ci.yml

---
name: CI

"on":
  # Run on PR open, new commits to an open PR, re-open, and draft→ready (no branch-push CI).
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
  push:
    branches:
      - main
  workflow_dispatch:

concurrency:
  group: ci-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.head.ref || github.ref_name }}
  cancel-in-progress: true

env:
  PYTHON_VERSION: "3.11"
  CARGO_MANIFEST: greenfloor-engine/Cargo.toml
  DIFF_COVER_FAIL_UNDER: "80"

jobs:
  lint:
    name: Lint, format, and tests (ubuntu-latest)
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
          fetch-depth: 0

      - name: Detect diff coverage scope
        id: scope
        run: |
          git fetch origin main
          bash .github/scripts/diff-coverage-scope.sh origin/main

      - uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - uses: actions/setup-node@v4
        with:
          node-version: "lts/*"

      - name: Restore Python venv cache
        id: cache-venv
        uses: actions/cache/restore@v4
        with:
          path: .venv
          key: venv-v2-${{ runner.os }}-${{ runner.arch }}-py311-${{ hashFiles('pyproject.toml') }}

      - name: Create venv and install dev dependencies
        run: |
          if [ ! -d .venv/bin ]; then
            python -m venv .venv
          fi
          export PATH="$GITHUB_WORKSPACE/.venv/bin:$PATH"
          echo "$GITHUB_WORKSPACE/.venv/bin" >> "$GITHUB_PATH"
          python -m pip install --upgrade pip
          python -m pip install -e ".[dev]"

      - name: Save Python venv cache
        if: steps.cache-venv.outputs.cache-hit != 'true'
        uses: actions/cache/save@v4
        with:
          path: .venv
          key: venv-v2-${{ runner.os }}-${{ runner.arch }}-py311-${{ hashFiles('pyproject.toml') }}

      - name: Cache pre-commit environment
        uses: actions/cache@v4
        with:
          path: ./.cache/pre-commit
          key: pre-commit-${{ runner.os }}-${{ runner.arch }}-py311-${{ hashFiles('.pre-commit-config.yaml') }}
          restore-keys: |
            pre-commit-${{ runner.os }}-${{ runner.arch }}-py311-

      - uses: ./.github/actions/rust-cache-greenfloor
        with:
          shared-key: test
          save-cache: "true"
          install-nextest: ${{ steps.scope.outputs.run_rust_cov != 'true' }}

      - name: Lint, format, clippy, and script tests (parallel)
        env:
          PRE_COMMIT_HOME: ${{ github.workspace }}/.cache/pre-commit
          RUN_PY_COV: ${{ steps.scope.outputs.run_py_cov }}
        run: bash .github/scripts/ubuntu-all-checks-parallel.sh

      - uses: ./.github/actions/rust-cache-greenfloor
        if: steps.scope.outputs.run_rust_cov == 'true'
        with:
          shared-key: coverage
          save-cache: "true"
          install-nextest: "true"

      - name: Install cargo-llvm-cov
        if: steps.scope.outputs.run_rust_cov == 'true'
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-llvm-cov

      - name: Install Rust llvm-tools for coverage
        if: steps.scope.outputs.run_rust_cov == 'true'
        run: rustup component add llvm-tools-preview

      - name: Rust tests (incremental coverage)
        if: steps.scope.outputs.run_rust_cov == 'true'
        env:
          CARGO_MANIFEST: ${{ env.CARGO_MANIFEST }}
          COMPARE_BRANCH: origin/main
          INCREMENTAL: "1"
        run: bash .github/scripts/ubuntu-rust-coverage.sh

      - name: Rust tests
        if: steps.scope.outputs.run_rust_cov != 'true'
        env:
          CARGO_MANIFEST: ${{ env.CARGO_MANIFEST }}
        run: bash .github/scripts/ubuntu-rust-tests.sh

      - name: Diff coverage gate (changed lines only)
        if: >-
          steps.scope.outputs.run_rust_cov == 'true'
          || steps.scope.outputs.run_py_cov == 'true'
        run: |
          status=0
          if [ "${{ steps.scope.outputs.run_rust_cov }}" = "true" ]; then
            diff-cover lcov.info \
              --compare-branch=origin/main \
              --fail-under="${{ env.DIFF_COVER_FAIL_UNDER }}" \
              --include-untracked \
              --exclude '**/tests/**' '**/test_support/**' '**/test_env/**' \
              --exclude '**/test_overrides/**' '**/bin/**' '**/main.rs' \
              --exclude '**/tests.rs' '**/storage/sqlite/**' \
              --exclude '**/storage/test_support.rs' \
              || status=1
          fi
          if [ "${{ steps.scope.outputs.run_py_cov }}" = "true" ]; then
            diff-cover coverage-python.xml \
              --compare-branch=origin/main \
              --fail-under="${{ env.DIFF_COVER_FAIL_UNDER }}" \
              --include-untracked \
              || status=1
          fi
          exit "${status}"

      - name: Upload coverage artifacts
        if: >-
          steps.scope.outputs.run_rust_cov == 'true'
          || steps.scope.outputs.run_py_cov == 'true'
        uses: actions/upload-artifact@v4
        with:
          name: coverage-reports
          path: |
            lcov.info
            coverage-python.xml
          if-no-files-found: ignore

  test:
    name: Test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 8
    strategy:
      fail-fast: false
      matrix:
        os:
          # ubuntu-latest Rust/Python tests run in the lint job (plain nextest or incremental llvm-cov).
          - ubuntu-24.04-arm
          - macos-14
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive

      - uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Restore Python venv cache
        id: cache-venv
        uses: actions/cache/restore@v4
        with:
          path: .venv
          key: venv-v2-${{ runner.os }}-${{ runner.arch }}-py311-${{ hashFiles('pyproject.toml') }}

      - name: Create venv and install package
        run: |
          if [ ! -d .venv/bin ]; then
            python -m venv .venv
          fi
          export PATH="$GITHUB_WORKSPACE/.venv/bin:$PATH"
          echo "$GITHUB_WORKSPACE/.venv/bin" >> "$GITHUB_PATH"
          python -m pip install --upgrade pip
          python -m pip install -e .

      - name: Save Python venv cache
        if: steps.cache-venv.outputs.cache-hit != 'true'
        uses: actions/cache/save@v4
        with:
          path: .venv
          key: venv-v2-${{ runner.os }}-${{ runner.arch }}-py311-${{ hashFiles('pyproject.toml') }}

      - uses: ./.github/actions/rust-cache-greenfloor
        with:
          shared-key: test
          install-nextest: "true"

      - name: Install cargo-audit
        if: matrix.os == 'ubuntu-24.04-arm'
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-audit

      - name: Cargo audit (greenfloor-engine)
        if: matrix.os == 'ubuntu-24.04-arm'
        working-directory: greenfloor-engine
        run: cargo audit

      - name: Build and test greenfloor-engine
        run: cargo nextest run --manifest-path "${{ env.CARGO_MANIFEST }}" --features test-support

      - name: Script adapter unit tests
        env:
          RUN_PY_COV: "false"
        run: bash .github/scripts/ubuntu-script-tests.sh