chore: migration

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @alpkom

.github/actions/setup/action.yml

@@ -0,0 +1,60 @@
+name: setup
+description: Checkout repo, set up Python and uv, and install dependencies.
+inputs:
+  token:
+    description: 'GitHub token for checkout (defaults to GITHUB_TOKEN)'
+    default: ${{ github.token }}
+  persist-credentials:
+    description: 'Whether to persist the token in git config after checkout'
+    default: 'false'
+  ref:
+    description: 'Git ref to checkout'
+    default: ''
+  fetch-depth:
+    description: 'Number of commits to fetch (0 = full history)'
+    default: '1'
+  python-version:
+    description: 'Python version'
+    default: '3.13'
+  index-username:
+    description: 'Username for the PyPI index'
+    default: ''
+  index-token:
+    description: 'Auth token for the PyPI index'
+    default: ''
+
+runs:
+  using: composite
+  steps:
+    - name: Checkout repository
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        token: ${{ inputs.token }}
+        persist-credentials: ${{ inputs.persist-credentials }}
+        ref: ${{ inputs.ref }}
+        fetch-depth: ${{ inputs.fetch-depth }}
+
+    - name: Set up Python ${{ inputs.python-version }}
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      with:
+        python-version: ${{ inputs.python-version }}
+
+    - name: Install uv
+      uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 #v8.2.0
+    - name: Install dependencies
+      shell: bash
+      env:
+        INDEX_USERNAME: ${{ inputs.index-username }}
+        INDEX_TOKEN: ${{ inputs.index-token }}
+        IS_FORK: ${{ github.event.pull_request.head.repo.fork == true }}
+      run: |
+        if [[ "$IS_FORK" == "true" ]]; then
+          echo "Fork detected — syncing from PyPI without lockfile"
+          UV_INDEX_URL="https://pypi.org/simple/" \
+            uv sync --all-packages --all-extras
+        else
+          echo "Syncing from Artifactory with lockfile"
+          UV_INDEX_ARTIFACTORY_USERNAME="${INDEX_USERNAME}" \
+          UV_INDEX_ARTIFACTORY_PASSWORD="${INDEX_TOKEN}" \
+            uv sync --all-packages --all-extras --locked
+        fi

.github/dependabot.yml

@@ -0,0 +1,29 @@
+version: 2
+registries:
+  sap-artifactory:
+    type: python-index
+    url: https://common.repositories.cloud.sap/artifactory/api/pypi/build.releases.pypi/
+    username: ${{secrets.DBOT_ARTIFACTORY_USERNAME}}
+    password: ${{secrets.DBOT_ARTIFACTORY_TOKEN}}
+    replaces-base: true
+updates:
+  - package-ecosystem: uv
+    target-branch: 'main'
+    directory: /
+    registries:
+      - sap-artifactory
+    schedule:
+      interval: daily
+      time: '22:00'
+    cooldown:
+      default-days: 5
+    open-pull-requests-limit: 10
+
+  - package-ecosystem: github-actions
+    target-branch: 'main'
+    directory: /
+    schedule:
+      interval: daily
+      time: '22:00'
+    cooldown:
+      default-days: 5

.github/scripts/extract_changelog.py

@@ -0,0 +1,10 @@
+#!/usr/bin/env python3
+import sys
+
+package, version = sys.argv[1], sys.argv[2]
+sections = open(f"packages/{package}/RELEASE_NOTES.md").read().split("## ")
+match = next((s for s in sections if s.startswith(version)), None)
+
+if not match:
+    sys.exit(f"No changelog entry found for version {version}")
+print(match[len(version):].strip())

.github/scripts/update_changelog.py

@@ -0,0 +1,13 @@
+#!/usr/bin/env python3
+import sys
+
+package, version, body = sys.argv[1], sys.argv[2], sys.argv[3]
+path = f"packages/{package}/RELEASE_NOTES.md"
+content = open(path).read()
+sections = content.split("## ")
+match = next((s for s in sections if s.startswith(version)), None)
+
+if not match:
+    sys.exit(f"No changelog entry found for version {version}")
+
+open(path, "w").write(content.replace(match, f"{version}\n\n{body.strip()}\n\n"))

.github/workflows/auto-doc.yml

@@ -0,0 +1,64 @@
+name: auto-doc
+
+on:
+  pull_request: ~
+  workflow_dispatch: ~
+
+jobs:
+  doc:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    if: github.event.pull_request.head.repo.fork == false
+
+    steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        with:
+          client-id: ${{ secrets.SAP_AI_SDK_BOT_CLIENT_ID }}
+          private-key: ${{ secrets.SAP_AI_SDK_BOT_PRIVATE_KEY }}
+          permission-contents: write
+
+      - name: Setup
+        uses: SAP/ai-sdk-python/.github/actions/setup@os-migration
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          persist-credentials: true
+          ref: ${{ github.head_ref }}
+          index-username: ${{ secrets.ARTIFACTORY_USERNAME }}
+          index-token: ${{ secrets.ARTIFACTORY_TOKEN }}
+
+      - name: Configure git
+        env:
+          BOT_EMAIL: ${{ vars.SAP_AI_SDK_BOT_EMAIL }}
+          BOT_NAME: ${{ vars.SAP_AI_SDK_BOT_NAME }}
+        run: |
+          git config --local user.email "$BOT_EMAIL"
+          git config --local user.name "$BOT_NAME"
+
+      - name: Generate docs
+        run: |
+          generate_docs() {
+            (
+              cd packages/$1/docs
+              rm -f *.html
+              uv run python -m pydoc -w ../ || true
+            )
+          }
+
+          generate_docs base
+          generate_docs core
+          generate_docs gen
+
+      - name: Commit and push
+        env:
+          HEAD_REF: ${{ github.head_ref }}
+        run: |
+          git add packages/base/docs packages/core/docs packages/gen/docs
+          if git diff --cached --quiet; then
+            echo "No documentation changes to commit"
+          else
+            git commit -m "docs: update pydoc3 documentation [skip ci]"
+            git push origin HEAD:"$HEAD_REF"
+          fi

.github/workflows/blackduck.yml

@@ -0,0 +1,67 @@
+name: blackduck
+
+on:
+  schedule:
+    - cron: '0 3 * * *'
+  workflow_dispatch:
+    inputs:
+      branch:
+        description: 'Branch to scan (defaults to default branch).'
+        required: false
+        type: string
+
+permissions: {}
+
+env:
+  BLACKDUCK_SKIP_PHONE_HOME: true
+
+jobs:
+  blackduck-scan:
+    name: blackduck scan
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    timeout-minutes: 15
+
+    steps:
+      - name: Determine project version
+        id: version
+        env:
+          INPUT_BRANCH: ${{ github.event.inputs.branch }}
+        run: |
+          if [ -n "$INPUT_BRANCH" ]; then
+            VERSION="$INPUT_BRANCH"
+          else
+            VERSION="main"
+          fi
+          echo "Black Duck project version: $VERSION"
+          echo "project_version=$VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Checkout repository at project version
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ steps.version.outputs.project_version }}
+          persist-credentials: false
+
+      - name: Run Black Duck SCA scan
+        uses: blackduck-inc/black-duck-security-scan@3fe94e4b3c3947bd21ba46b7da255d6d3638b325 # v2.10.0
+        with:
+          blackducksca_url: https://sap.blackducksoftware.com
+          blackducksca_token: ${{ secrets.BLACKDUCK_API_TOKEN }}
+          blackducksca_scan_full: true
+          blackducksca_scan_failure_severities: 'BLOCKER,CRITICAL'
+          blackducksca_reports_sarif_create: true
+          blackducksca_reports_sarif_severities: 'BLOCKER,CRITICAL'
+          blackducksca_reports_sarif_groupSCAIssues: true
+          blackducksca_upload_sarif_report: true
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          detect_args: >-
+            --detect.project.name="${{ vars.BLACKDUCK_PROJECT_NAME }}"
+            --detect.project.version.name="${{ steps.version.outputs.project_version }}"
+            --detect.project.user.groups="${{ vars.BLACKDUCK_PROJECT_GROUP }}"
+            --detect.code.location.name="${{ vars.BLACKDUCK_PROJECT_NAME }}/${{ steps.version.outputs.project_version }}"
+            --detect.blackduck.signature.scanner.memory=4096
+            --detect.timeout=6000
+            --detect.blackduck.signature.scanner.arguments="--min-scan-interval=0"
+            --detect.excluded.directories='**/__pycache__,**/.venv,**/venv,**/env,**/dist,**/build,**/*.egg-info,**/test,**/tests,**/coverage'

.github/workflows/bump.yml

@@ -0,0 +1,49 @@
+name: bump
+
+on:
+  workflow_dispatch:
+    inputs:
+      package:
+        description: 'Package to bump'
+        required: true
+        type: choice
+        options:
+          - base
+          - core
+          - gen
+
+jobs:
+  bump:
+    runs-on: ubuntu-latest
+    permissions: {}
+    steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        with:
+          client-id: ${{ secrets.SAP_AI_SDK_BOT_CLIENT_ID }}
+          private-key: ${{ secrets.SAP_AI_SDK_BOT_PRIVATE_KEY }}
+          permission-contents: write
+
+      - name: Setup
+        uses: SAP/ai-sdk-python/.github/actions/setup@os-migration
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          persist-credentials: true
+          fetch-depth: 0
+
+      - name: Configure git
+        run: |
+          git config --local user.email "${{ vars.SAP_AI_SDK_BOT_EMAIL }}"
+          git config --local user.name "${{ vars.SAP_AI_SDK_BOT_NAME }}"
+
+      - name: Bump versions and generate changelogs
+        working-directory: packages/${{ inputs.package }}
+        run: uv run cz bump --changelog
+
+      - name: Push
+        working-directory: packages/${{ inputs.package }}
+        run: |
+          VERSION=$(uv run cz version --project)
+          git push origin main
+          git push origin "${{ inputs.package }}-v${VERSION}"