ci.yaml

name: CI

on:
  push:
    branches: [ master ]
    paths:
      - '**.py'
      - 'pyproject.toml'
      - 'uv.lock'
      - '**/ci.yaml'
      - '!airflow_dbt_python/__version__.py'
    tags:
      - "v*"
  pull_request:
    branches:
      - master
    paths:
      - '**.py'
      - 'pyproject.toml'
      - 'uv.lock'
      - '**/ci.yaml'
      - '!airflow_dbt_python/__version__.py'

jobs:
  test:
    name: Test on Python ${{ matrix.python-version }} and Airflow ${{ matrix.airflow-version }} and dbt ${{ matrix.dbt-version }}
    strategy:
      fail-fast: false
      matrix:
        python-version:
          - '3.13'
          - '3.12'
          - '3.11'
          - '3.10'
        airflow-version:
          # Latest release as of 2025-12-27
          # See: https://airflow.apache.org/docs/apache-airflow/stable/release_notes.html
          - '3.1.5'
          # GCP Cloud Composer latest as of 2025-12-27
          # See: https://docs.cloud.google.com/composer/docs/composer-versions
          # TODO: Uncomment once 'SUPERVISOR_COMMS' import bug is figured out
          # This is fixed in later versions of Airflow.
          # - '3.1.0'
          # AWS MWAA latest as of 2025-12-27
          # See: https://docs.aws.amazon.com/mwaa/latest/userguide/airflow-versions.html
          - '3.0.6'
        dbt-version:
          - '1.11.2'
          - '1.10.17'
        exclude:
          # Airflow added 3.13 support in >=3.1
          - airflow-version: '3.0.6'
            python-version: '3.13'

    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@v2.14.0
        with:
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            files.pythonhosted.org:443
            hub.getdbt.com:443
            github.com:80
            github.com:443
            release-assets.githubusercontent.com:443
            gitlab.com:22
            gitlab.com:80
            gitlab.com:443
            objects.githubusercontent.com:443
            raw.githubusercontent.com:443
            pypi.org:443
            archive.ubuntu.com:80
            azure.archive.ubuntu.com:80
            esm.ubuntu.com:443
            motd.ubuntu.com:443
            packages.microsoft.com:80
            packages.microsoft.com:443
            ppa.launchpadcontent.net:443
            security.ubuntu.com:80

      - run: |
          sudo apt-get update
          sudo apt-get install --yes --no-install-recommends postgresql

      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install uv
        uses: astral-sh/setup-uv@v7
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install Airflow & dbt
        run: |
          uv add "apache-airflow==${{ matrix.airflow-version }}; python_version=='${{ matrix.python-version }}'" \
                 "dbt-core==${{ matrix.dbt-version }}"
          uv sync --all-extras --dev
          uv run airflow db migrate
          uv run airflow connections create-default-connections

      - name: Linting with ruff
        run: uv run ruff check .

      - name: Static type checking with mypy
        # We only run mypy on the latest supported versions of Airflow & dbt,
        if: matrix.python-version == '3.13' && matrix.airflow-version == '3.1.1' && matrix.dbt-version == '1.11.12'
        run: uv run mypy .

      - name: Code formatting with ruff
        run: uv run ruff format --check .

      - name: Set COVERAGE_FILE in environment
        run: echo "COVERAGE_FILE=.coverage.${{ matrix.python-version }}-${{ matrix.airflow-version }}-${{ matrix.dbt-version }}" >> $GITHUB_ENV

      - name: Run tests with pytest
        run: uv run coverage run -m pytest -v tests/ airflow_dbt_python/utils/
        env:
          GITLAB_READ_TOKEN: ${{ secrets.GITLAB_READ_TOKEN }}
          GITLAB_USERNAME: ${{ secrets.GITLAB_USERNAME }}
          GITHUB_READ_TOKEN: ${{ secrets.GH_READ_TOKEN }}
          GITHUB_USERNAME: ${{ secrets.GH_USERNAME }}

      - name: Upload code coverage
        uses: actions/upload-artifact@v4
        with:
          name: coverage-data-${{ matrix.python-version }}-${{ matrix.airflow-version }}-${{ matrix.dbt-version }}
          path: ".coverage.*"
          include-hidden-files: true

  coverage:
    name: Combine and check coverage
    runs-on: ubuntu-latest
    needs: test

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@v2.14.0
        with:
          egress-policy: block
          allowed-endpoints: >
            files.pythonhosted.org:443
            github.com:443
            release-assets.githubusercontent.com:443
            api.github.com:443
            pypi.org:443

      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up Python '3.13'
        uses: actions/setup-python@v6
        with:
          python-version: '3.13'

      - name: Install uv
        uses: astral-sh/setup-uv@v7
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install airflow-dbt-python with uv
        run: uv sync --dev --extra airflow-providers

      - name: Download coverage data.
        uses: actions/download-artifact@v4
        with:
          merge-multiple: true

      - name: Combine coverage & fail if it's <95%.
        run: |
          uv run coverage combine
          uv run coverage html --skip-covered --skip-empty
          uv run coverage json
          # Save in env variable for badge
          export TOTAL=$(python -c "import json;print(json.load(open('coverage.json'))['totals']['percent_covered_display'])")
          echo "total=$TOTAL" >> $GITHUB_ENV
          # Report and write to summary.
          uv run coverage report | sed 's/^/    /' >> $GITHUB_STEP_SUMMARY
          # Report again and fail if under 100%.
          uv run coverage report --fail-under=95

      - name: Upload HTML report if check failed.
        uses: actions/upload-artifact@v4
        if: ${{ failure() }}
        with:
          name: html-report
          path: htmlcov

      - name: "Make coverage badge"
        uses: schneegans/dynamic-badges-action@v1.7.0
        if: github.event_name != 'pull_request'
        with:
          auth: ${{ secrets.GIST_TOKEN }}
          gistID: 81ef37701aa088d18db8a58ce07c79c7 # pragma: allowlist secret
          filename: covbadge.json
          label: Coverage
          message: ${{ env.total }}%
          minColorRange: 50
          maxColorRange: 90
          valColorRange: ${{ env.total }}

  release:
    runs-on: ubuntu-latest
    needs: test
    if: github.ref_type == 'tag'
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@v2.14.0
        with:
          egress-policy: audit
          allowed-endpoints: >
            files.pythonhosted.org:443
            github.com:443
            release-assets.githubusercontent.com:443
            api.github.com:443
            pypi.org:443

      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up Python '3.13'
        uses: actions/setup-python@v6
        with:
          python-version: '3.13'

      - name: Install uv
        uses: astral-sh/setup-uv@v7
        with:
          python-version: 3.13

      - name: Install airflow-dbt-python with uv
        run: uv sync --no-dev

      - name: Build airflow-dbt-python with uv
        run: uv build

      - name: Set prerelease variable
        run: echo "IS_PRERELEASE=$(if $(uv version --short | grep -qP '^[0-9]+\.[0-9]+\.[0-9]+$'); then echo 'false'; else echo 'true'; fi)" >> $GITHUB_ENV

      - name: Set release git tag
        run: echo "RELEASE_TAG=${{ github.ref_name }}" >> $GITHUB_ENV

      - name: Check tag matches package version
        run: if [[ "$(uv version --short)" == ${RELEASE_TAG/v/} ]]; then exit 0; else exit 1; fi

      - name: Release new tag
        uses: softprops/action-gh-release@v1
        with:
          prerelease: ${{ fromJSON(env.IS_PRERELEASE) }}
          token: ${{ secrets.GH_DEPLOY_TOKEN }}
          files: |
            dist/*