[yujiyokoo]

Summary

The Python SDK at languages/python had no CI. This adds tests-python.yml. It runs the workspace's Rust checks and pytest on Python 3.9 and 3.14, and builds one wheel for each of the six platforms the FFI ships for. Nothing is published.

Changes

• .github/workflows/tests-python.yml: two jobs. python runs fmt, clippy, cargo test --locked, and pytest on both interpreters. wheels builds six abi3-py39 release wheels, uploads them as artifacts, and writes the build time per platform to the job summary. No job receives a CS_* credential.
• scripts/__tests__/python-ci.test.mjs: holds the workflow to the tree. The path filter must cover every path dependency in the workspace's Cargo.lock. The Python matrix must be the requires-python floor and the version in mise.toml. The wheel matrix must match the protect-ffi platform packages.
• scripts/__tests__/eql-suite-ci.test.mjs: counts a mise run as an EQL task only from a step that runs under packages/eql. Before this, mise run test from languages/python was read as EQL's test task.
• scripts/__tests__/lib/workflows.mjs: two shared helpers, triggers and runWorkingDirectory. Six existing guards switch to triggers.
• languages/python/Cargo.lock: re-seeded from the root lock. The old one named crate versions the root no longer uses, so every --locked check failed.
• tests.yml: excludes languages/python/** from its live gate, as it does for the Go module.
• AGENTS.md, languages/python/mise.toml: notes on the workflow, the lock re-seeding, and why this workspace uses plain cargo test.

Verification

• scripts/__tests__ meta-tests: 83 files pass.
• In languages/python: cargo fmt --all --check, cargo clippy --locked, mise run test:cargo, and mise run test pass locally.
• shellcheck is clean on every run: block.
• No CI run has happened yet. The six wheel legs are untested until the first run of this PR.

Related

Closes #1383. Stacked on #1405. The live test job is #1389.

Review notes

This PR adds no Python lockfile. A uv.lock comes later, in a new PR at the top of this stack.

Today CI resolves every Python package from PyPI on each run. The packages are maturin and the test extra. By the end of the stack, that extra lists pytest, attrs, Pydantic, SQLAlchemy, and psycopg. The package itself has no runtime dependency, so a lock affects only CI and local builds.

The lock waits for the end of the stack for two reasons:

• Two later PRs add test packages: feat(python): read a model's declaration and check rule A (#1386) #1433 adds attrs, Pydantic, and SQLAlchemy, and feat(python): encrypt models into EQL v4 rows #1499 adds psycopg. A lock added here would have to be regenerated in each of them.
• Without a lock, the stack's CI meets each new release of these packages at once.

Until the lock lands, three risks apply:

• A new release of a test package can fail CI on a PR that did not change anything related.
• Two runs of the same commit can install different versions.
• The live job installs releases nobody has checked, while it has the CS_* secrets in its environment.

🤖 Generated with Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: d0a8e3a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI; Enforced overrides: Organization
• Review profile: CHILL
• Plan: Advanced
• Run ID: c8071aba-4e79-4648-ab02-09f9459cc532

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

[cipherstash-agent]

Review attestation

Reviewed d0a8e3a · posted from Claude Code · claude-sonnet-5-5 · effort unknown
Sources: code-review · model unknown; manual diff read · claude-sonnet-5-5
Skills: code-review, company-skills:review-cross-check, company-skills:review-post

Findings (3): 0 critical, 0 major, 3 minor — 3 inline, 0 below.

Checked against existing feedback (changeset-bot, CodeRabbit skip notice): none of the three is already raised.

---

Generated by Claude Code

[cipherstash-agent]

minor On pull_request runs actions/checkout checks out the synthetic merge commit, so git rev-parse HEAD stamps a throwaway SHA into every wheel's stackencrypt.__engine__. That SHA is on no branch, so a bug report naming it cannot be traced. Use ${{ github.event.pull_request.head.sha || github.sha }}.

_{Source: code-review · model unknown}

---

Generated by Claude Code

[cipherstash-agent]

minor The root .cargo/config.toml exists and cargo reads it for languages/python, so a [patch], [source] or [build] change there alters how this workspace compiles. The filter omits .cargo/**, so a PR touching only it skips the one job that links stack-encrypt into pyo3. Add .cargo/**.

_{Source: code-review · model unknown}

---

Generated by Claude Code

[cipherstash-agent]

minor needs: [wheels] with no if: always() skips this job when any wheel leg fails, so the build-time table for the passing legs is never written. The "fails here by platform name" diagnostic only fires when every leg is green. Add if: ${{ !cancelled() }}.

_{Source: code-review · model unknown}

---

Generated by Claude Code

[cipherstash-bot]

Recommendation: 🟡 merge after changes

Change one thing before merging: the new AGENTS.md text says the Python Cargo.lock is seeded from the root lock, and at this commit it is not. The maturin pin and the four test-coverage gaps can wait for a follow-up.

Other findings not posted as comments

• Optional: the credential test in scripts/__tests__/python-ci.test.mjs (near line 282) matches only secrets.CS_ and vars.CS_. The bracket form secrets['CS_CLIENT_KEY'] passes it.

How this review was made

Agent	Model	Review type	Result
claude	claude-opus-5-5	test-gap	4 found, 4 posted
claude	claude-opus-5-5	rust	0 found, 0 posted
claude	claude-opus-5-5	python	0 found, 0 posted
claude	claude-opus-5-5	infracode	2 found, 2 posted
codex	gpt-5.6-terra	test-gap	0 found, 0 posted
codex	gpt-5.6-terra	rust	0 found, 0 posted
codex	gpt-5.6-terra	python	0 found, 0 posted
codex	gpt-5.6-terra	infracode	0 found, 0 posted

Synthesis: claude-sonnet-5-5 merged the findings, removed duplicates and dropped findings it could not confirm in the code. 0 posted finding(s) were raised by two or more models.

Plain language: the reader test did not run; only the word-and-shape check was applied.

Stack: position 2 of 15 (#1405, *️⃣ #1406, #1414, #1415, #1433, #1437, #1453, #1499, #1509, #1510, #1511, #1513, #1516, #1517, #1582). *️⃣ marks this pull request.

Context loaded: the description, 2 linked issue(s) and 6 discussion entries.

[cipherstash-bot]

Change before merge: this text says the Python Cargo.lock uses the root workspace's crate versions. At this commit it does not, and no check compares the two lockfiles.

Impact: The Python engine compiles different versions of shared crates than the root crates that the other SDKs are tested with. No test or log message reports the difference. This file says a new ore-rs or recipher release can change every stored order term. If one of them moves in the root lock only, the Python SDK can produce terms the other SDKs do not match. The sentence "Until then, tests-python.yml fails on --locked" is also wrong for most moves. A root lock bump inside the existing requirements leaves the Python lock valid, so --locked still passes.

Evidence: vitaminc is 0.8.1 in languages/python/Cargo.lock and 0.8.0 in the root Cargo.lock. chrono is 0.4.43 in the Python lock and 0.4.45 in the root lock. cargo-lock-freshness.test.mjs compares only path crates, so it does not see registry versions.

Fix: Re-seed the Python lock so the claim is true today. Then add a parity test like scripts/__tests__/cipherstash-client-parity.test.mjs. For each registry package in both lockfiles, compare version, source and checksum. At minimum, compare the crates pinned with = in the root Cargo.toml, plus vitaminc and cipherstash-client. If exact parity is not the goal, change the sentence to say what stays equal and what may differ.

_{Found by 1 model: claude}

[cipherstash-bot]

Fix in a follow-up: the wheel build does not pin the maturin version, so every run downloads the newest maturin release.

Impact: The action is pinned by SHA, but maturin-action uses latest for maturin-version by default. A new maturin release can change wheel tags or fail all six legs on a PR that changed nothing related. Two runs of the same commit can use different maturin versions, so the recorded build times cannot be compared. The uv.lock in #1582 does not cover this, because maturin is not in it.

Fix: Pin the version in with:, inside the maturin>=1.9,<2.0 range from pyproject.toml:

        with:
          maturin-version: v1.9.6   # use the version the green runs used
          working-directory: languages/python

_{Found by 1 model: claude}

[cipherstash-bot]

Optional: the path-filter test still passes if pathDependencyTrees() finds no path dependency.

Impact: The test reads path dependencies from languages/python/Cargo.lock. If the lockfile format changes, the parser can return an empty list. Then the test checks only languages/python and the two EQL crates. A filter that drops packages/stack-encrypt/** is no longer caught.

Evidence: Today the lockfile gives five trees: stack-auth, stack-encrypt, stack-encrypt-derive, stack-kms, stack-profile. No assertion pins any of them.

Fix: Add a test that the scan finds the crates the engine links.

it('finds the stack crates as path dependencies, so the filter check is not empty', () => {
  expect(pathDependencyTrees()).toEqual(
    expect.arrayContaining(['packages/stack-encrypt', 'packages/stack-kms']),
  )
})

_{Found by 1 model: claude}

[cipherstash-bot]

Optional: the Rust cache test passes if it finds no job that compiles Rust.

Impact: compiles matches cargo, mise run, or PyO3/maturin-action@. If the wheel step changes form, for example to uvx maturin build, the wheels job is not counted. The test still passes, and a later removal of Swatinem/rust-cache from wheels is not caught.

Fix: Assert which jobs the scan counts, before the cache check.

const compiling = Object.entries(wf.jobs)
  .filter(([, job]) => job.steps.some(compiles))
  .map(([id]) => id)
expect(compiling.sort()).toEqual(['python', 'wheels'])

_{Found by 1 model: claude}

[cipherstash-bot]

Optional: the new shared triggers() helper has no test of its own, and seven guards now depend on it.

Impact: workflow-dispatch-job-conditions.test.mjs uses 'workflow_dispatch' in triggers(wf). That works only because the helper returns the on: object even when workflow_dispatch: is null. A later edit that drops null values changes the result for every guard. Those guards then find fewer workflows and pass with no error. The doc comment's three behaviours are not tested: the YAML 1.1 true key, a quoted 'on' key, and {} for a missing or non-object on:.

Fix: Add a small unit test for the helper.

import yaml from 'js-yaml'
import { triggers } from './lib/workflows.mjs'

describe('triggers()', () => {
  it('reads `on:` under the YAML 1.1 `true` key and under a quoted key', () => {
    expect(triggers(yaml.load('on:\n  push: {}'))).toHaveProperty('push')
    expect(triggers(yaml.load("'on':\n  push: {}"))).toHaveProperty('push')
  })
  it('keeps a trigger declared with no value', () => {
    expect('workflow_dispatch' in triggers(yaml.load('on:\n  workflow_dispatch:'))).toBe(true)
  })
  it('gives {} for a missing or non-object `on:`', () => {
    expect(triggers(undefined)).toEqual({})
    expect(triggers(yaml.load('name: x'))).toEqual({})
  })
})

_{Found by 1 model: claude}

[cipherstash-bot]

Optional: no test checks that a sibling folder such as packages/eql-foo is not read as inside EQL.

Impact: insideEql is correct today because EQL_PREFIX ends with /. If someone changes the check to startsWith(EQL_DIR), a step under packages/eql-foo counts as EQL. Then a task of the same name reads as an EQL task that CI runs. This change exists to stop that false result. The fixtures cover packages/eql, packages/eql/packages/eql and languages/python, but not a shared prefix.

Fix: Add one case to the does not read another workspace's task test.

it('does not read a sibling folder with the same prefix as packages/eql', () => {
  const wf = workflow({
    sibling: { steps: [step('mise run test:sqlx', 'packages/eql-bench')] },
    slash: { steps: [step('mise run test:schema', 'packages/eql/')] },
  })
  expect(eqlRunBodies(wf)).toEqual(['mise run test:schema'])
})

_{Found by 1 model: claude}