ci.yaml

name: CI

on:
  push:
    branches: [main]
    tags: ["*"]
  pull_request:
  workflow_dispatch:

jobs:
  example:
    strategy:
      matrix:
        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
      fail-fast: false
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - uses: astral-sh/setup-uv@v6

      - if: runner.os != 'Windows'
        run: uv run camas matrix

      # zuban non-deterministically fails to find test deps under UV_PROJECT_ENVIRONMENT on
      # Windows in CI (cannot reproduce locally); inline the matrix without zuban there.
      - if: runner.os == 'Windows'
        run: |
          uv run camas 'Sequential(
            "uv sync",
            {format_check, lint, mypy, pyright, ty, pyrefly, test},
            env={"UV_PROJECT_ENVIRONMENT": ".venv-{PY}", "UV_PYTHON": "{PY}"},
            matrix={"PY": ("3.10", "3.11", "3.12", "3.13", "3.14", "3.15")},
          )'

  check:
    strategy:
      matrix:
        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
        python: ["3.10", "3.11", "3.12", "3.13", "3.14", "3.15"]
      fail-fast: false
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v5

      - uses: astral-sh/setup-uv@v6

      - run: uv run camas check
        env:
          UV_PYTHON: ${{ matrix.python }}

  coverage:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - uses: astral-sh/setup-uv@v6

      - run: uv run camas coverage --effects='(Status(StatusOptions(output_mode="all")),)'

      - uses: codecov/codecov-action@v5
        if: always()
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: ./coverage.xml
          flags: unittests

  github-checks-demo:
    permissions:
      checks: write
      contents: read
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - uses: actions/checkout@v5

      - uses: astral-sh/setup-uv@v6

      - run: |
          uv run --extra github_checks camas matrix --effects='(
            Status(StatusOptions(output_mode="github")),
            GitHubChecks(GitHubChecksOptions(
              sha="${{ github.event.pull_request.head.sha || github.sha }}",
            )),
          )'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  status-modes-demo:
    # Showcases each Status output_mode so reviewers can click through and compare;
    # the auto-detected default (Status output_mode='github') is exercised by every
    # other job, so only the non-default modes are matrixed here.
    strategy:
      matrix:
        mode: [quiet, all, errors, stream]
      fail-fast: false
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - uses: astral-sh/setup-uv@v6

      - run: uv run camas check --effects='(Status(StatusOptions(output_mode="${{ matrix.mode }}")),)'

  nix:
    strategy:
      matrix:
        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest]
      fail-fast: false
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v5

      - uses: DeterminateSystems/nix-installer-action@v22

      - uses: DeterminateSystems/magic-nix-cache-action@v13

      - run: nix flake check --print-build-logs

  tauri-fixture:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    defaults:
      run:
        working-directory: tests/fixtures/tauri-app
    steps:
      - uses: actions/checkout@v5

      - uses: astral-sh/setup-uv@v6

      - uses: actions/setup-node@v4
        with:
          node-version-file: tests/fixtures/tauri-app/.nvmrc

      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy

      - run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libxdo-dev libssl-dev libayatana-appindicator3-dev librsvg2-dev
        working-directory: .

      - run: uv tool install .
        working-directory: .

      - run: npm ci

      # First run: verify pipeline + warm caches (cargo, uv, node_modules).
      - run: camas all

      # Too slow to be a useful example, but you get the idea
      # - run: camas build

      - run: shellcheck .github/scripts/*.sh
        working-directory: .

      - name: Install shfmt
        working-directory: .
        run: |
          mkdir -p "$HOME/.local/bin"
          curl -fsSL --retry 3 -o "$HOME/.local/bin/shfmt" \
            https://github.com/mvdan/sh/releases/download/v3.13.1/shfmt_v3.13.1_linux_amd64
          chmod +x "$HOME/.local/bin/shfmt"

      - run: $HOME/.local/bin/shfmt -d .github/scripts/*.sh
        working-directory: .

      - name: Install demo recording tools
        working-directory: .
        run: bash .github/scripts/ci-setup.sh

      # Second run: record demo on warm caches.
      - name: Record demo
        working-directory: .
        run: bash .github/scripts/record-demo.sh

      - run: test -s .demo/demo.gif
        working-directory: .

      - uses: actions/upload-artifact@v7
        with:
          name: demo
          path: .demo/

      - name: Publish demo to gh-storage branch
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        working-directory: .
        run: |
          SHORT_SHA="${GITHUB_SHA::7}"

          git config user.name  "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

          if git ls-remote --exit-code origin gh-storage >/dev/null; then
            git fetch origin gh-storage
            git worktree add storage gh-storage
          else
            git worktree add --orphan -b gh-storage storage
            (cd storage && git rm -rf . >/dev/null 2>&1 || true)
          fi

          mkdir -p storage/demos/archive
          cp .demo/demo.gif storage/demos/demo-latest.gif
          cp .demo/demo.gif "storage/demos/archive/demo-${SHORT_SHA}.gif"
          cp .demo/demo.cast storage/demos/demo-latest.cast
          cp .demo/demo.cast "storage/demos/archive/demo-${SHORT_SHA}.cast"

          cd storage
          git add demos
          if git diff --cached --quiet; then
            echo "No changes to publish"
          else
            git commit -m "Render demo for ${SHORT_SHA}"
            git push origin gh-storage
          fi

  wheels:
    strategy:
      matrix:
        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
        python: ["311", "312", "313", "314"]
      fail-fast: false
    runs-on: ${{ matrix.os }}
    continue-on-error: true
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - uses: pypa/cibuildwheel@v3.4.1
        env:
          CIBW_BUILD: "cp${{ matrix.python }}-*"
          CIBW_SKIP: "*-musllinux_i686 *-win32"
          CIBW_ENVIRONMENT: CAMAS_USE_MYPYC=1
          CIBW_BUILD_VERBOSITY: 1
          CIBW_BEFORE_ALL_LINUX: git config --global --add safe.directory '*'
          CIBW_TEST_REQUIRES: pytest pytest-asyncio cyclopts httpx ty
          CIBW_TEST_COMMAND: >
            python -c "import camas.main.dispatch, camas.main.entrypoint, camas.effect.summary, camas.effect.termtree;
            assert all(not m.__file__.endswith('.py') for m in (camas.main.dispatch, camas.main.entrypoint, camas.effect.summary, camas.effect.termtree))" &&
            pytest {project}/tests -v -m "not slow"

      - if: always()
        uses: actions/upload-artifact@v7
        with:
          name: wheels-${{ matrix.os }}-cp${{ matrix.python }}
          path: ./wheelhouse/*.whl
          if-no-files-found: ignore

  sdist:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - uses: astral-sh/setup-uv@v6

      - run: uv build --sdist

      - uses: actions/upload-artifact@v7
        with:
          name: sdist
          path: dist/*.tar.gz

  publish:
    if: startsWith(github.ref, 'refs/tags/')
    needs: [check, coverage, wheels, sdist, tauri-fixture, example, nix]
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/p/camas
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@v7
        with:
          path: dist
          pattern: wheels-*
          merge-multiple: true

      - uses: actions/download-artifact@v7
        with:
          path: dist
          name: sdist

      - uses: pypa/gh-action-pypi-publish@release/v1