ci.yml

# NOTES:
# - The map syntax used for matrix is flagged red but actually works
# - This runs everything in Python 3.12, except the fulltest which is also run in 3.10
# - Only coretest and fulltest environments are cached due to space limit

name: Continuous Integration
on:
  push:
    branches:
      - main
      - 'dev/**'
  pull_request:
    branches:
      - main
      - 'dev/**'
  workflow_dispatch:

env:
  COVERAGE_OVERALL_THRESH: 70      # threshold for overall coverage check
  COVERAGE_INDIVIDUAL_THRESH: 45   # threshold for individual coverage check

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  changelog:
    name: "Changelog"
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'pull_request' }}
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
      - name: Assert Changelog Edit
        run: |
          git fetch origin main:main
          NUM_ADDED=`git diff --numstat main HEAD CHANGELOG.md | cut -d$'\t' -f1`
          echo "Changelog differences: $NUM_ADDED"
          if [ "$NUM_ADDED" -gt "0" ]; then
            echo "SUCCESS"
            exit 0
          else
            echo "ERROR - Nothing has been added to CHANGELOG.md"
            exit 1
          fi

  reminder:
    runs-on: ubuntu-latest
    name: "Reminder"
    continue-on-error: true
    permissions:
      issues: write
    steps:
      - name: check reminders and notify
        uses: agrc/reminder-action@v1

  lockfiles:
    runs-on: ubuntu-latest
    name: "Lockfiles"
    env: 
      TARGET_DOCS_LOCKFILE_PATH: .lockfiles/py310-dev.lock
      DOCS_LOCKFILE_PATH: /tmp/lockfile
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        id: setup-python
        with:
          python-version: '3.10'
      - name:  Verify lockfile integrity 
        run: |
          git fetch origin main:main
          if git diff --name-only origin/main -- pyproject.toml | grep -q pyproject.toml; then
            echo "pyproject.toml has been modified compared to the main branch."
            echo "Lockfile might need to be updated."
            exit 1
          fi

  lint:
    strategy:
      matrix:
        py-version: [ {semantic: '3.12', tox: 'py312'} ]
    name: Lint ${{ matrix.py-version.semantic }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        id: setup-python
        with:
          python-version: ${{ matrix.py-version.semantic }}
      - name: Run linting
        run: |
          pip install tox-uv
          tox -e lint-${{ matrix.py-version.tox }}

  build-docs:
    name: "Build Docs"
    runs-on: ubuntu-latest
    needs: [lint]
    permissions:
      contents: read
      pages: write
      id-token: write
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: {python-version: "3.10"}
      - name: Build Docs
        run: |
          pip install tox-uv
          tox -e docs-py310 -- -r
          
  typecheck:
    needs: [lint]
    strategy:
      matrix:
        py-version: [ {semantic: '3.12', tox: 'py312'} ]
    name: Type Check ${{ matrix.py-version.semantic }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        id: setup-python
        with:
          python-version: ${{ matrix.py-version.semantic }}
      - name: Run type check
        run: |
          pip install tox-uv
          tox -e mypy-${{ matrix.py-version.tox }}

  audit:
    needs: [lint]
    strategy:
      matrix:
        py-version: [ {semantic: '3.12', tox: 'py312'} ]
    name: Audit ${{ matrix.py-version.semantic }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        id: setup-python
        with:
          python-version: ${{ matrix.py-version.semantic }}
      - name: Run pip-audit
        run: |
          pip install tox-uv
          tox -e audit-${{ matrix.py-version.tox }}

  coretest:
    needs: [typecheck, audit]
    strategy:
      matrix:
        py-version: [ {semantic: '3.10', tox: 'py310'} ]
    name: Core Tests ${{ matrix.py-version.semantic }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        id: setup-python
        with:
          python-version: ${{ matrix.py-version.semantic }}
      - uses: actions/cache@v4
        with:
          path: .tox/coretest-${{ matrix.py-version.tox }}
          key: coretest-${{ matrix.py-version.tox }}-${{ hashFiles('pyproject.toml') }}-${{ hashFiles('tox.ini') }}
      - name: Run core tests
        run: |
          pip install tox-uv
          tox -e coretest-${{ matrix.py-version.tox }}

  fulltest:
    needs: [typecheck, audit]
    strategy:
      matrix:
        py-version: [ {semantic: '3.10', tox: 'py310'}, {semantic: '3.12', tox: 'py312'} ]
    name: Full Tests ${{ matrix.py-version.semantic }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        id: setup-python
        with:
          python-version: ${{ matrix.py-version.semantic }}
      - uses: actions/cache@v4
        with:
          path: .tox/fulltest-${{ matrix.py-version.tox }}
          key: fulltest-${{ matrix.py-version.tox }}-${{ hashFiles('pyproject.toml') }}-${{ hashFiles('tox.ini') }}
      - name: Run full tests
        run: |
          pip install tox-uv
          tox -e fulltest-${{ matrix.py-version.tox }} -- --cov-report=xml
      - name: "Assert Overall Coverage"
        run: |
          pip install coverage
          coverage report --fail-under=${{ env.COVERAGE_OVERALL_THRESH }}
      - name: "Assert Individual Coverage"
        shell: bash
        run: |
          coverage report |
          grep -E -o '[0-9]+%' |
          tr -d '%' |
          sed '$d' |
          awk '{if ( $1<${{ env.COVERAGE_INDIVIDUAL_THRESH }} ) exit 1 }'