# Copyright © 2025-26 l5yth & contributors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: Python

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]
    paths:
      - '.github/**'
      - 'data/**'
      - 'tests/**'
      # Deployment surfaces read by tests/test_env_surfaces.py.
      - '.env.example'
      - 'README.md'
      - 'docker-compose.yml'
      - 'flake.nix'
      # tests/test_configure_script.py runs it.
      - 'configure.sh'
      - 'web/lib/potato_mesh/config.rb'
      # tests/test_dockerfile_sync.py compares these two files.
      - 'Dockerfile'
      - 'web/Dockerfile'
      # tests/test_dependency_manifests.py reads the web Gemfile and its lock.
      - 'web/Gemfile*'

permissions:
  contents: read

jobs:
  ingestor:
    runs-on: ubuntu-latest
    strategy:
      # The ingestor image ships Python 3.13 (data/Dockerfile); CI tests it
      # and 3.14. One leg's failure must not cancel the other's result.
      fail-fast: false
      matrix:
        python-version: ['3.13', '3.14']
    steps:
    - uses: actions/checkout@v5
    - name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@v7
      with:
        python-version: ${{ matrix.python-version }}
    - name: Install dependencies
      # Install from the manifests, not a hand-picked list: PR #838 added
      # `cryptography` to data/requirements.txt and the hand-list here missed
      # it, breaking test collection on main. requirements-dev.txt adds the
      # dev tools (black/pytest/pytest-cov) to the runtime set.
      run: |
        python -m pip install --upgrade pip
        pip install -r data/requirements.txt -r data/requirements-dev.txt
    - name: Test with pytest and coverage
      run: |
        mkdir -p reports
        pytest --cov=data --cov-report=term --cov-report=xml:reports/python-coverage.xml --junitxml=reports/python-junit.xml
    - name: Upload coverage to Codecov
      if: always()
      uses: codecov/codecov-action@v5
      with:
        token: ${{ secrets.CODECOV_TOKEN }}
        files: reports/python-coverage.xml
        flags: python-ingestor
        fail_ci_if_error: false
        name: python-ingestor
      env:
        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
    - name: Upload test results to Codecov
      uses: codecov/test-results-action@v1
      with:
        token: ${{ secrets.CODECOV_TOKEN }}
        files: reports/python-junit.xml
        flags: python-ingestor
    - name: Lint with black
      run: |
        black --check ./