ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: fluxgraph-ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  changes:
    name: Detect code changes
    runs-on: ubuntu-24.04
    permissions:
      pull-requests: read
    outputs:
      code: ${{ steps.filter.outputs.code }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4
        id: filter
        with:
          predicate-quantifier: every
          filters: |
            code:
              - '**'
              - '!**/*.md'

  python-lint:
    name: Python Linting (ruff)
    needs: [changes]
    if: needs.changes.outputs.code == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 10

    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
          python-version: "3.12"

      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
        with:
          enable-cache: true
          cache-dependency-glob: |
            pyproject.toml
            uv.lock

      - name: Install dependencies
        run: uv sync --locked --extra dev

      - name: Run ruff checks
        run: |
          uv run ruff check tests --output-format=github
          uv run ruff format --check tests

  python-typecheck:
    name: Python Type Checking (mypy)
    needs: [changes]
    if: needs.changes.outputs.code == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 10

    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
          python-version: "3.12"

      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
        with:
          enable-cache: true
          cache-dependency-glob: |
            pyproject.toml
            uv.lock

      - name: Install dependencies
        run: uv sync --locked --extra dev

      - name: Run mypy
        run: uv run mypy tests

  linux-matrix:
    name: Linux ${{ matrix.lane }}
    needs: [changes]
    if: needs.changes.outputs.code == 'true'
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        include:
          - lane: core-only
            preset: ci-linux-release
            grpc_integration: false
          - lane: diagram-dot
            preset: ci-linux-release-diagram
            grpc_integration: false
          - lane: json
            preset: ci-linux-release-json
            grpc_integration: false
          - lane: yaml
            preset: ci-linux-release-yaml
            grpc_integration: false
          - lane: server-enabled
            preset: ci-linux-release-server
            grpc_integration: true

    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y ninja-build g++

      - name: Setup vcpkg
        uses: anolishq/.github/.github/actions/setup-vcpkg@b2d9b16b9accee0e58d37e7d05add68b6621961a # v2.2
        with:
          triplet: x64-linux
          # server-enabled is the sole writer (its closure — grpc+protobuf+json+
          # yaml+gtest — is the union of every lane). The 4 subset lanes restore
          # only, so a 1-min subset save can't clobber the shared key and drop
          # grpc, which forced a ~65min grpc rebuild on the server lane every run.
          cache-write: ${{ matrix.lane == 'server-enabled' }}

      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        if: ${{ matrix.grpc_integration }}
        with:
          python-version: "3.12"

      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
        if: ${{ matrix.grpc_integration }}
        with:
          enable-cache: true
          cache-dependency-glob: |
            pyproject.toml
            uv.lock

      - name: Install Python integration deps
        if: ${{ matrix.grpc_integration }}
        run: uv sync --locked --extra dev

      - name: Configure
        run: |
          EXTRA_ARGS=""
          if [ "${{ matrix.grpc_integration }}" = "true" ]; then
            EXTRA_ARGS="-DPython3_EXECUTABLE=$(pwd)/.venv/bin/python"
          fi
          cmake --preset "${{ matrix.preset }}" $EXTRA_ARGS

      - name: Build
        run: cmake --build --preset "${{ matrix.preset }}" --parallel

      - name: Generate Python Protobuf Bindings
        if: ${{ matrix.grpc_integration }}
        run: |
          bash ./scripts/generate_proto_python.sh build-server/python

      - name: Run tests
        run: ctest --preset "${{ matrix.preset }}"

  strict-dimensional-validation:
    name: Strict dimensional validation
    needs: [changes]
    if: needs.changes.outputs.code == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 30

    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y ninja-build g++ python3

      - name: Setup vcpkg
        uses: anolishq/.github/.github/actions/setup-vcpkg@b2d9b16b9accee0e58d37e7d05add68b6621961a # v2.2
        with:
          triplet: x64-linux
          # Subset closure (core preset, no grpc) — read-only so it can't clobber
          # the shared x64-linux key written by the server-enabled lane.
          cache-write: "false"

      - name: Run strict dimensional validation
        id: dimensional
        shell: bash
        run: |
          set -euo pipefail
          OUT_DIR="artifacts/dimensional-validation/${{ github.run_id }}_${{ github.run_attempt }}_ci-linux-release"
          python3 scripts/run_dimensional_validation.py \
            --preset ci-linux-release \
            --output-dir "$OUT_DIR" \
            --enforce
          echo "out_dir=$OUT_DIR" >> "$GITHUB_OUTPUT"

      - name: Upload strict-dimensional artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: strict-dimensional-validation-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ steps.dimensional.outputs.out_dir }}
          if-no-files-found: error

  windows-core:
    name: Windows core-only
    needs: [changes]
    if: needs.changes.outputs.code == 'true'
    runs-on: windows-2025

    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

      - name: Setup vcpkg
        uses: anolishq/.github/.github/actions/setup-vcpkg@b2d9b16b9accee0e58d37e7d05add68b6621961a # v2.2
        with:
          triplet: x64-windows-v145

      - name: Configure
        run: cmake --preset ci-windows-release

      - name: Build
        run: cmake --build --preset ci-windows-release --parallel

      - name: Run C++ tests
        run: ctest --preset ci-windows-release

  windows-diagram:
    name: Windows diagram-dot
    needs: [changes]
    if: needs.changes.outputs.code == 'true'
    runs-on: windows-2025

    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

      - name: Setup vcpkg
        uses: anolishq/.github/.github/actions/setup-vcpkg@b2d9b16b9accee0e58d37e7d05add68b6621961a # v2.2
        with:
          triplet: x64-windows-v145

      - name: Configure
        run: cmake --preset ci-windows-release-diagram

      - name: Build
        run: cmake --build --preset ci-windows-release-diagram --parallel

      - name: Run C++ tests
        run: ctest --preset ci-windows-release-diagram

  diagram-render-smoke:
    name: Diagram Render Smoke
    needs: [changes]
    if: needs.changes.outputs.code == 'true'
    runs-on: ubuntu-24.04

    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y ninja-build g++ graphviz

      - name: Setup vcpkg
        uses: anolishq/.github/.github/actions/setup-vcpkg@b2d9b16b9accee0e58d37e7d05add68b6621961a # v2.2
        with:
          triplet: x64-linux
          # Subset closure (diagram preset, no grpc) — read-only so it can't
          # clobber the shared x64-linux key written by the server-enabled lane.
          cache-write: "false"

      - name: Configure diagram preset
        run: cmake --preset ci-linux-release-diagram

      - name: Build diagram tool
        run: cmake --build --preset ci-linux-release-diagram --target fluxgraph_diagram --parallel

      - name: Render SVG smoke output
        run: |
          set -euo pipefail
          BIN="./build/ci-linux-release-diagram/tools/fluxgraph-diagram"
          OUT="$RUNNER_TEMP/graph-smoke.svg"
          "$BIN" --in ./examples/03_json_graph/graph.json --out "$OUT" --format svg
          test -s "$OUT"

  version-sync:
    needs: [changes]
    if: needs.changes.outputs.code == 'true'
    uses: anolishq/.github/.github/workflows/version-sync.yml@c76784aff711e6540d539f6a5c3ea33c63627930 # v2
    with:
      python-version: '3.12'
      working-directory: '.'

  cpp-format:
    name: C++ Formatting (clang-format)
    needs: [changes]
    if: needs.changes.outputs.code == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - name: Install pinned clang-tools
        # SHA-verified static LLVM 18.1.8 clang-format on PATH — the org source of
        # truth, matching workstation-configs apps/clang-tools on dev boxes. See
        # anolishq/.github#69.
        uses: anolishq/.github/.github/actions/setup-clang-tools@43a0fe0a7feb87215f6e7677133be542ef6f1031 # setup-clang-tools
      - name: Check formatting
        run: git ls-files '*.c' '*.cc' '*.cpp' '*.cxx' '*.h' '*.hh' '*.hpp' '*.hxx' | xargs clang-format --dry-run --Werror

  ok:
    name: ok
    if: always()
    needs: [changes, python-lint, python-typecheck, linux-matrix, strict-dimensional-validation, windows-core, windows-diagram, diagram-render-smoke, version-sync, cpp-format]
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    steps:
      - name: Fail if any upstream job failed or was cancelled
        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
        run: exit 1
      - name: Pass
        run: echo 'All checks passed or were skipped'