V0.1.x sync

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,37 +1,38 @@
 ## Description
-[Provide a detailed description of the changes in this PR]
+<!-- Provide a detailed description of the changes in this PR -->
 
 ## Related Issues
-[Link to related issues using #issue-number format]
+
+<!-- Link to related issues using #issue-number format -->
 
 ## Documentation PR
-[Link to related associated PR in the agent-docs repo]
+
+<!-- Link to related associated PR in the agent-docs repo -->
 
 ## Type of Change
-- Bug fix
-- New feature
-- Breaking change
-- Documentation update
-- Other (please describe):
 
-[Choose one of the above types of changes]
+<!-- Choose one of the following types of changes, delete the rest -->
 
+Bug fix
+New feature
+Breaking change
+Documentation update
+Other (please describe):
 
 ## Testing
-[How have you tested the change?]
 
-* `hatch fmt --linter`
-* `hatch fmt --formatter`
-* `hatch test --all`
-* Verify that the changes do not break functionality or introduce warnings in consuming repositories: agents-docs, agents-tools, agents-cli
+How have you tested the change?  Verify that the changes do not break functionality or introduce warnings in consuming repositories: agents-docs, agents-tools, agents-cli
 
+- [ ] I ran `hatch run prepare`
 
 ## Checklist
 - [ ] I have read the CONTRIBUTING document
-- [ ] I have added tests that prove my fix is effective or my feature works
+- [ ] I have added any necessary tests that prove my fix is effective or my feature works
 - [ ] I have updated the documentation accordingly
-- [ ] I have added an appropriate example to the documentation to outline the feature
+- [ ] I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
 - [ ] My changes generate no new warnings
 - [ ] Any dependent changes have been merged and published
 
+----
+
 By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

.github/workflows/integration-test.yml

@@ -0,0 +1,74 @@
+name: Secure Integration test
+
+on:
+  pull_request_target:
+    branches: main
+
+jobs:
+  authorization-check:
+    permissions: read-all
+    runs-on: ubuntu-latest
+    outputs: 
+      approval-env: ${{ steps.collab-check.outputs.result }}
+    steps:
+      - name: Collaborator Check
+        uses: actions/github-script@v7
+        id: collab-check
+        with:
+          result-encoding: string
+          script: | 
+            try {
+              const permissionResponse = await github.rest.repos.getCollaboratorPermissionLevel({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                username: context.payload.pull_request.user.login,
+              });
+              const permission = permissionResponse.data.permission;
+              const hasWriteAccess = ['write', 'admin'].includes(permission);
+              if (!hasWriteAccess) {
+                console.log(`User ${context.payload.pull_request.user.login} does not have write access to the repository (permission: ${permission})`);
+                return "manual-approval"
+              } else {
+                console.log(`Verifed ${context.payload.pull_request.user.login} has write access. Auto Approving PR Checks.`)
+                return "auto-approve"
+              }             
+            } catch (error) {
+              console.log(`${context.payload.pull_request.user.login} does not have write access. Requiring Manual Approval to run PR Checks.`)
+              return "manual-approval"
+            }
+  check-access-and-checkout:
+    runs-on: ubuntu-latest
+    needs: authorization-check
+    environment: ${{ needs.authorization-check.outputs.approval-env }}
+    permissions:
+      id-token: write
+      pull-requests: read
+      contents: read
+    steps:
+      - name: Configure Credentials 
+        uses: aws-actions/configure-aws-credentials@v4
+        with: 
+         role-to-assume: ${{ secrets.STRANDS_INTEG_TEST_ROLE }}
+         aws-region: us-east-1
+         mask-aws-account-id: true
+      - name: Checkout head commit
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }} # Pull the commit from the forked repo
+          persist-credentials: false  # Don't persist credentials for subsequent actions
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.10'
+      - name: Install dependencies
+        run: |
+          pip install --no-cache-dir hatch
+      - name: Run integration tests
+        env:
+          AWS_REGION: us-east-1
+          AWS_REGION_NAME: us-east-1 # Needed for LiteLLM
+        id: tests
+        run: |
+          hatch test tests-integ
+
+

.github/workflows/pr-and-push.yml

@@ -0,0 +1,19 @@
+name: Pull Request and Push Action
+
+on:
+  pull_request:  # Safer than pull_request_target for untrusted code
+    branches: [ main ]
+    types: [opened, synchronize, reopened, ready_for_review, review_requested, review_request_removed]
+  push:
+    branches: [ main ]  # Also run on direct pushes to main
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  call-test-lint:
+    uses: ./.github/workflows/test-lint.yml
+    permissions:
+      contents: read
+    with:
+      ref: ${{ github.event.pull_request.head.sha }}

.github/workflows/pypi-publish-on-release.yml

@@ -0,0 +1,82 @@
+name: Publish Python Package
+
+on:
+  release:
+    types:
+      - published
+
+jobs:
+  call-test-lint:
+    uses: ./.github/workflows/test-lint.yml
+    permissions:
+      contents: read
+    with:
+      ref: ${{ github.event.release.target_commitish }}
+
+  build:
+    name: Build distribution 📦
+    permissions:
+      contents: read
+    needs:
+      - call-test-lint
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
+
+    - name: Set up Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: '3.10'
+
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        pip install hatch twine
+
+    - name: Validate version
+      run: |
+        version=$(hatch version)
+        if [[ $version =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Valid version format"
+            exit 0
+        else
+            echo "Invalid version format"
+            exit 1
+        fi
+
+    - name: Build
+      run: |
+        hatch build
+
+    - name: Store the distribution packages
+      uses: actions/upload-artifact@v4
+      with:
+        name: python-package-distributions
+        path: dist/
+
+  deploy:
+    name: Upload release to PyPI
+    needs:
+    - build
+    runs-on: ubuntu-latest
+
+    # environment is used by PyPI Trusted Publisher and is strongly encouraged
+    # https://docs.pypi.org/trusted-publishers/adding-a-publisher/
+    environment:
+      name: pypi
+      url: https://pypi.org/p/strands-agents
+    permissions:
+      # IMPORTANT: this permission is mandatory for Trusted Publishing
+      id-token: write
+
+    steps:
+    - name: Download all the dists
+      uses: actions/download-artifact@v4
+      with:
+        name: python-package-distributions
+        path: dist/
+    - name: Publish distribution 📦 to PyPI
+      uses: pypa/gh-action-pypi-publish@release/v1

.github/workflows/test-lint-pr.yml → .github/workflows/test-lint.yml

@@ -1,14 +1,11 @@
 name: Test and Lint
 
 on:
-  pull_request:  # Safer than pull_request_target for untrusted code
-    branches: [ main ]
-    types: [opened, synchronize, reopened, ready_for_review, review_requested, review_request_removed]
-  push:
-    branches: [ main ]  # Also run on direct pushes to main
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+  workflow_call:
+    inputs:
+      ref:
+        required: true
+        type: string
 
 jobs:
   unit-test:
@@ -56,7 +53,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.pull_request.head.sha }}  # Explicitly define which commit to check out
+          ref: ${{ inputs.ref }}  # Explicitly define which commit to check out
           persist-credentials: false  # Don't persist credentials for subsequent actions
       - name: Set up Python
         uses: actions/setup-python@v5
@@ -78,7 +75,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
+          ref: ${{ inputs.ref }}
           persist-credentials: false
 
       - name: Set up Python

.gitignore

@@ -7,4 +7,5 @@ __pycache__*
 .pytest_cache
 .ruff_cache
 *.bak
-.vscode
+.vscode
+dist

README.md

@@ -123,6 +123,7 @@ from strands.models.llamaapi import LlamaAPIModel
 bedrock_model = BedrockModel(
   model_id="us.amazon.nova-pro-v1:0",
   temperature=0.3,
+  streaming=True, # Enable/disable streaming
 )
 agent = Agent(model=bedrock_model)
 agent("Tell me about Agentic AI")