1_test.yml

name: Tests

on:
  workflow_dispatch:
  push:
    branches: ["main"]
    tags:
      - "*.*.*"
    paths:
      - "examples/**"
      - "litestar_auth/**"
      - "README.md"
      - "tests/**"
      - ".pre-commit-config.yaml"
      - "pyproject.toml"
      - "uv.lock"
      - "justfile"
      - ".github/workflows/**"
  pull_request:
    paths:
      - "examples/**"
      - "litestar_auth/**"
      - "README.md"
      - "tests/**"
      - ".pre-commit-config.yaml"
      - "pyproject.toml"
      - "uv.lock"
      - "justfile"
      - ".github/workflows/**"

concurrency:
  group: check-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

# Test job: id-token write is required for OIDC JWT (GitHub Actions OIDC reference).
# Codecov: use_oidc per codecov-action README; token alternative in Codecov token docs.
# https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect
# https://github.com/codecov/codecov-action#using-oidc
# https://docs.codecov.com/docs/codecov-tokens

env:
  VENV_PRECOMMIT_CACHE_VERSION: v1

jobs:
  prek:
    if: github.event.repository.fork == false
    name: Prek
    runs-on: ubuntu-latest
    env:
      UV_PYTHON_PREFERENCE: only-managed
      # Same as prek: skip hooks that are CI-inappropriate on default branch / shared runners.
      SKIP: detect-aws-credentials,no-commit-to-branch
    steps:
      - name: Check out repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Set uv Python install dir
        run: echo "UV_PYTHON_INSTALL_DIR=${RUNNER_TEMP}/uv-python-dir" >> "$GITHUB_ENV"

      - name: Install uv
        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
        with:
          python-version: "3.12"
          enable-cache: true
          cache-python: true
          github-token: ${{ secrets.GITHUB_TOKEN }}

      # Local hooks use `uv run` (language: system); cache .venv like the former prek job.
      # prek-action also caches the prek hook environment (default cache: true).
      # Key includes run_id + run_attempt so "Re-run jobs" does not try to save the same
      # cache key twice (GitHub: "another job may be creating this cache").
      # restore-keys restores any prior attempt for this OS/Python; uv sync fixes deps if needed.
      # See: https://github.com/actions/cache/blob/main/tips-and-workarounds.md#update-a-cache
      - name: Restore .venv cache (prek / uv run hooks)
        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: .venv
          key: venv-precommit-${{ env.VENV_PRECOMMIT_CACHE_VERSION }}-${{ runner.os }}-3.12-${{ github.run_id }}-${{ github.run_attempt }}
          restore-keys: |
            venv-precommit-${{ env.VENV_PRECOMMIT_CACHE_VERSION }}-${{ runner.os }}-3.12-

      - name: Install the project
        run: uv sync --frozen --all-extras --group dev

      - name: Save .venv cache (prek / uv run hooks)
        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: .venv
          key: venv-precommit-${{ env.VENV_PRECOMMIT_CACHE_VERSION }}-${{ runner.os }}-3.12-${{ github.run_id }}-${{ github.run_attempt }}

      - name: Run prek
        uses: j178/prek-action@bdca6f102f98e2b4c7029491a53dfd366469e33d # v2.0.4
        with:
          cache: true

  test:
    name: Test (${{ matrix.python-version }} on ${{ matrix.os }})
    needs: [prek]
    runs-on: ${{ matrix.os }}
    if: github.event.repository.fork == false
    permissions:
      contents: read
      id-token: write
    strategy:
      fail-fast: false
      matrix:
        python-version:
          - "3.12"
          - "3.13"
          - "3.14"
        os:
          - ubuntu-latest
          - macos-latest
          - windows-2025-vs2026
    steps:
      - name: Check out repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 0

      - name: Install uv
        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
        with:
          python-version: ${{ matrix.python-version }}
          enable-cache: true
          cache-python: true
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Add .local/bin to Windows PATH
        if: runner.os == 'Windows'
        shell: bash
        run: echo "$USERPROFILE/.local/bin" >> "$GITHUB_PATH"

      - name: Clear Python install dir (Windows)
        if: runner.os == 'Windows'
        shell: bash
        run: rm -rf "${UV_PYTHON_INSTALL_DIR:-}" 2>/dev/null || true

      - name: Set up Python
        shell: bash
        run: uv python install ${{ matrix.python-version }}

      - name: Install the project
        run: uv sync --frozen --all-extras --group dev

      # Install the coverage subprocess startup hook so pytest-cov measures
      # import-time class/function definitions in modules that pytest-cov
      # imports during plugin discovery (otherwise instrumentation starts
      # after those modules are already in sys.modules).
      # See: https://coverage.readthedocs.io/en/latest/subprocess.html
      - name: Install coverage subprocess hook
        run: >-
          uv run python -c
          "import sysconfig, pathlib;
          p = pathlib.Path(sysconfig.get_paths()['purelib']) / 'coverage_subprocess.pth';
          p.write_text('import coverage; coverage.process_startup()\n');
          print(f'Installed {p}')"

      - name: Detect dead fixtures
        run: uv run pytest --dead-fixtures

      - name: Run tests (coverage + XML for Codecov)
        env:
          COVERAGE_PROCESS_START: pyproject.toml
        run: >-
          uv run pytest
          --cov=litestar_auth
          --cov-branch
          --cov-report=term-missing
          --cov-report=xml
          --cov-fail-under=100
          -n auto

      # Codecov flags: ^[\w.\-]{1,45}$ (alphanumeric, _, -, .); see https://docs.codecov.com/docs/flags
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        with:
          fail_ci_if_error: true
          files: coverage.xml
          flags: ${{ matrix.os }}
          name: py-${{ matrix.python-version }}-${{ matrix.os }}
          use_oidc: true