up

src/Sdk/StellaOps.Sdk.Generator/python/README.md

@@ -4,6 +4,7 @@ Deterministic generator settings for the Python SDK (asyncio library).
 
 ## Prereqs
 - `STELLA_OAS_FILE` pointing to the frozen OpenAPI spec.
+- Optional but recommended: `STELLA_OAS_EXPECTED_SHA256` set to the pinned spec hash; the script will verify and emit `.oas.sha256` in the output.
 - OpenAPI Generator CLI 7.4.0 jar at `tools/openapi-generator-cli-7.4.0.jar` (override with `STELLA_OPENAPI_GENERATOR_JAR`).
 - JDK 21 available on PATH (vendored at `../tools/jdk-21.0.1+12`; set `JAVA_HOME` if needed).
 
@@ -12,8 +13,8 @@ Deterministic generator settings for the Python SDK (asyncio library).
 cd src/Sdk/StellaOps.Sdk.Generator
 STELLA_OAS_FILE=ts/fixtures/ping.yaml \
 STELLA_SDK_OUT=$(mktemp -d) \
+STELLA_OAS_EXPECTED_SHA256=$(sha256sum ts/fixtures/ping.yaml | awk '{print $1}') \
 python/generate-python.sh
 ```
 
-Outputs land in `out/python/` and are post-processed to normalize whitespace, inject the banner, and copy shared helpers (`sdk_hooks.py`).
-Override `STELLA_SDK_OUT` to keep the repo clean during local runs.
+Outputs land in `out/python/` and are post-processed to normalize whitespace, inject the banner, copy shared helpers (`sdk_hooks.py`), and write `.oas.sha256` with the spec hash. Override `STELLA_SDK_OUT` to keep the repo clean during local runs.

src/Sdk/StellaOps.Sdk.Generator/python/generate-python.sh

@@ -10,8 +10,27 @@ if [ -z "$spec" ]; then
   exit 1
 fi
 
+compute_sha256() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "$1" | awk '{print $1}'
+  elif command -v shasum >/dev/null 2>&1; then
+    shasum -a 256 "$1" | awk '{print $1}'
+  else
+    echo "No sha256 tool available (install sha256sum or shasum)" >&2
+    exit 1
+  fi
+}
+
+spec_hash=$(compute_sha256 "$spec")
+expected_hash="${STELLA_OAS_EXPECTED_SHA256:-}"
+if [ -n "$expected_hash" ] && [ "$expected_hash" != "$spec_hash" ]; then
+  echo "Spec hash mismatch: expected $expected_hash but got $spec_hash" >&2
+  exit 1
+fi
+
 output_dir="${STELLA_SDK_OUT:-$root_dir/out/python}"
 mkdir -p "$output_dir"
+printf "%s  %s\n" "$spec_hash" "$(basename "$spec")" > "$output_dir/.oas.sha256"
 
 export STELLA_POSTPROCESS_ROOT="$output_dir"
 export STELLA_POSTPROCESS_LANG="python"
@@ -22,6 +41,20 @@ if [ ! -f "$jar" ]; then
   exit 1
 fi
 
+# Prefer vendored JDK when java is absent
+if ! command -v java >/dev/null 2>&1; then
+  vendor_jdk="$root_dir/tools/jdk-21.0.1+12"
+  if [ -d "$vendor_jdk/bin" ]; then
+    export JAVA_HOME="$vendor_jdk"
+    export PATH="$JAVA_HOME/bin:$PATH"
+  fi
+fi
+
+if ! command -v java >/dev/null 2>&1; then
+  echo "java not found; install JDK 21 or provide vendored tools/jdk-21.0.1+12" >&2
+  exit 1
+fi
+
 JAVA_OPTS="${JAVA_OPTS:-} -Dorg.openapitools.codegen.utils.postProcessFile=$root_dir/postprocess/postprocess.sh"
 export JAVA_OPTS
 
@@ -34,4 +67,9 @@ java -jar "$jar" generate \
   --global-property models,apis,supportingFiles \
   -o "$output_dir"
 
+# Ensure shared helpers are present even if upstream post-process hooks were skipped for some files
+if [ -f "$output_dir/stellaops_sdk/__init__.py" ]; then
+  "$root_dir/postprocess/postprocess.sh" "$output_dir/stellaops_sdk/__init__.py"
+fi
+
 echo "Python SDK generated at $output_dir"

src/Sdk/StellaOps.Sdk.Generator/python/test_generate_python.sh

@@ -7,11 +7,34 @@ spec="$root_dir/ts/fixtures/ping.yaml"
 jar_default="$root_dir/tools/openapi-generator-cli-7.4.0.jar"
 jar="${STELLA_OPENAPI_GENERATOR_JAR:-$jar_default}"
 
+compute_sha256() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "$1" | awk '{print $1}'
+  else
+    shasum -a 256 "$1" | awk '{print $1}'
+  fi
+}
+expected_hash=$(compute_sha256 "$spec")
+
 if [ ! -f "$jar" ]; then
   echo "SKIP: generator jar not found at $jar" >&2
   exit 0
 fi
 
+# If java is missing, try vendored JDK in tools/
+if ! command -v java >/dev/null 2>&1; then
+  vendor_jdk="$root_dir/tools/jdk-21.0.1+12"
+  if [ -d "$vendor_jdk/bin" ]; then
+    export JAVA_HOME="$vendor_jdk"
+    export PATH="$JAVA_HOME/bin:$PATH"
+  fi
+fi
+
+if ! command -v java >/dev/null 2>&1; then
+  echo "SKIP: java not on PATH and vendored JDK not found; set JAVA_HOME or install JDK to run this smoke." >&2
+  exit 0
+fi
+
 if ! command -v java >/dev/null 2>&1; then
   echo "SKIP: java not on PATH; set JAVA_HOME to run this smoke." >&2
   exit 0
@@ -23,9 +46,11 @@ trap 'rm -rf "$out_dir"' EXIT
 STELLA_OAS_FILE="$spec" \
 STELLA_SDK_OUT="$out_dir" \
 STELLA_OPENAPI_GENERATOR_JAR="$jar" \
+STELLA_OAS_EXPECTED_SHA256="$expected_hash" \
 "$script"
 
 test -f "$out_dir/stellaops_sdk/__init__.py" || { echo "missing generated package" >&2; exit 1; }
 test -f "$out_dir/sdk_hooks.py" || { echo "missing helper copy" >&2; exit 1; }
+test -f "$out_dir/.oas.sha256" || { echo "missing spec hash output" >&2; exit 1; }
 
 echo "Python generator smoke test passed"