python-check.yaml

name: Python Check
run-name: "${{ github.actor }} checking Python code"

permissions:
  contents: read
  pull-requests: read

"on":
  pull_request:
  push:
    branches: ["release/*"]
  workflow_dispatch:
    inputs:
      ref:
        description: "The branch, ref, or SHA to checkout. Defaults to the repository's default branch."
        required: false
        type: string
  workflow_call:
    inputs:
      checkout-path:
        description: "Path to check out code to"
        required: false
        type: string
      skip-relevance-check:
        description: "Bypass relevance check"
        required: false
        type: boolean
        default: false
      pr-base-sha:
        description: "Base SHA of the PR for relevance check"
        required: false
        type: string
      pr-head-sha:
        description: "Head SHA of the PR for relevance check"
        required: false
        type: string
      ref:
        description: "The branch, ref, or SHA to checkout"
        required: false
        type: string
      repo:
        description: "The repository to checkout from"
        required: false
        type: string

jobs:
  setup:
    runs-on: ubuntu-latest
    outputs:
      is_act: ${{ steps.setup.outputs.is_act }}
      ref: ${{ steps.setup.outputs.ref }}
      repo: ${{ steps.setup.outputs.repo }}
      base_sha: ${{ steps.setup.outputs.base_sha }}
      pr_number: ${{ steps.setup.outputs.pr_number }}
      checkout_path: ${{ steps.setup.outputs.checkout_path }}
      has_changes: ${{ steps.setup.outputs.has_changes }}
    steps:
      - name: Workflow setup
        id: setup
        uses: Framework-R-D/action-workflow-setup@f73307dd8c13cb66c2565c9ace32571517b1cea8 # v1
        with:
          file-type: |
            python
            yaml
          include-globs: |
            scripts/**
            ci/**
            .devcontainer/**
          head-ref: ${{ inputs.pr-head-sha }}
          ref: ${{ inputs.ref }}
          repo: ${{ inputs.repo }}
          pr-base-sha: ${{ inputs.pr-base-sha }}
          checkout-path: ${{ inputs.checkout-path }}

  python-check:
    needs: setup
    if: >
      always() && (
        github.event_name == 'workflow_dispatch' ||
        inputs.skip-relevance-check ||
        needs.setup.outputs.has_changes == 'true'
      )
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref:
            ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || needs.setup.outputs.ref }}
          path: ${{ needs.setup.outputs.checkout_path }}
          repository:
            ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name ||
            needs.setup.outputs.repo }}
          persist-credentials: false

      - name: Install uv
        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2

      - name: Install Python dependencies
        run: uv tool install ruff && uv tool install mypy --with types-PyYAML

      - name: Run ruff check
        id: ruff
        working-directory: ${{ needs.setup.outputs.checkout_path }}
        env:
          FORCE_COLOR: 1
        run: |
          echo "➡️ Checking Python code with ruff..."
          ruff check
        continue-on-error: true

      - name: Run MyPy check
        id: mypy
        working-directory: ${{ needs.setup.outputs.checkout_path }}
        run: |
          echo "➡️ Checking Python code with MyPy..."
          mypy --color-output .
        continue-on-error: true

      - name: Evaluate Python checks result
        if: always() && (steps.ruff.outcome != 'skipped' || steps.mypy.outcome != 'skipped')
        env:
          REPO: ${{ needs.setup.outputs.repo }}
        # yamllint disable rule:line-length
        run: |
          REPO_NAME="${REPO##*/}"
          if [ "${{ steps.ruff.outcome }}" = 'success' ] && [ "${{ steps.mypy.outcome }}" = 'success' ]; then
            echo "✅ Python checks passed."
          else
            echo "::error::Python checks failed. Comment '@${REPO_NAME}bot python-fix' on the PR to attempt auto-fix."
            exit 1
          fi
        # yamllint enable

  scripts-test:
    needs: setup
    if: >
      always() && (
        github.event_name == 'workflow_dispatch' ||
        inputs.skip-relevance-check ||
        needs.setup.outputs.has_changes == 'true'
      )
    strategy:
      fail-fast: false
      matrix:
        arch:
          - amd64
          - arm64
        include:
          - arch: amd64
            runner: ubuntu-24.04
          - arch: arm64
            runner: ubuntu-24.04-arm
    runs-on: ${{ matrix.runner }}
    permissions:
      contents: read
    env:
      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref:
            ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || needs.setup.outputs.ref }}
          path: ${{ needs.setup.outputs.checkout_path }}
          repository:
            ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name ||
            needs.setup.outputs.repo }}
          persist-credentials: false

      - name: Install uv
        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2

      - name: Run scripts unit tests with coverage
        working-directory: ${{ needs.setup.outputs.checkout_path }}
        run: |
          echo "➡️ Running scripts/ unit tests with coverage..."
          uv run --python 3.12 --with pytest --with PyYAML --with pytest-cov \
            pytest scripts/test/ -v \
            --cov=scripts \
            --cov=ci \
            --cov=.devcontainer \
            --cov-report="xml:${GITHUB_WORKSPACE}/coverage-scripts.xml" \
            --cov-report=term-missing

      - name: Upload scripts coverage to Codecov
        if: ${{ hashFiles('coverage-scripts.xml') != '' }}
        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
        with:
          files: coverage-scripts.xml
          flags: ${{ matrix.arch }}
          name: phlex-scripts-coverage-${{ matrix.arch }}
          fail_ci_if_error: false
          verbose: true
          root_dir: ${{ needs.setup.outputs.checkout_path || '.' }}
          token: ${{ env.CODECOV_TOKEN }}