twice over identical code paths.
## Impact
| | Before | After |
|---|---|---|
| Wall-clock (full suite, local 12-core) | **121s** (71% CPU, single-core bound) | **72s** (622% CPU) → **~40% faster** |
| Executions from dead param | +26 redundant | 0 |
CI runners benefit proportionally to their core count; the parallelism win is the dominant factor.
## Why the `llm_backend` removal is safe
The `@pytest.mark.parametrize("llm_backend", ["GOOGLE_AI", "VERTEX"])` decorator on these 26 tests (24 in `test_instructions.py`, 2 in `test_llm_request.py`) did **nothing**:
- No test body referenced `llm_backend`.
- No fixture consumed it (the working pattern is the `env_variables` fixture in `conftest.py`, a different name that actually sets `GOOGLE_GENAI_USE_ENTERPRISE`).
- Both param values executed identical code under the same ambient env.
I scanned every backend-branching site in the source and confirmed the full call surface of these tests has **zero backend branching**:
- `flows/llm_flows/instructions.py` and `contents.py` — no variant checks.
- `models/llm_request.py::append_instructions` — pure data transform.
Real dual-backend FD-prep coverage (the env-driven path through `base_tool._get_declaration` → `_automatic_function_calling_util` / `_gemini_schema_util`) remains intact in `test_agent_tool.py`, which correctly uses the `env_variables` fixture to flip the variant.
## Test plan
- [x] `test_instructions.py` + `test_llm_request.py`: 60 passed (was 86 with duplicates; 26 redundant executions removed, all unique cases preserved).
- [x] Full suite under `-n auto`: 7160 passed, 0 new failures.
- [x] pyink + isort clean; pre-commit hooks pass.
> Note: `telemetry/test_functional.py::test_instrumented_with_opentelemetry_instrumentation_google_genai` fails locally in isolation on a clean `main` too (local env / optional `opentelemetry-instrumentation-google-genai`); pre-existing and unrelated to this PR.
Co-authored-by: Wei Sun (Jack) <weisun@google.com>
COPYBARA_INTEGRATE_REVIEW=https://github.com/google/adk-python/pull/6098 from google:perf/reduce-unittest-runtime 0baac8fb8642433bab779ea8cb20779431e25713
PiperOrigin-RevId: 931335891
Merge https://github.com/google/adk-python/pull/5391
## Summary
- Add `if: github.repository == 'google/adk-python'` guard to 3 workflows that lack this protection: v2-sync, issue-monitor, and copybara-pr-handler
- These workflows use secrets unavailable on forks (RELEASE_PAT, ADK_TRIAGE_AGENT, GOOGLE_API_KEY), causing daily failures on forks
## Context
Other scheduled/repo-specific workflows (triage.yml, stale-bot.yml, upload-adk-docs-to-vertex-ai-search.yml) already have this guard. These 3 were missing it, causing errors on forks every day.
## Testing Plan
- Verified that the added condition matches the existing pattern used in triage.yml, stale-bot.yml, and upload-adk-docs-to-vertex-ai-search.yml
- On forks, the job will be skipped (same behavior as the already-protected workflows)
- On google/adk-python, the workflows will continue to run as before since the condition evaluates to true
Co-authored-by: George Weale <gweale@google.com>
COPYBARA_INTEGRATE_REVIEW=https://github.com/google/adk-python/pull/5391 from Wu-Jiayang:fix/workflow-fork-protection 6601a67cd1b74b2d50820edd7944b4ab1d080466
PiperOrigin-RevId: 931242443
Merge https://github.com/google/adk-python/pull/5272
### Link to Issue or Description of Change
**1. Link to an existing issue (if applicable):**
- Related: #5271
**2. Or, if no issue exists, describe the change:**
**Problem:**
The release analyzer workflow interpolated `workflow_dispatch` string inputs directly into the shell command used in `run:`. That let shell metacharacters in `start_tag` or `end_tag` be parsed by bash before Python started.
**Solution:**
Move the dispatch inputs into environment variables and build the Python argument list in bash using an array before invoking the analyzer. This keeps the input values as data instead of shell syntax.
### Testing Plan
**Unit Tests:**
- [ ] I have added or updated unit tests for my change.
- [ ] All unit tests pass locally.
There is no repo unit-test harness for this workflow YAML.
**Manual Validation:**
- Parsed the updated workflow YAML successfully.
- In Linux Docker, the pre-patch rendered command `python -m adk_release_analyzer.main --start-tag v1.0.0; touch /tmp/gh-before-proof #` created the proof file.
- In Linux Docker, the patched bash-array form received the same malicious value as a single argv element:
- `["--start-tag", "v1.0.0; touch /tmp/gh-after-proof #"]`
- The patched form did not create the proof file.
### Checklist
- [x] I have read the [CONTRIBUTING.md](https://github.com/google/adk-python/blob/main/CONTRIBUTING.md) document.
- [x] I have performed a self-review of my own code.
- [ ] I have commented my code, particularly in hard-to-understand areas.
- [ ] I have added tests that prove my fix is effective or that my feature works.
- [ ] New and existing unit tests pass locally with my changes.
- [ ] I have manually tested my changes end-to-end.
- [x] Any dependent changes have been merged and published in downstream modules.
### Additional context
This is a small workflow hardening change intended to remove shell interpretation of `workflow_dispatch` string inputs while preserving the existing analyzer behavior.
Co-authored-by: George Weale <gweale@google.com>
COPYBARA_INTEGRATE_REVIEW=https://github.com/google/adk-python/pull/5272 from petrmarinec:fix-release-workflow-input-handling 5e24baee21ab023693d6bad7d92516db47ddafb4
PiperOrigin-RevId: 930894541
Merge https://github.com/google/adk-python/pull/6086
## Summary
- Adds `.github/workflows/block-merge.yml`, an always-failing check that keeps the GitHub merge button disabled on every PR.
- Maintainers land changes internally and Copybara syncs them back to this repo; PRs are not merged through the GitHub UI.
- The job runs standalone (no `needs:` dependents) so it does **not** block or cancel other CI checks — they still run and report normally.
On the PR page the check appears as:
> **Do Not Merge on GitHub / Do not merge — maintainers land changes via Copybara**
with the annotation:
> Do NOT merge this pull request on GitHub. A maintainer will land the change internally, and Copybara will sync it back to this repository automatically.
## Follow-up (manual, GitHub UI)
After this merges, create a branch ruleset to require the check:
1. Settings → Rules → Rulesets → **New branch ruleset**
2. Name: `Block GitHub Merge`, Enforcement: **Active**
3. Target branches → **Include default branch**
4. Rules → **Require status checks to pass** → add check **`Do not merge — maintainers land changes via Copybara`**
5. **Create**
The check name appears in the picker after this workflow runs once; otherwise type it manually.
## Test plan
- [ ] Confirm the merge-block check appears and fails on this PR
- [ ] Confirm other CI checks still run and report independently
- [ ] After ruleset is added, confirm the merge button is grayed out
Co-authored-by: Wei Sun (Jack) <weisun@google.com>
COPYBARA_INTEGRATE_REVIEW=https://github.com/google/adk-python/pull/6086 from google:ci/block-github-merge 587a03a5137c6255429dfa8be4e59abbb9dc258b
PiperOrigin-RevId: 930808152
Merge https://github.com/google/adk-python/pull/6053
## What the patch does
`pr-triage.yml` in `google/adk-python` runs on `pull_request_target` and mounts `ADK_TRIAGE_AGENT` and `GOOGLE_API_KEY` while the triage agent processes untrusted fork PR content.
This patch adds a fork guard: automated `pull_request_target` runs only when `head.repo.full_name == github.repository`. Maintainers can still trigger via `workflow_dispatch`.
**Pull request:** COLE_SEU_LINK_AQUI
## How it works
- **Before:** CLA-signed fork PR could auto-trigger privileged triage agent with API secrets in environment.
- **After:** External fork PRs no longer auto-run secret-backed triage; `workflow_dispatch` preserved.
## Writing effort
Modest — coordinated `if:` guard in `.github/workflows/pr-triage.yml`.
## Security impact
Compelling proactive hardening: prevents untrusted fork PR content from reaching privileged LLM CI with secrets.
No live exploit was performed. Local trust-boundary simulation only.
## Project scope
`google/adk-python` is OT1 in Google OSS repository tier.
## Relation to prior submissions
Proactive patch; pivots from REPORT-002 OSS VRP GHA class. **This is the security patch PR**, not a duplicate VRP report.
## Diff access
COLE_SEU_LINK_AQUI/files
COPYBARA_INTEGRATE_REVIEW=https://github.com/google/adk-python/pull/6053 from DVHRMNTCBSL:security/pr-analyze-fork-guard 7ec1ef0bd145f8367630c128328d19fba13bc631
PiperOrigin-RevId: 930315612
Remove the issue-analyze, issue-fix, and pr-analyze GitHub Actions
workflows. They ran an automated agent over untrusted issue and PR
content with broad repository credentials; deleting them removes that
exposure while a safer design is considered.
Co-authored-by: George Weale <gweale@google.com>
PiperOrigin-RevId: 929246616
Move pull request metadata verification, Google CLA checking, and diff analysis from adk-pr-triage into a dedicated adk-pr-analyze skill. This allows the CI system to run automated read-only checks on incoming pull requests without needing write permissions or manual intervention.
Change-Id: I1b7961eaeee5e26df10396d3439127da08fd320c
The --remote flag is not supported by gh repo fork when a repository argument (google/adk-python) is provided. Removing it ensures the fork is successfully created in GitHub Actions without causing workflow failures.
Change-Id: Ied687ee512bb37c1af9f3a7ff8b005bef1afd26f
- Fixes repository not found errors when pushing the fix branch in the issue-fix workflow by query-inspecting the authenticated bot's username and ensuring the fork exists via gh repo fork.
- Also updates the adk-issue-analyze skill output template to use a details tag for collapsible section and restructure questions.
Change-Id: If87b4ddbe897b9338aa6ee78221709e8777b0045
Enables issue analysis workflow to trigger on comments posted to pull requests. This is done by removing the `!github.event.issue.pull_request` check from the GHA issue analysis workflow definition, since GitHub models PR comments under the `issue_comment` event. The fix implementation workflow remains restricted to issues to prevent PR-on-PR loops and permission issues.
- Update scripts/run_antigravity.py to include comments and review comments in JSON payloads fetched by helper tools.
- Update adk-issue and adk-issue-analyze skills to prevent routing conflicts when /adk-issue-analyze is explicitly requested.
- Update branch validation in issue-fix workflow to fail if the agent does not successfully create and checkout fix/issue-<number>.
- Update adk-issue-fix skill branch template to match expected GHA workflow fallback pattern.
Change-Id: I34405266bb6b11cc4ad18878ef932bb46677c89d
- Adds secure command policy to the LocalAgentConfig in scripts/run_antigravity.py
that denies unsafe command executions and checks for shell injection.
- Allows both `gh` and `git` commands to be executed by the agent runner.
- Adds custom `fetch_github_issue` and `fetch_github_pr` Python tools to the
Antigravity agent runner configuration, using `curl` to enable direct JSON
metadata fetches from GitHub without requiring a configured `gh` CLI environment.
- Introduces the --show-steps CLI flag to scripts/run_antigravity.py
to output intermediate thoughts, tool calls, and tool results (default off).
- Updates .github/workflows/issue-analyze.yml to capture stdout from the
runner script, run automatic triage for any user's opened issues, and post
the report to the triggering GitHub issue as a comment via the `gh` CLI tool.
- Updates the adk-issue-analyze and adk-pr-triage skills to prefer using the
custom `fetch_github_issue` Python tool over raw `gh` command lines, and
strictly enforces that the issue-analyze skill is read-only and must not edit files.
Change-Id: I58a9c64f0680a56d07b9877cbcb9ffe027afeee2
Installs the public google-antigravity SDK via pip and executes a runner
python script scripts/run_antigravity.py to run any antigravity prompts.
This replaces the Node-based @google/antigravity CLI tool, and allows general
executions via Python.
Change-Id: Iade60816b4613567e261934a46285d7933adfc00
Introduce the adk-pr-triage skill and its supporting triage_pr.py helper
script to guide AI coding assistants through conducting rigorous and
automated triage of GitHub pull requests.
The workflow script handles compliance verification, validates that the
contributor's Google CLA signature status check run is SUCCESS, fetches
remote branches, and automates PR updates via server-side rebase before local checkout.
Provides an interactive 'Local Review' option that integrates branch checkout,
preserves original PR commit metadata, and triggers /adk-review for rigorous
quality control before squashing and pushing changes to Gerrit.
Change-Id: If311b90b185636f4f737aa04a3c50a4a460b94db
Ensure both types of Copybara PR commits are correctly identified and parsed by checking author email, headers, and updated merge regex.
Change-Id: Ic0cc19f67a3db4637fa597702393a11802b3f9aa
The upload-adk-docs-to-vertex-ai-search workflow failed with ModuleNotFoundError: No module named 'adk_answering_agent' because the relative PYTHONPATH path did not resolve correctly under some CI environment execution states. Resolved by using the absolute ${{ github.workspace }} path.
Change-Id: I18c72b671f33c134bd08601b4a97671a1b1b0fa9
ci: Repoint v2 release workflows and manifests to v1 branch
END_PUBLIC
This change repurposes all secondary v2 release workflows (cherry-pick, cut, finalize, please, publish) and Release Please manifest configs to manage legacy patch releases on the v1 branch, as v2 GA releases are now serviced directly from main.
BUG=None
TAG=agy
CONV=8876d6f0-694d-4980-9005-979adc5a2ef4
Change-Id: I9c682f5ec2c21fde95e0f00930e2442e254b33b3
The stale-bot workflow failed with ModuleNotFoundError because adk_stale_agent imports python-dateutil but the runner environment did not have it installed. Added python-dateutil to the pip install step.
Change-Id: I1002c8eb7bb8fe2f9e106e85c3b5a7f990fe1c62
The samples in `contributing/samples/adk_documentation` and other `adk_..._agent` directories were moved to `contributing/samples/adk_team/`. This caused workflows to fail with `ModuleNotFoundError` because `PYTHONPATH` was pointing to the old location.
Updated `PYTHONPATH` and module names in 7 workflow files to resolve correctly.
Change-Id: I5495a086b2ddc8f7bbd8c70b529271e06baced91
- Restrict invoke and review triggers purely to explicit user comments.
- Enforce strict author association verification (OWNER, MEMBER, COLLABORATOR).
- Enforce strict targeting assertion to ensure pull requests act on the main branch.
- Synchronize prompt constraints and GitHub action tools with the community catalog.
- Refine action API key options to uniformly target secrets.GOOGLE_API_KEY.
Co-authored-by: Shangjie Chen <deanchen@google.com>
PiperOrigin-RevId: 915654346
Merge https://github.com/google/adk-python/pull/5612
## Summary
- Added `.github/header-checker-lint.yml` with full configuration to ignore `src/google/adk/cli/browser/**`.
- Ensured Python files are still checked by adding `py` to `sourceFileExtensions`
## Test Plan
- Verify that the `License Header Lint GCF` / `header-check` status check passes on this PR
Co-authored-by: Wei Sun (Jack) <weisun@google.com>
COPYBARA_INTEGRATE_REVIEW=https://github.com/google/adk-python/pull/5612 from google:ci/ignore-browser-assets d08d1618a2de883a300f817c9fdc777daba5185e
PiperOrigin-RevId: 911583387
adk-bot