Merge remote-tracking branch 'origin/main' into issue5826/empty-openai-apikey-guard

Author: feiiiiii5

.github/.release-please-manifest.json

@@ -5,6 +5,6 @@
   "python-sdk": "1.0.0",
   "mcp-server": "1.0.0",
   "langevals": "2.2.0",
-  ".": "3.5.0",
+  ".": "3.6.0",
   "skills": "1.0.0"
 }

.github/actions/detect-changes/action.yml

@@ -4,7 +4,9 @@
 # base using dorny/paths-filter. On every other event (push, schedule,
 # workflow_dispatch, merge_group) we force every declared filter to
 # `true` so the real jobs always run — required aggregator checks need
-# a concrete result.
+# a concrete result. Exception: with `push-strategy: diff` a push is
+# diffed against its before-commit instead of force-run, for workflows
+# whose real jobs spend money on live LLM calls.
 #
 # The caller MUST check out the repo first so this composite action is
 # accessible — dorny/paths-filter then reads the diff against the PR
@@ -41,29 +43,44 @@ inputs:
   filters:
     description: YAML filter block for dorny/paths-filter (must define `relevant` + `feature-parity` filters).
     required: true
+  push-strategy:
+    description: >-
+      How push events are treated. 'force' (default) marks every filter
+      true so the real jobs always run post-merge. 'diff' diffs the push
+      against its before-commit with dorny/paths-filter instead, so
+      workflows whose real jobs spend money (live LLM calls) only run
+      them when the push actually touched relevant paths.
+    required: false
+    default: force
 outputs:
   relevant:
-    description: "'true' if relevant paths changed, or if event is not a PR."
+    description: "'true' if relevant paths changed, or if the event is neither a PR nor a diff-mode push."
     value: ${{ steps.filter.outputs.relevant || steps.force.outputs.relevant }}
   feature-parity:
-    description: "'true' if feature-parity-relevant paths changed, or if event is not a PR."
+    description: "'true' if feature-parity-relevant paths changed, or if the event is neither a PR nor a diff-mode push."
     value: ${{ steps.filter.outputs.feature-parity || steps.force.outputs.feature-parity }}
   lambda-image:
-    description: "'true' if Lambda-image-relevant paths changed, or if event is not a PR. Used by langwatch-nlp-ci's LWA-readiness job — covers Go-binary source + Dockerfile + entrypoint, which aren't matched by the Python-only `relevant` filter."
+    description: "'true' if Lambda-image-relevant paths changed, or if the event is neither a PR nor a diff-mode push. Used by langwatch-nlp-ci's LWA-readiness job — covers Go-binary source + Dockerfile + entrypoint, which aren't matched by the Python-only `relevant` filter."
     value: ${{ steps.filter.outputs.lambda-image || steps.force.outputs.lambda-image }}
 
 runs:
   using: composite
   steps:
     - name: Detect relevant changes
-      if: github.event_name == 'pull_request' || github.event_name == 'pull_request_target'
+      if: >-
+        github.event_name == 'pull_request'
+        || github.event_name == 'pull_request_target'
+        || (github.event_name == 'push' && inputs.push-strategy == 'diff')
       id: filter
       uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
       with:
         filters: ${{ inputs.filters }}
 
     - name: Force every filter true on non-PR events
-      if: github.event_name != 'pull_request' && github.event_name != 'pull_request_target'
+      if: >-
+        github.event_name != 'pull_request'
+        && github.event_name != 'pull_request_target'
+        && (github.event_name != 'push' || inputs.push-strategy != 'diff')
       id: force
       shell: bash
       run: |

.github/release-please-config.json

@@ -295,11 +295,6 @@
         }
       ],
       "extra-files": [
-        {
-          "type": "toml",
-          "path": "pyproject.toml",
-          "jsonpath": "$.project.version"
-        },
         {
           "type": "yaml",
           "path": "charts/langwatch/Chart.yaml",

.github/workflows/deployment-impact-check.yml

@@ -25,6 +25,18 @@ permissions:
 
 jobs:
   check:
+    # Release PRs are exempt. release-please writes their description itself
+    # from the changelog, so there is no author to fill the section in, and the
+    # operator impact of everything the release carries was already stated on
+    # the PRs that composed it.
+    #
+    # Same-repo only: a fork can name its branch anything, and the branch name
+    # alone would let it opt out of the gate. release-please only ever opens
+    # PRs from inside the upstream repo, matching the guard in
+    # release-please-chart-lock-sync.yml.
+    if: |
+      !(github.event.pull_request.head.repo.full_name == github.repository &&
+        startsWith(github.head_ref, 'release-please--'))
     runs-on: ubuntu-latest
     steps:
       - name: Verify deployment-impact section in PR description

.github/workflows/go-services.yaml

@@ -195,7 +195,12 @@ jobs:
 
       - name: Assert gateway subchart renders under the umbrella
         run: |
-          if ! grep -q "app.kubernetes.io/name: gateway" /tmp/umbrella.yaml; then
+          # Assert on the Source marker helm stamps on every rendered file, not on
+          # the gateway's pod label: sibling charts legitimately SELECT that label
+          # (langyagent's NetworkPolicy has an egress rule to the gateway), so a
+          # label grep answers "does anything mention the gateway", not "did the
+          # subchart render".
+          if ! grep -q "^# Source: langwatch/charts/gateway/" /tmp/umbrella.yaml; then
             echo "umbrella chart did NOT include the gateway subchart — dependency broken?"
             exit 1
           fi
@@ -204,14 +209,50 @@ jobs:
             exit 1
           fi
 
+      - name: Assert the gateway follows the release name to the control plane
+        working-directory: charts/langwatch
+        run: |
+          # A fixed control-plane address resolves only on an install named the
+          # same as ours, and the failure is silent: every pod healthy, then
+          # every virtual-key request refused. Render under a release name that
+          # is deliberately NOT "langwatch" so a hardcoded default cannot pass.
+          helm template lw . --set autogen.enabled=true --dry-run > /tmp/umbrella-lw.yaml
+          if ! grep -q 'LW_GATEWAY_BASE_URL: "http://lw-app:5560"' /tmp/umbrella-lw.yaml; then
+            echo "gateway control-plane URL does not follow the release name:"
+            grep "LW_GATEWAY_BASE_URL" /tmp/umbrella-lw.yaml || echo "  (not rendered at all)"
+            exit 1
+          fi
+
+          # An address the operator set is theirs, not a starting point.
+          helm template lw . --set autogen.enabled=true \
+            --set gateway.controlPlane.baseUrl=http://elsewhere.internal:9000 --dry-run \
+            > /tmp/umbrella-cp-override.yaml
+          if ! grep -q 'LW_GATEWAY_BASE_URL: "http://elsewhere.internal:9000"' /tmp/umbrella-cp-override.yaml; then
+            echo "an explicit gateway.controlPlane.baseUrl was overridden by the derived one"
+            exit 1
+          fi
+
+          # The derivation can only assume the default app port, so an app moved
+          # off it has to be refused rather than silently dialled.
+          if helm template lw . --set autogen.enabled=true --set app.service.port=8080 --dry-run \
+            > /tmp/umbrella-cp-port.yaml 2>&1; then
+            echo "a non-default app.service.port with no gateway.controlPlane.baseUrl should fail to render"
+            exit 1
+          fi
+          if ! grep -q "gateway.controlPlane.baseUrl" /tmp/umbrella-cp-port.yaml; then
+            echo "the refusal does not name the value that fixes it:"
+            cat /tmp/umbrella-cp-port.yaml
+            exit 1
+          fi
+
       - name: helm template (umbrella gateway disabled)
         working-directory: charts/langwatch
         run: |
           helm template langwatch . --set autogen.enabled=true --set gateway.chartManaged=false --dry-run > /tmp/umbrella-no-gw.yaml
 
       - name: Assert opt-out drops the gateway
         run: |
-          if grep -q "app.kubernetes.io/name: gateway" /tmp/umbrella-no-gw.yaml; then
+          if grep -q "^# Source: langwatch/charts/gateway/" /tmp/umbrella-no-gw.yaml; then
             echo "gateway.chartManaged=false should suppress the subchart"
             exit 1
           fi

.github/workflows/langevals-ci.yml

@@ -28,6 +28,9 @@ jobs:
       - uses: ./.github/actions/detect-changes
         id: detect
         with:
+          # push-strategy diff: the test job spends real LLM money, so it
+          # must not run on pushes that touched nothing under langevals/.
+          push-strategy: diff
           filters: |
             relevant:
               - 'langevals/**'

.github/workflows/langwatch-chart.yml

@@ -41,10 +41,10 @@ jobs:
             flags: "--set autogen.enabled=true -f examples/overlays/size-prod.yaml -f examples/overlays/access-ingress.yaml"
           - name: ha+ingress+replicated
             flags: "--set autogen.enabled=true -f examples/overlays/size-ha.yaml -f examples/overlays/access-ingress.yaml -f examples/overlays/clickhouse-replicated.yaml"
-          - name: langy
-            flags: "--set autogen.enabled=true -f examples/overlays/langy-assistant.yaml"
-          - name: langy+unsandboxed
-            flags: "--set autogen.enabled=true -f examples/overlays/langy-assistant.yaml -f examples/overlays/langy-assistant-unsandboxed.yaml"
+          - name: langy-gvisor
+            flags: "--set autogen.enabled=true -f examples/overlays/langy-gvisor.yaml"
+          - name: langy-disabled
+            flags: "--set autogen.enabled=true -f examples/overlays/langy-disabled.yaml"
           - name: prod+external-ch
             flags: "--set autogen.enabled=true -f examples/overlays/size-prod.yaml -f examples/overlays/clickhouse-external.yaml"
           - name: prod+ext-pg+ext-redis

.github/workflows/mcp-javascript-ci.yml

@@ -27,12 +27,17 @@ jobs:
       - uses: ./.github/actions/detect-changes
         id: detect
         with:
+          # push-strategy diff + no release-please-manifest entry: the
+          # integration step spends real LLM money (Anthropic), so it must
+          # not run on pushes or release PRs that touched nothing under
+          # mcp-server/. A release PR still matches via
+          # mcp-server/CHANGELOG.md.
+          push-strategy: diff
           filters: |
             relevant:
               - 'mcp-server/**'
               - '.github/workflows/mcp-javascript-ci.yml'
               - '.github/actions/setup-pnpm-node/**'
-              - '.github/.release-please-manifest.json'
 
   typecheck:
     needs: changes

.github/workflows/sdk-go-ci.yml

@@ -27,11 +27,15 @@ jobs:
       - uses: ./.github/actions/detect-changes
         id: detect
         with:
+          # push-strategy diff + no release-please-manifest entry: the test
+          # job spends real LLM money, so it must not run on pushes or
+          # release PRs that touched nothing under sdk-go/. An SDK release
+          # PR still matches via sdk-go/CHANGELOG.md.
+          push-strategy: diff
           filters: |
             relevant:
               - 'sdk-go/**'
               - '.github/workflows/sdk-go-ci.yml'
-              - '.github/.release-please-manifest.json'
 
   test:
     needs: changes

.github/workflows/sdk-javascript-cd.yml

@@ -41,7 +41,11 @@ jobs:
       - name: Run tests
         working-directory: ./typescript-sdk
         env:
-          OPENAI_API_KEY: ${{ secrets.TYPESCRIPT_SDK_OPENAI_API_KEY }}
+          # OpenAI traffic rides the LangWatch AI Gateway (virtual key +
+          # gateway base URL), same as sdk-javascript-ci.yml.
+          OPENAI_API_KEY: ${{ secrets.TYPESCRIPT_SDK_GATEWAY_VIRTUAL_KEY }}
+          OPENAI_BASE_URL: https://gateway.langwatch.ai/v1
+          OPENAI_API_BASE: https://gateway.langwatch.ai/v1
           LANGWATCH_ENDPOINT: ${{ secrets.TYPESCRIPT_SDK_LANGWATCH_ENDPOINT }}
           LANGWATCH_API_KEY: ${{ secrets.TYPESCRIPT_SDK_LANGWATCH_API_KEY }}
         run: pnpm test