ci-cd.yml

name: Python checks

on:
  push:
    branches: [ "main" ]
    tags: [v*]
  pull_request:
  merge_group:

env:
  FORCE_COLOR: 1

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions: {}

jobs:
  linting:
    runs-on: ubuntu-latest
    name: "Python linting"
    permissions:
      contents: read
    env:
      UV_FROZEN: true

    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false

    - name: Set up Python 🐍
      id: python
      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
      with:
        python-version-file: "pyproject.toml"

    - name: Install uv
      uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
      with:
        enable-cache: | # zizmor: ignore[cache-poisoning] cache is disabled when publishing to prevent poisoning
          ${{ github.ref_type == 'tag' && 'false' || 'auto' }}
        cache-dependency-glob: "uv.lock"
        python-version: ${{ steps.python.outputs.python-path }}
        activate-environment: true

    - name: Check lock is up-to-date
      run: |
        uv lock --check

    - name: Install dependencies
      run: |
        uv sync

    - name: Check file formatting
      uses: astral-sh/ruff-action@278981a28ce3188b1e39527901f38254bf3aac89 # v4.1.0
      with:
        args: "format --check"

    - name: Lint with ruff
      env:
        RUFF_OUTPUT_FORMAT: github
      run: |
        ruff check

    - name: Typecheck with pyright
      uses: jakebailey/pyright-action@8ec14b5cfe41f26e5f41686a31eb6012758217ef # v3.0.2
      with:
        version: PATH

  tests:
    strategy:
      fail-fast: false
      matrix:
        os: ["ubuntu-latest", "windows-latest", "macos-latest"]
        python-version: ["3.11", "3.12", "3.13", "3.14"]
        include:
          - extras_best_effort: false  # If True, try to install each extra separately and skip those that fail to install
            skip_extras: ''            # JSON array of extras not to install
          - os: windows-latest
            extras_best_effort: true
          - os: ubuntu-latest
            # cvxopt 1.3.3 wheels for Linux are bundled with GLPK 4.65, which
            # has a known bug, see
            # https://github.com/cvxopt/cvxopt-wheels/issues/8
            skip_extras: '["glpk-mi"]'

    name: Python tests (${{ matrix.python-version }}, ${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
      id-token: write  # needed for the codecov actions to obtain a OIDC token
    env:
      UV_FROZEN: true

    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false

    - name: Set up Python ${{ matrix.python-version }} 🐍
      id: python
      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
      with:
        python-version: ${{ matrix.python-version }}

    - name: Install uv
      uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9  # v9.0.0
      with:
        enable-cache: | # zizmor: ignore[cache-poisoning] cache is disabled when publishing to prevent poisoning
          ${{ github.ref_type == 'tag' && 'false' || 'auto' }}
        cache-dependency-glob: "uv.lock"
        python-version: ${{ steps.python.outputs.python-path }}

    - name: Install dependencies
      run: uv sync

    - name: Install additional backends
      if: ${{ ! matrix.extras_best_effort && matrix.skip_extras == '' }}
      run: uv sync --all-extras

    # Windows runners do not have yq installed, so we use the official yq action instead
    - name: Enumerate backends
      id: backends
      uses: mikefarah/yq@1b9b4ac5187171d2e5e3129be0cfa827c7f9d53d  # v4.53.3
      if: ${{ matrix.extras_best_effort || matrix.skip_extras != '' }}
      with:
        cmd: |
          # for each extra, output the extra name followed by the listed dependencies, space-separated
          yq --output-format=yaml '
              .project.optional-dependencies
            | to_entries[]
            | .value |= join(" ")
            | "\(.key) \(.value)"
          ' pyproject.toml

    - name: Install additional backends (best effort)
      if: ${{ matrix.extras_best_effort || matrix.skip_extras != '' }}
      env:
        NO_COLOR: 1
        SKIP_EXTRAS: ${{ matrix.skip_extras && matrix.skip_extras || '[]' }}
        EXTRAS: ${{ steps.backends.outputs.result }}
      shell: bash
      run: |
        set -eu -o pipefail
        while read -r -a extra_deps; do
          extra_name="${extra_deps[0]}"
          if jq --exit-status --null-input --argjson skip_extras "${SKIP_EXTRAS}" --arg extra "${extra_name}" \
             '$skip_extras | contains([$extra])' > /dev/null;
          then
            echo "NOT installing $extra_name backend"
            continue
          fi
          deps=("${extra_deps[@]:1}")
          echo "::group::Installing $extra_name backend"
          uv pip install "${deps[@]}" \
            || IFS=' ' echo "::warning title=Could not install $extra_name solver backend::Failed to install ${deps[*]}"
          echo "::endgroup::"
        done <<< "$EXTRAS"

    - name: Test with pytest
      run: |
        # codecov requires that the test results are shared in xunit1 / legacy format.
        uv run pytest -v --junitxml=junit.xml -o junit_family=legacy

    - name: Upload coverage reports to Codecov
      uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
      with:
        use_oidc: true

    - name: Upload test results to Codecov
      if: ${{ !cancelled() }}
      uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
      with:
        report_type: test_results
        use_oidc: true

  test-summary:
    name: Test matrix status
    runs-on: ubuntu-latest
    needs:
      - linting
      - tests
    if: always()
    steps:
    - name: Decide whether the needed jobs succeeded or failed
      env:
        SUCCEEDED: ${{ !(contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped')) }}
      run: |
        echo "All jobs passed: ${SUCCEEDED}"
        if [ "${SUCCEEDED}" = 'false' ]; then exit 1; fi

  build:
    name: Build distribution 📦
    runs-on: ubuntu-latest
    permissions:
      contents: read
    env:
      UV_FROZEN: true
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
    needs:
      - test-summary

    outputs:
      version: ${{ steps.note.outputs.version }}
      prerelease: ${{ steps.note.outputs.prerelease }}

    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false

    - name: Set up Python 🐍
      id: python
      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
      with:
        python-version-file: "pyproject.toml"

    - name: Install uv
      uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
      with:
        enable-cache: false
        cache-dependency-glob: "uv.lock"
        python-version: ${{ steps.python.outputs.python-path }}

    - name: Build the Python 🐍 binary wheel and source tarball 📦
      id: build-dist
      run: |
        uv build
        rm -f dist/.gitignore  # get-releasenotes can't handle non-dist files here
        echo "version=$(uvx uv-dynamic-versioning@0.14.0)" >> "$GITHUB_OUTPUT"

    - name: Check build
      run: uvx twine@7.0.0 check --strict dist/*

    - name: Prepare Release Note
      id: note
      uses: aio-libs/get-releasenote@b0fcc7f3e5f5cc7c8b01e2f75516b1732f6bd8b2 # v1.4.5
      with:
        changes_file: CHANGELOG.md
        output_file: release_notes.md
        version: ${{ steps.build-dist.outputs.version }}
        start_line: '<!-- changes go below this line -->'
        head_line: '## \[{version}\] - {date}'
        name: Rummikub Solver library
        dist_dir: dist

    - name: Store the Python 🐍 distribution 📦
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        name: python-package-distributions
        path: |
          dist/
          release_notes.md

  pypi-publish:
    name: Upload release to PyPI
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
    needs:
      - build
    environment:
      name: pypi
      url: https://pypi.org/p/rummikub-solver
    permissions:
      id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
      contents: write  # required for creating GH releases

    steps:
    - name: Download Python 🐍 distribution 📦
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        name: python-package-distributions

    - name: Publish Python 🐍 distribution 📦 to PyPI
      uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

    - name: GitHub release
      env:
        RELEASE_TITLE: Rummikub Solver library ${{ needs.build.outputs.version }}
        PRERELEASE_SWITCH: ${{ case(fromJSON(needs.build.outputs.prerelease), '--prerelease', '') }}
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        GH_REPO: ${{ github.repository }}
      run: gh release create --title "${RELEASE_TITLE}" --notes-file release_notes.md "${PRERELEASE_SWITCH}" "${GITHUB_REF_NAME}" dist/*