python-package.yml

name: CI_TEST

on:
  push:
    branches: [master]
  pull_request:
    branches: [master]
  workflow_dispatch: # allow manual run

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint:
    runs-on: ubuntu-latest

    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
      with:
        egress-policy: audit
        # azure.archive.ubuntu.com:80           - Ubuntu apt packages
        # esm.ubuntu.com:443                    - Ubuntu ESM security updates
        # files.pythonhosted.org:443            - Python package downloads
        # ftp-chi.osuosl.org:443                - Python mirror fallback (Chicago)
        # ftp-nyc.osuosl.org:443                - Python mirror fallback (NYC)
        # github.com:443                        - Git operations / Actions
        # api.github.com:443                    - GitHub API
        # int.api.stepsecurity.io:443           - harden-runner telemetry
        # mirror.xmission.com:443               - Python mirror fallback (Utah)
        # motd.ubuntu.com:443                   - Ubuntu MOTD
        # packages.microsoft.com:443            - Microsoft apt repo (ubuntu-latest runner)
        # ppa.launchpadcontent.net:443          - Ubuntu PPA
        # pypi.org:443                          - PyPI package index
        # objects.githubusercontent.com:443     - GitHub release artifacts / LFS
        allowed-endpoints: >
          azure.archive.ubuntu.com:80
          esm.ubuntu.com:443
          files.pythonhosted.org:443
          ftp-chi.osuosl.org:443
          ftp-nyc.osuosl.org:443
          github.com:443
          api.github.com:443
          int.api.stepsecurity.io:443
          mirror.xmission.com:443
          motd.ubuntu.com:443
          packages.microsoft.com:443
          ppa.launchpadcontent.net:443
          pypi.org:443
          objects.githubusercontent.com:443

    - name: Checkout
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

    - name: Install uv
      uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0

    - name: Install python
      run: uv python install

    - name: Install dependencies
      run: |
        sudo apt-get update; sudo apt-get install libkrb5-dev gcc

    - name: Lint with ruff
      run: |
        uv run ruff check jenkinsapi/ --output-format full

  build:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        # Keep in sync with requires-python and classifiers in pyproject.toml
        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]

    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
      with:
        egress-policy: audit
        # azure.archive.ubuntu.com:80           - Ubuntu apt packages
        # esm.ubuntu.com:443                    - Ubuntu ESM security updates
        # files.pythonhosted.org:443            - Python package downloads
        # ftp-chi.osuosl.org:443                - Python mirror fallback (Chicago)
        # ftp-nyc.osuosl.org:443                - Python mirror fallback (NYC)
        # github.com:443                        - Git operations / Actions
        # api.github.com:443                    - GitHub API
        # int.api.stepsecurity.io:443           - harden-runner telemetry
        # mirror.xmission.com:443               - Python mirror fallback (Utah)
        # motd.ubuntu.com:443                   - Ubuntu MOTD
        # packages.microsoft.com:443            - Microsoft apt repo (ubuntu-latest runner)
        # ppa.launchpadcontent.net:443          - Ubuntu PPA
        # pypi.org:443                          - PyPI package index
        # objects.githubusercontent.com:443     - GitHub release artifacts / LFS
        allowed-endpoints: >
          azure.archive.ubuntu.com:80
          esm.ubuntu.com:443
          files.pythonhosted.org:443
          ftp-chi.osuosl.org:443
          ftp-nyc.osuosl.org:443
          github.com:443
          api.github.com:443
          int.api.stepsecurity.io:443
          mirror.xmission.com:443
          motd.ubuntu.com:443
          packages.microsoft.com:443
          ppa.launchpadcontent.net:443
          pypi.org:443
          objects.githubusercontent.com:443

    - name: Checkout
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

    - name: Install uv
      uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
      with:
        python-version: ${{ matrix.python-version }}

    - name: Install python
      run: uv python install

    - name: Install dependencies
      run: |
        sudo apt-get update; sudo apt-get install libkrb5-dev gcc

    - name: Prepare Docker image
      uses: ./.github/actions/docker-image-prep
      with:
        image_name: ghcr.io/${{ github.repository_owner }}/jenkinsapi

    - name: Test with pytest
      run: |
        NUM_WORKERS=auto
        echo "Running full test suite with xdist mode '$NUM_WORKERS' ($(nproc) CPUs available)"
        uv run pytest -sv -n $NUM_WORKERS --tb=short \
          --cov=jenkinsapi --cov-report=term-missing --cov-report=xml \
          --junit-xml=test-results.xml \
          jenkinsapi_tests

    - name: Upload test results
      if: always()
      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
      with:
        name: test-results-py${{ matrix.python-version }}
        path: test-results.xml

  test-macos:
    # macOS: unit tests only. GitHub Actions macOS runners are themselves VMs
    # and do not expose the Hypervisor Framework (HVF) to nested processes,
    # so QEMU-backed Docker (Lima/Colima) cannot start. Systests are covered
    # by the Linux build job; macOS validates pure-Python portability.
    runs-on: macos-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.13"]

    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
      with:
        egress-policy: audit

    - name: Checkout
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

    - name: Install uv
      uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
      with:
        python-version: ${{ matrix.python-version }}

    - name: Install python
      run: uv python install

    - name: Install Kerberos (macOS)
      run: |
        brew install krb5
        KRB5_PREFIX=$(brew --prefix krb5)
        echo "PKG_CONFIG_PATH=${KRB5_PREFIX}/lib/pkgconfig" >> "$GITHUB_ENV"
        echo "KRB5_CONFIG=${KRB5_PREFIX}/etc/krb5.conf" >> "$GITHUB_ENV"

    - name: Install project dependencies
      run: uv sync --all-groups

    - name: Unit tests (macOS)
      run: |
        uv run pytest -sv -n auto --cov=jenkinsapi --cov-report=term-missing \
          jenkinsapi_tests/unittests/ -m "not docker"

  test-windows:
    # Windows: unit tests only. requests-kerberos on Windows uses winkerberos
    # (Windows SSPI) — no system Kerberos library needed. Linux containers
    # are not reliably available on Windows CI runners, so systests are
    # skipped; they are covered by the Linux build job.
    runs-on: windows-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.13"]

    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
      with:
        egress-policy: audit

    - name: Checkout
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

    - name: Install uv
      uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
      with:
        python-version: ${{ matrix.python-version }}

    - name: Install python
      run: uv python install

    - name: Install project dependencies
      run: uv sync --all-groups
      shell: pwsh

    - name: Unit tests (Windows)
      run: |
        uv run pytest -sv -n auto --cov=jenkinsapi --cov-report=term-missing `
          jenkinsapi_tests/unittests/ -m "not docker"
      shell: pwsh