deepseek-harness/.gitlab-ci.yml

workflow:
  rules:
    - if: '$CI_COMMIT_TAG =~ /^python-v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.]+)?$/'
    - when: never

stages:
  - build
  - publish

variables:
  GIT_DEPTH: "0"
  PIP_DISABLE_PIP_VERSION_CHECK: "1"

.python-tools:
  before_script:
    - python3 -m venv .ci-python
    - . .ci-python/bin/activate
    - export DSH_VERSION="$(python -c 'import json; print(json.load(open("package.json"))["version"])')"
    - export DSH_WHEEL_VERSION="$(python -c 'import runpy; release = runpy.run_path("scripts/build-python-release.py"); print(release["pep440_version"](release["repository_version"]()))')"
    - test "$CI_COMMIT_TAG" = "python-v$DSH_VERSION" || { echo "Tag $CI_COMMIT_TAG does not match package.json version $DSH_VERSION"; exit 1; }
    - python -m pip install uv==0.11.23

sdk-wheel:
  extends: .python-tools
  stage: build
  tags: [linux-x64]
  script:
    - python scripts/build-python-release.py --package sdk --tag "$CI_COMMIT_TAG" --output-dir release/sdk
  artifacts:
    paths: [release/sdk/*.whl]
    expire_in: 1 week

.runtime-wheel:
  extends: .python-tools
  stage: build
  script:
    - corepack enable
    - pnpm install --frozen-lockfile
    - pnpm run verify-runtime-closure
    - pnpm exec tsx scripts/build-exe-for-python-sdk.ts --targets="$PKG_TARGET"
    - EXE="$PWD/dist-exe/deepseek-harness-sdk-runtime-$PLATFORM"
    - test -x "$EXE"
    - uv run --python 3.10 --group test --project python/sdk python scripts/smoke-python-runtime.py --scenario all --exe "$EXE"
    - python scripts/build-python-release.py --package runtime --tag "$CI_COMMIT_TAG" --platform "$PLATFORM" --runtime-exe "$EXE" --output-dir "release/$PLATFORM"
    - python -m venv .wheel-smoke
    - .wheel-smoke/bin/python -m pip install --find-links "release/$PLATFORM" --find-links release/sdk deepseek-harness-sdk=="$DSH_WHEEL_VERSION"
    - .wheel-smoke/bin/python scripts/smoke-python-runtime.py --scenario sdk-default
    - .wheel-smoke/bin/python scripts/smoke-python-runtime.py --scenario sdk-mcp
    - |
      if [ "${PLATFORM#linux-}" != "$PLATFORM" ]; then
        readelf --version-info "$EXE" > glibc-versions.txt
        maximum="$(sed -n 's/.*Name: GLIBC_\([0-9.]*\).*/\1/p' glibc-versions.txt | sort -V | tail -1)"
        test -n "$maximum"
        dpkg --compare-versions "$maximum" le 2.28
        case "$PLATFORM" in
          linux-x64) image=quay.io/pypa/manylinux_2_28_x86_64 ;;
          linux-arm64) image=quay.io/pypa/manylinux_2_28_aarch64 ;;
          *) echo "Unsupported Linux platform $PLATFORM"; exit 1 ;;
        esac
        docker run --rm -v "$PWD:/work" -w /work "$image" bash -euxo pipefail -c "/opt/python/cp310-cp310/bin/python -m venv /tmp/dsh-sdk && /tmp/dsh-sdk/bin/python -m pip install --find-links /work/release/$PLATFORM --find-links /work/release/sdk deepseek-harness-sdk==$DSH_WHEEL_VERSION && /tmp/dsh-sdk/bin/python /work/scripts/smoke-python-runtime.py --scenario sdk-default && /tmp/dsh-sdk/bin/python /work/scripts/smoke-python-runtime.py --scenario sdk-mcp"
      fi
    - |
      if [ "${PLATFORM#macos-}" != "$PLATFORM" ]; then
        case "$PLATFORM" in
          macos-arm64) macho_arch=arm64 ;;
          macos-x64) macho_arch=x86_64 ;;
          *) echo "Unsupported macOS platform $PLATFORM"; exit 1 ;;
        esac
        for payload in "$EXE" "$EXE-rg" "$EXE-spawn-helper"; do
          lipo "$payload" -verify_arch "$macho_arch"
        done
        python3 scripts/check-macos-deployment-target.py --platform "$PLATFORM" "$EXE" "$EXE-rg" "$EXE-spawn-helper"
      fi
  artifacts:
    paths: [release/$PLATFORM/*.whl]
    expire_in: 1 week

runtime-linux-x64:
  extends: .runtime-wheel
  tags: [linux-x64]
  variables:
    PKG_TARGET: node24-linux-x64
    PLATFORM: linux-x64
  needs:
    - job: sdk-wheel
      artifacts: true

runtime-linux-arm64:
  extends: .runtime-wheel
  tags: [linux-arm64]
  variables:
    PKG_TARGET: node24-linux-arm64
    PLATFORM: linux-arm64
  needs:
    - job: sdk-wheel
      artifacts: true

runtime-macos-arm64:
  extends: .runtime-wheel
  tags: [macos-arm64]
  variables:
    PKG_TARGET: node24-macos-arm64
    PLATFORM: macos-arm64
  needs:
    - job: sdk-wheel
      artifacts: true

runtime-macos-x64:
  extends: .runtime-wheel
  tags: [macos-x64]
  variables:
    PKG_TARGET: node24-macos-x64
    PLATFORM: macos-x64
  needs:
    - job: sdk-wheel
      artifacts: true

runtime-windows-x64:
  stage: build
  tags: [windows-x64]
  variables:
    PKG_TARGET: node24-win-x64
    PLATFORM: win-x64
  needs:
    - job: sdk-wheel
      artifacts: true
  before_script:
    - python -m venv .ci-python
    - $env:DSH_VERSION = (& .ci-python\Scripts\python.exe -c 'import json; print(json.load(open("package.json"))["version"])')
    - $env:DSH_WHEEL_VERSION = (& .ci-python\Scripts\python.exe -c 'import runpy; release = runpy.run_path("scripts/build-python-release.py"); print(release["pep440_version"](release["repository_version"]()))')
    - if ($env:CI_COMMIT_TAG -ne "python-v$env:DSH_VERSION") { throw "Tag $env:CI_COMMIT_TAG does not match package.json version $env:DSH_VERSION" }
    - .ci-python\Scripts\python.exe -m pip install uv==0.11.23
    - $env:Path = (Join-Path $PWD ".ci-python\Scripts") + [IO.Path]::PathSeparator + $env:Path
  script:
    - corepack enable
    - pnpm install --frozen-lockfile
    - pnpm run verify-runtime-closure
    - pnpm exec tsx scripts/build-exe-for-python-sdk.ts --targets=$env:PKG_TARGET
    - $exe = Join-Path $PWD "dist-exe\deepseek-harness-sdk-runtime-win-x64.exe"
    - if (-not (Test-Path -LiteralPath $exe -PathType Leaf)) { throw "Runtime executable is missing at $exe" }
    - uv run --python 3.10 --group test --project python/sdk python scripts/smoke-python-runtime.py --scenario all --exe $exe
    - .ci-python\Scripts\python.exe scripts/build-python-release.py --package runtime --tag $env:CI_COMMIT_TAG --platform $env:PLATFORM --runtime-exe $exe --output-dir "release/$env:PLATFORM"
    - python -m venv .wheel-smoke
    - .wheel-smoke\Scripts\python.exe -m pip install "release/sdk/deepseek_harness_sdk-$env:DSH_WHEEL_VERSION-py3-none-any.whl" "release/win-x64/deepseek_harness_runtime_bin-$env:DSH_WHEEL_VERSION-py3-none-win_amd64.whl"
    - Remove-Item Env:PYTHONPATH -ErrorAction SilentlyContinue
    - Remove-Item Env:DSH_RUNTIME_MODE -ErrorAction SilentlyContinue
    - $blackbox = Join-Path $env:TEMP "dsh-sdk-blackbox-$([guid]::NewGuid())"
    - New-Item -ItemType Directory -Path $blackbox | Out-Null
    - Push-Location $blackbox
    - try { & "$env:CI_PROJECT_DIR\.wheel-smoke\Scripts\python.exe" "$env:CI_PROJECT_DIR\scripts\smoke-python-runtime.py" --scenario all --installed-wheel } finally { Pop-Location }
  artifacts:
    paths: [release/win-x64/*.whl]
    expire_in: 1 week

publish-python:
  stage: publish
  tags: [linux-x64]
  resource_group: python-release
  needs:
    - job: sdk-wheel
      artifacts: true
    - job: runtime-linux-x64
      artifacts: true
    - job: runtime-linux-arm64
      artifacts: true
    - job: runtime-macos-arm64
      artifacts: true
    - job: runtime-macos-x64
      artifacts: true
    - job: runtime-windows-x64
      artifacts: true
  before_script:
    - python3 -m venv .ci-python
    - . .ci-python/bin/activate
    - export DSH_VERSION="$(python -c 'import json; print(json.load(open("package.json"))["version"])')"
    - export DSH_WHEEL_VERSION="$(python -c 'import runpy; release = runpy.run_path("scripts/build-python-release.py"); print(release["pep440_version"](release["repository_version"]()))')"
    - test "$CI_COMMIT_TAG" = "python-v$DSH_VERSION" || { echo "Tag $CI_COMMIT_TAG does not match package.json version $DSH_VERSION"; exit 1; }
    - python -m pip install twine==6.2.0
  script:
    - test "$(find release -name '*.whl' | wc -l | tr -d ' ')" = 6
    - test -f "release/sdk/deepseek_harness_sdk-${DSH_WHEEL_VERSION}-py3-none-any.whl"
    - test -f "release/linux-x64/deepseek_harness_runtime_bin-${DSH_WHEEL_VERSION}-py3-none-manylinux_2_28_x86_64.whl"
    - test -f "release/linux-arm64/deepseek_harness_runtime_bin-${DSH_WHEEL_VERSION}-py3-none-manylinux_2_28_aarch64.whl"
    - test -f "release/macos-arm64/deepseek_harness_runtime_bin-${DSH_WHEEL_VERSION}-py3-none-macosx_14_0_arm64.whl"
    - test -f "release/macos-x64/deepseek_harness_runtime_bin-${DSH_WHEEL_VERSION}-py3-none-macosx_14_0_x86_64.whl"
    - test -f "release/win-x64/deepseek_harness_runtime_bin-${DSH_WHEEL_VERSION}-py3-none-win_amd64.whl"
    - python -m twine check release/*/*.whl
    - export TWINE_USERNAME=gitlab-ci-token
    - export TWINE_PASSWORD="$CI_JOB_TOKEN"
    - export TWINE_REPOSITORY_URL="$CI_API_V4_URL/projects/$CI_PROJECT_ID/packages/pypi"
    - python -m twine upload --non-interactive release/*/*.whl || { echo 'Publish failed. GitLab does not overwrite an existing version; create a new python-v<repository-version> tag.'; exit 1; }