SEARCH-3102 add semantic search to bdk (#374)

.github/workflows/build.yml

@@ -22,11 +22,11 @@ jobs:
             path: ~\AppData\Local\pypoetry\Cache\virtualenvs
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.2.2
 
       - name: Set up Python ${{ matrix.python-version }}
         id: setup-python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -35,7 +35,7 @@ jobs:
         run: |
           echo "::set-output name=dir::$(pip cache dir)"
       - name: Cache pip dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ${{ steps.pip-cache.outputs.dir }}
           key: ${{ runner.os }}-pip-${{ steps.setup-python.outputs.python-version }}
@@ -44,7 +44,7 @@ jobs:
         run: pip install poetry
 
       - name: Cache poetry
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ${{ matrix.path }}
           key: ${{ runner.os }}-poetry-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('poetry.lock') }}
@@ -58,14 +58,14 @@ jobs:
         timeout-minutes: 10
 
       - name: Upload test results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: pytest-results-${{ matrix.os }}-${{ matrix.python-version }}-${{ github.run_id }}
           path: test-results/junit.xml
         if: ${{ always() }}
 
       - name: Upload test coverage
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: pytest-coverage-${{ matrix.os }}-${{ matrix.python-version }}-${{ github.run_id }}
           path: htmlcov

.github/workflows/cve-scanning-python.yml

@@ -17,8 +17,8 @@ jobs:
     name: Build and test App
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.2.2
+      - uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
         with:
           python-version: "3.10"
       - uses: abatilo/actions-poetry@192395c0d10c082a7c62294ab5d9a9de40e48974
@@ -32,6 +32,29 @@ jobs:
         run: |
           poetry install
       - name: Scan CVEs
-        run: poetry export --without-hashes -f requirements.txt | safety check --full-report --stdin
+        # IDs below mirror .github/workflows/security.yml: all urllib3/aiohttp findings whose
+        # fix requires a version that dropped Python 3.9 support (this project's floor, see
+        # pyproject.toml). Passing -i here (rather than relying only on .safety-policy.yml)
+        # because the -i flag replaces, rather than merges with, the policy file's
+        # ignore-vulnerabilities list when both are used together. Revisit when Python 3.9
+        # support is dropped.
+        run: >
+          poetry export --without-hashes -f requirements.txt | safety check --full-report --stdin
+          -i 96886
+          -i SFTY-20260511-47957
+          -i SFTY-20260615-39401
+          -i SFTY-20260615-18154
+          -i SFTY-20260615-56865
+          -i SFTY-20260615-97789
+          -i SFTY-20260615-89136
+          -i SFTY-20260615-16622
+          -i SFTY-20260615-53053
+          -i SFTY-20260615-28483
+          -i SFTY-20260603-52923
+          -i SFTY-20260603-52285
+          -i SFTY-20260615-45392
+          -i SFTY-20260803-49978
+          -i SFTY-20260803-85786
+          -i SFTY-20260803-45259
         # Without poetry, use this command instead
         # run: safety check -r requirements.txt --full-report --policy-file safety-policy.yml

.github/workflows/e2e-build.yml

@@ -1,18 +1,18 @@
 name: e2e test
 on:
   push:
-    branches: [ "main" ]
+    branches: [ "main", "release/3.x" ]
 
 jobs:
   e2e-test:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.2.2
 
       - name: Set up Python
         id: setup-python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
         with:
           python-version: '3.12'
 
@@ -21,7 +21,7 @@ jobs:
         run: |
           echo "dir=$(pip cache dir)" >> $GITHUB_OUTPUT
       - name: Cache pip dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ${{ steps.pip-cache.outputs.dir }}
           key: ${{ runner.os }}-pip-${{ steps.setup-python.outputs.python-version }}
@@ -33,7 +33,7 @@ jobs:
         run: poetry self add poetry-plugin-export
 
       - name: Cache poetry virtualenv
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ~/.cache/pypoetry/virtualenvs
           key: ${{ runner.os }}-poetry-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('poetry.lock') }}

.github/workflows/license-scanning-python.yml

@@ -15,8 +15,8 @@ jobs:
     name: Scan for licenses
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.2.2
+      - uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
         with:
           python-version: "3.10"
       - name: Install pip-licenses

.github/workflows/linting.yaml

@@ -12,18 +12,18 @@ jobs:
 
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.2.2
 
       - name: Set up Python 3.9
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
         with:
           python-version: 3.9
 
       - name: Install Poetry
         run: pip install poetry
 
       - name: Cache poetry virtualenv
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ~/.cache/pypoetry/virtualenvs
           key: ${{ runner.os }}-poetry-${{ hashFiles('poetry.lock') }}
@@ -34,7 +34,7 @@ jobs:
         run: poetry install
 
       - name: Cache ruff
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: .ruff_cache
           key: ${{ runner.os }}-ruff-${{ github.ref_name }}-${{ hashFiles('poetry.lock') }}

.github/workflows/push.yml

@@ -8,7 +8,7 @@ jobs:
   security:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.2.2
       - name: Run Snyk to check for vulnerabilities
         uses: snyk/actions/python@b98d498629f1c368650224d6d212bf7dfa89e4bf
         env:
@@ -20,13 +20,13 @@ jobs:
   documentation:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.2.2
         with:
           fetch-depth: 0
 
       - name: Set up Python 3.9
         id: setup-python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
         with:
           python-version: 3.9
 
@@ -41,7 +41,7 @@ jobs:
           echo "::set-output name=dir::$(pip cache dir)"
 
       - name: Cache pip dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ${{ steps.pip-cache.outputs.dir }}
           key: ${{ runner.os }}-pip-${{ steps.setup-python.outputs.python-version }}
@@ -50,7 +50,7 @@ jobs:
         run: pip install poetry
 
       - name: Cache poetry
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ~/.cache/pypoetry/virtualenvs
           key: ${{ runner.os }}-poetry-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('poetry.lock') }}

.github/workflows/release.yml

@@ -11,10 +11,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.2.2
 
       - name: Set up Python 3.9
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
         with:
           python-version: 3.9
 

.github/workflows/security.yml

@@ -13,11 +13,11 @@ jobs:
 
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.2.2
 
       - name: Set up Python 3.9
         id: setup-python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
         with:
           python-version: 3.9
 
@@ -27,7 +27,7 @@ jobs:
           echo "::set-output name=dir::$(pip cache dir)"
 
       - name: Cache pip dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ${{ steps.pip-cache.outputs.dir }}
           key: ${{ runner.os }}-pip-${{ steps.setup-python.outputs.python-version }}
@@ -36,7 +36,7 @@ jobs:
         run: pip install poetry
 
       - name: Cache poetry
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ~/.cache/pypoetry/virtualenvs
           key: ${{ runner.os }}-poetry-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('poetry.lock') }}
@@ -47,10 +47,32 @@ jobs:
         run: poetry install
 
       - name: Export dependencies
-        run: poetry export -o requirements.txt
+        run: poetry export -o requirements.txt --only main
 
       - name: Run license checks
         run: poetry run liccheck
 
       - name: Run CVE checks
-        run: poetry run safety check
+        # IDs below are all urllib3/aiohttp findings whose fix requires a version that
+        # dropped Python 3.9 support (this project's floor, see pyproject.toml). Passing
+        # -i here (rather than relying only on .safety-policy.yml) because the -i flag
+        # replaces, rather than merges with, the policy file's ignore-vulnerabilities list
+        # when both are used together. Revisit when Python 3.9 support is dropped.
+        run: >
+          poetry run safety check -r requirements.txt
+          -i 96886
+          -i SFTY-20260511-47957
+          -i SFTY-20260615-39401
+          -i SFTY-20260615-18154
+          -i SFTY-20260615-56865
+          -i SFTY-20260615-97789
+          -i SFTY-20260615-89136
+          -i SFTY-20260615-16622
+          -i SFTY-20260615-53053
+          -i SFTY-20260615-28483
+          -i SFTY-20260603-52923
+          -i SFTY-20260603-52285
+          -i SFTY-20260615-45392
+          -i SFTY-20260803-49978
+          -i SFTY-20260803-85786
+          -i SFTY-20260803-45259

.github/workflows/semgrep.yml

@@ -9,7 +9,7 @@ jobs:
     container:
       image: returntocorp/semgrep
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.2.2
     - run: semgrep scan --error --config auto
       env:
         SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}

.safety-policy.yml

@@ -9,4 +9,12 @@ security: # configuration for the `safety check` command
           #  expires: '2022-10-21' # datetime string - date this ignore will expire, best practice to use this variable
         70612:
             reason: The maintainer and multiple third parties believe that this vulnerability isn't valid because users shouldn't use untrusted templates without sandboxing.
+        96886:
+            reason: Fix requires urllib3>=2.7.0, which dropped Python 3.9 support. This project still supports Python 3.9 (see pyproject.toml), so the fixed version cannot be installed on that interpreter. Revisit when Python 3.9 support is dropped. NOTE this entry is superseded in CI, where -i flags on the safety check command are used instead for this and related IDs (see .github/workflows/security.yml) since -i replaces rather than merges with this list when both are passed.
+        SFTY-20260803-49978:
+            reason: Fix requires aiohttp>=3.14.3, which dropped Python 3.9 support (Requires-Python >=3.10). This project still supports Python 3.9 (see pyproject.toml), so the py3.9 aiohttp constraint (<3.14) cannot pick up the fix. Revisit when Python 3.9 support is dropped. NOTE this entry is superseded in CI, where -i flags on the safety check command are used instead for this and related IDs (see .github/workflows/security.yml) since -i replaces rather than merges with this list when both are passed.
+        SFTY-20260803-85786:
+            reason: Fix requires aiohttp>=3.14.2, which dropped Python 3.9 support (Requires-Python >=3.10). This project still supports Python 3.9 (see pyproject.toml), so the py3.9 aiohttp constraint (<3.14) cannot pick up the fix. Revisit when Python 3.9 support is dropped. NOTE this entry is superseded in CI, where -i flags on the safety check command are used instead for this and related IDs (see .github/workflows/security.yml) since -i replaces rather than merges with this list when both are passed.
+        SFTY-20260803-45259:
+            reason: Fix requires aiohttp>=3.14.2, which dropped Python 3.9 support (Requires-Python >=3.10). This project still supports Python 3.9 (see pyproject.toml), so the py3.9 aiohttp constraint (<3.14) cannot pick up the fix. Revisit when Python 3.9 support is dropped. NOTE this entry is superseded in CI, where -i flags on the safety check command are used instead for this and related IDs (see .github/workflows/security.yml) since -i replaces rather than merges with this list when both are passed.
     continue-on-vulnerability-error: False # Suppress non-zero exit codes when vulnerabilities are found. Enable this in pipelines and CI/CD processes if you want to pass builds that have vulnerabilities

api_client_generation/generate.sh

@@ -4,7 +4,7 @@ code_gen_dir=`pwd`
 project_root=$code_gen_dir/..
 echo $code_gen_dir
 
-commit_hash=64977061b376680aaf09b088877bcaa9c3acc6a8
+commit_hash=baf01bee3bd00612d57d2df481ea54aab9404017
 api_spec_base_url=https://raw.githubusercontent.com/symphonyoss/symphony-api-spec/${commit_hash}
 echo $api_spec_base_url
 

examples/services/messages.py

@@ -9,7 +9,7 @@
 from symphony.bdk.gen.agent_model.message_search_query import MessageSearchQuery
 from symphony.bdk.gen.agent_model.v4_imported_message import V4ImportedMessage
 from symphony.bdk.gen.agent_model.v4_imported_message_attachment import V4ImportedMessageAttachment
-
+from symphony.bdk.core.service.stream.stream_util import to_url_safe_stream_id
 
 async def run():
     stream_id_1 = "lRwCZlDbxWLd2BDP-1D_8n___o0f4ZkEdA"
@@ -61,6 +61,10 @@ async def run():
         )
         await message_service.import_messages([msg])
 
+        results = await message_service.search_messages_semantic("greetings", limit=2)
+        for message in results:
+            logging.info(f"fround a message: {message.message}")
+
         logging.info("Obo example:")
         obo_auth_session = bdk.obo(username="username")
         async with bdk.obo_services(obo_auth_session) as obo_services: