ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint:
    name: Lint the template repository
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          python-version: "3.13"
          enable-cache: true

      - run: uv sync --locked --all-groups

      - name: Ruff
        run: |
          uv run ruff check --output-format=github .
          uv run ruff format --check --diff .

      - name: Validate copier.yml
        run: uv run python -c "import yaml,pathlib; yaml.safe_load(pathlib.Path('copier.yml').read_text())"

      - name: Validate generated catalog artifacts
        run: uv run python scripts/compile_catalog.py --check

  structure:
    name: Generation tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # Copier resolves the template version from git history and tags.
          fetch-depth: 0
          persist-credentials: false

      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          python-version: "3.13"
          enable-cache: true

      - run: uv sync --locked --all-groups

      - name: Fast tests
        run: uv run pytest -m "not slow and not preset" -n auto

  coverage:
    name: Catalog compiler coverage
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          python-version: "3.13"
          enable-cache: true

      - run: uv sync --locked --all-groups

      - name: Enforce 100% compiler coverage
        run: >-
          uv run pytest tests/test_compile_catalog.py
          --cov=scripts
          --cov-branch
          --cov-report=term-missing
          --cov-report=xml

      - name: Upload repository coverage
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        with:
          files: ./coverage.xml
          fail_ci_if_error: false

  presets:
    name: AI preset vertical slices
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          python-version: "3.13"
          enable-cache: true

      - run: uv sync --locked --all-groups

      - name: Generate and test affected presets offline
        run: uv run pytest -m preset -n auto --basetemp="${{ runner.temp }}/pytest-presets"

  docs:
    name: Repository documentation
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          python-version: "3.13"
          enable-cache: true

      - run: uv sync --locked --only-group docs

      - name: Build Zensical site
        run: uv run --only-group docs zensical build --clean --strict

  toolchain:
    name: Generated project / ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          python-version: "3.13"
          enable-cache: true

      - run: uv sync --locked --all-groups

      # This is what stops the template from rotting: it generates every
      # variant and runs the full toolchain inside each generated project.
      #
      # --basetemp matters more than it looks. Generated projects land in
      # pytest's temp dir, and uv installs into their virtualenvs by hardlinking
      # from its cache. A hardlink cannot cross volumes, and on Windows runners
      # the default temp dir is on C: while the uv cache is on D:, so every
      # package gets copied instead of linked. Putting both on the same volume
      # is the difference between a six minute job and a fast one.
      - name: Slow tests
        run: uv run pytest -m slow -n auto --basetemp="${{ runner.temp }}/pytest"


  zizmor:
    name: Workflow security
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2

  # Single required status check for branch protection. Depending on every
  # other job means the protection rule never needs updating when the matrix
  # changes -- only this job's name is referenced.
  ci:
    name: CI
    runs-on: ubuntu-latest
    needs: [lint, structure, coverage, presets, docs, toolchain, zizmor]
    if: always()
    steps:
      - name: Verify every job succeeded
        env:
          RESULTS: ${{ join(needs.*.result, ' ') }}
        run: |
          echo "Job results: $RESULTS"
          case "$RESULTS" in
            *failure*|*cancelled*|*skipped*)
              echo "::error::A required job did not succeed"
              exit 1
              ;;
          esac