Sync upstream main into sendbird (375f64c)

.github/workflows/acp-ci.yml

@@ -0,0 +1,147 @@
+name: ACP CI
+
+# acp/ is a nested Go module, so root CI does not build or test its packages.
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'acp/**'
+      - '.github/workflows/acp-ci.yml'
+      - '.gitattributes'
+      - 'scripts/verify-license.sh'
+      - 'scripts/verify-english-only.go'
+  # Integration branch PRs need the same checks before they reach main.
+  pull_request:
+    paths:
+      - 'acp/**'
+      - '.github/workflows/acp-ci.yml'
+      - '.gitattributes'
+      - 'scripts/verify-license.sh'
+      - 'scripts/verify-english-only.go'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: self-hosted
+    timeout-minutes: 15
+    container:
+      image: golang:1.26.9
+      options: --cpus=2
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Trust workspace
+        run: git config --global --replace-all safe.directory '*'
+
+      - name: Verify license headers
+        run: bash scripts/verify-license.sh
+
+      - name: Verify sources contain no unapproved non-English text
+        working-directory: acp
+        run: go run ../scripts/verify-english-only.go
+
+      - name: Check formatting
+        working-directory: acp
+        run: |
+          unformatted="$(gofmt -s -l .)"
+          if [ -n "$unformatted" ]; then
+            echo "::error::Not gofmt-clean. Run 'gofmt -s -w .' and commit:"
+            echo "$unformatted"
+            gofmt -s -d .
+            exit 1
+          fi
+
+      - name: Check line endings
+        run: |
+          git add --renormalize .
+          if ! git diff --cached --quiet; then
+            echo "::error::Line endings must be LF. Run 'git add --renormalize .' and commit the diff below."
+            git diff --cached --stat
+            exit 1
+          fi
+
+      # `git status --porcelain` rather than `git diff`: a newly created go.sum
+      # is untracked, and `git diff` would not report it.
+      - name: Check go.mod is tidy
+        working-directory: acp
+        run: |
+          go mod tidy
+          if [ -n "$(git status --porcelain -- go.mod go.sum)" ]; then
+            echo "::error::go.mod/go.sum are not tidy. Run 'go mod tidy' in acp/ and commit the diff below."
+            git status --porcelain -- go.mod go.sum
+            git --no-pager diff -- go.mod go.sum
+            exit 1
+          fi
+
+      - name: Vet
+        working-directory: acp
+        run: go vet ./...
+
+      - name: Staticcheck
+        working-directory: acp
+        run: |
+          go install honnef.co/go/tools/cmd/staticcheck@v0.8.1
+          staticcheck -version
+          output="$(staticcheck ./... 2>&1)" || { printf '%s\n' "$output"; exit 1; }
+          printf '%s\n' "$output"
+          if printf '%s' "$output" | grep -q 'matched no packages'; then
+            echo "::error::Staticcheck analyzed no packages."
+            exit 1
+          fi
+
+      - name: Govulncheck
+        working-directory: acp
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@v1.6.0
+          govulncheck ./...
+
+      - name: Test with coverage
+        working-directory: acp
+        run: |
+          LC_ALL=C go test -v -race -count=1 -coverpkg=./... -coverprofile=coverage.out ./...
+          go tool cover -func=coverage.out | grep total: | awk '{print $3}'
+
+      - name: Check coverage threshold
+        working-directory: acp
+        run: |
+          COVERAGE=$(go tool cover -func=coverage.out | grep total: | awk '{print $3}' | sed 's/%//')
+          if [ -z "$COVERAGE" ]; then
+            echo "::error::Could not parse total coverage from coverage.out."
+            exit 1
+          fi
+          echo "Total coverage: ${COVERAGE}%"
+          if awk "BEGIN {exit !($COVERAGE < 90)}"; then
+            echo "FAIL: Coverage ${COVERAGE}% is below 90% threshold"
+            exit 1
+          fi
+          echo "PASS: Coverage ${COVERAGE}% meets 90% threshold"
+
+      - name: Build
+        working-directory: acp
+        run: go build -o ../dist/ocr-acp ./cmd/ocr-acp
+
+      # The Go container need not provide Python. uv provisions an isolated
+      # Python runtime and the pinned official SDK; no OCR/LLM credentials.
+      - name: Set up uv for official Python client
+        uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
+        with:
+          version: '0.11.1'
+          enable-cache: true
+          cache-dependency-glob: acp/testdata/python-smoke-requirements.txt
+          cache-suffix: python-3.12.13
+
+      - name: Smoke test
+        timeout-minutes: 5
+        env:
+          PYTHONUNBUFFERED: '1'
+          PYTHONOPTIMIZE: ''
+        run: >-
+          uv run --no-project --managed-python --python 3.12.13
+          --with-requirements acp/testdata/python-smoke-requirements.txt
+          acp/testdata/python-client-smoke.py

.github/workflows/action-contract.yml

@@ -18,6 +18,8 @@ on:
       - 'scripts/github-actions/**'
       - 'examples/github_actions/README.md'
       - '.github/workflows/action-contract.yml'
+      - '.github/workflows/pr-commit-policy.yml'
+      - '.github/workflows/release.yml'
   pull_request:
     branches: [main]
     paths:
@@ -30,6 +32,8 @@ on:
       - 'scripts/github-actions/**'
       - 'examples/github_actions/README.md'
       - '.github/workflows/action-contract.yml'
+      - '.github/workflows/pr-commit-policy.yml'
+      - '.github/workflows/release.yml'
 
 permissions:
   contents: read
@@ -54,6 +58,9 @@ jobs:
       - name: Trust workspace
         run: git config --global --replace-all safe.directory '*'
 
+      - name: Install release contract dependencies
+        run: apt-get update && apt-get install -y jq
+
       - name: Test GitHub Actions contracts
         run: npm run test:github-actions
 

.github/workflows/ci.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: self-hosted
     timeout-minutes: 15
     container:
-      image: golang:1.26.6
+      image: golang:1.26.9
       options: --cpus=2
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -82,6 +82,8 @@ jobs:
           govulncheck ./...
 
       - name: Test with coverage
+        env:
+          OCR_DELEGATE_REQUIRE_PTY: '1'
         run: |
           go test -v -race -count=1 -coverprofile=coverage.out ./...
           go tool cover -func=coverage.out | grep total: | awk '{print $3}'
@@ -109,6 +111,7 @@ jobs:
           echo "$HELP" | grep -q "scan"
           echo "$HELP" | grep -q "delegate"
           echo "$HELP" | grep -q "config"
+          echo "$HELP" | grep -q "auth"
           echo "$HELP" | grep -q "llm"
           echo "$HELP" | grep -q "viewer"
           echo "$HELP" | grep -q "session"
@@ -119,7 +122,7 @@ jobs:
   # do: it only proves the windows arms of the build-tag splits compile. GitHub
   # does not support `container:` on Windows runners
   # (actions/runner#904), so this job installs Go directly instead of reusing the
-  # golang:1.26.5 image the other jobs share.
+  # golang:1.26.9 image the other jobs share.
   windows:
     runs-on: windows-latest
     timeout-minutes: 20
@@ -128,7 +131,7 @@ jobs:
 
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.26.5'
+          go-version: '1.26.9'
           cache: true
 
       - name: Vet
@@ -161,6 +164,7 @@ jobs:
           echo "$HELP" | grep -q "scan"
           echo "$HELP" | grep -q "delegate"
           echo "$HELP" | grep -q "config"
+          echo "$HELP" | grep -q "auth"
           echo "$HELP" | grep -q "llm"
           echo "$HELP" | grep -q "viewer"
           echo "$HELP" | grep -q "session"
@@ -171,7 +175,7 @@ jobs:
     runs-on: self-hosted
     timeout-minutes: 10
     container:
-      image: golang:1.26.6
+      image: golang:1.26.9
       options: --cpus=2
     strategy:
       fail-fast: false

.github/workflows/pr-commit-policy.yml

@@ -0,0 +1,37 @@
+name: PR Commit Policy
+
+on:
+  pull_request_target:
+    branches: [main]
+    types: [opened, synchronize, reopened, edited, ready_for_review]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  pr-commit-policy:
+    name: PR Commit Policy
+    runs-on: [self-hosted, Linux, X64]
+    timeout-minutes: 5
+    container:
+      image: node:24.18.0
+      options: --cpus=1 --memory=1g
+    steps:
+      - name: Check out trusted policy script
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Check PR title and commit messages
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          retries: 2
+          script: |
+            const { run } = require('./scripts/github-actions/check-pr-commit-policy.js');
+            await run({ github, context, core });