ci-checks.yml

# Copyright (c) 2024-2026, NVIDIA CORPORATION.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: CI - checks

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
  merge_group:
    types: [checks_requested]
  workflow_dispatch:

defaults:
  run:
    shell: bash -x -e -u -o pipefail {0}

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # ---------------------------------------------------------------------------
  # Detect which files changed so downstream jobs can be skipped when only
  # docs, config, or other non-source files are modified.  The "ci-status"
  # summary job (below) is the single required check for branch protection,
  # so skipped jobs won't block merge.
  # ---------------------------------------------------------------------------
  changes:
    name: Detect changes
    if: github.event_name != 'workflow_dispatch'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    outputs:
      src: ${{ steps.changes.outputs.src }}
      tests: ${{ steps.changes.outputs.tests }}
      pytest_ini: ${{ steps.changes.outputs.pytest_ini }}
      pyproject: ${{ steps.changes.outputs.pyproject }}
      uv_lock: ${{ steps.changes.outputs.uv_lock }}
      docs_src: ${{ steps.changes.outputs.docs_src }}
      any: ${{ steps.changes.outputs.any }}
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false
      - name: Detect changes
        id: changes
        uses: ./.github/actions/detect-changes

  format:
    name: Format
    # Intentionally does not depend on `changes`: format and lock checks run on
    # every push, pull request, and workflow_dispatch.
    runs-on: ubuntu-latest
    steps:
      - name: checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Setup Python environment
        id: setup
        uses: ./.github/actions/setup-python-env
        with:
          checkout: "false"
          bootstrap-tools: "true"

      - name: Bootstrap
        run: mise run bootstrap-nss dev

      - name: Check formatting, linting, and copyright headers
        run: mise run format-check

      - name: Check uv.lock is up to date
        run: mise run lock-check

  typecheck:
    name: Typecheck
    # Intentionally does not depend on `changes`: type checks run on every push,
    # pull request, and workflow_dispatch.
    runs-on: ubuntu-latest
    steps:
      - name: checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Setup Python environment
        id: setup
        uses: ./.github/actions/setup-python-env
        with:
          checkout: "false"
          bootstrap-tools: "true"

      - name: Bootstrap
        run: mise run bootstrap-nss cpu

      - name: Run ty type checks
        run: mise run typecheck

  unit-test:
    name: Unit Tests
    needs: changes
    # `changes` is intentionally skipped on workflow_dispatch. `always()` lets
    # manual runs bypass that skipped dependency and run the full test job.
    if: >-
      ${{
        always() &&
        (
          github.event_name == 'workflow_dispatch' ||
          needs.changes.outputs.any == 'true'
        )
      }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.11", "3.12", "3.13"]
    steps:
      - name: checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Setup Python environment
        id: setup
        uses: ./.github/actions/setup-python-env
        with:
          python-version: ${{ matrix.python-version }}
          checkout: "false"
          bootstrap-tools: "true"

      - name: Bootstrap
        run: mise run bootstrap-nss cpu

      - name: Run unit tests with coverage
        run: mise run test:ci

      - name: Upload coverage report
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: matrix.python-version == '3.13'
        with:
          name: coverage-report
          path: coverage.json
          retention-days: 30
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6
        if: matrix.python-version == '3.13'
        with:
          files: coverage.json
          token: ${{ secrets.CODECOV_TOKEN }}
          fail_ci_if_error: false
          comment: true
          flags: python${{ matrix.python-version }}

  smoke-test:
    name: Smoke Tests
    needs: changes
    # `changes` is intentionally skipped on workflow_dispatch. `always()` lets
    # manual runs bypass that skipped dependency and run the full smoke job.
    if: >-
      ${{
        always() &&
        (
          github.event_name == 'workflow_dispatch' ||
          needs.changes.outputs.src == 'true' ||
          needs.changes.outputs.tests == 'true' ||
          needs.changes.outputs.pytest_ini == 'true' ||
          needs.changes.outputs.uv_lock == 'true' ||
          needs.changes.outputs.pyproject == 'true'
        )
      }}
    runs-on: ubuntu-latest
    steps:
      - name: checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Setup Python environment
        uses: ./.github/actions/setup-python-env
        with:
          checkout: "false"
          bootstrap-tools: "true"

      - name: Run CPU smoke tests
        run: |
          mise run bootstrap-nss cpu
          mise run test:smoke


  # ---------------------------------------------------------------------------
  # Single required status check for branch protection.
  # Aggregates results from all upstream jobs so that skipped jobs (due to
  # path filtering) don't block merge.
  # ---------------------------------------------------------------------------
  ci-status:
    name: CI Status
    if: always() && !cancelled()
    needs: [changes, format, typecheck, unit-test, smoke-test]
    runs-on: ubuntu-latest
    steps:
      - name: Check job results
        run: |
          echo "changes:    ${{ needs.changes.result }}"
          echo "format:     ${{ needs.format.result }}"
          echo "typecheck:  ${{ needs.typecheck.result }}"
          echo "unit-test:  ${{ needs.unit-test.result }}"
          echo "smoke-test: ${{ needs.smoke-test.result }}"

          if [[ "${{ contains(needs.*.result, 'failure') }}" == "true" ]]; then
            echo "::error::One or more CI jobs failed"
            exit 1
          fi

          echo "All CI jobs passed (or were skipped)."