.github/workflows/ci.yml

name: CI

on:
  push:
    branches: [main, 'release/*']
  pull_request:
    branches: [main, 'release/*']

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  pre-commit:
    name: Pre-commit hooks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install uv
        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          enable-cache: true
      - name: Install locked dependencies
        run: uv sync --locked
      - name: Verify PEP 723 script lockfile
        run: uv lock --script runtime/run_mcp.py --check
      # Runs every hook in .pre-commit-config.yaml (ruff lint, file hygiene,
      # uv-lock) against all files. commit-msg hooks are skipped by --all-files.
      - name: Run pre-commit
        run: uv run pre-commit run --all-files --show-diff-on-failure
        env:
          # Cache hook environments across CI runs.
          PRE_COMMIT_HOME: ${{ github.workspace }}/.cache/pre-commit

  license-headers:
    name: Apache 2.0 license headers
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      # Fails if any tracked Python, shell, JavaScript, CSS, or HTML file is missing
      # the Apache 2.0 preamble. Stdlib only, so no dependency install needed.
      - name: Check license headers
        run: python3 scripts/check_license_headers.py

  test:
    name: Pytest (py${{ matrix.python-version }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install uv
        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          enable-cache: true
      - name: Install locked dependencies
        run: uv sync --locked --python ${{ matrix.python-version }}
      - name: Validate finalized release into main
        if: github.event_name == 'pull_request' && github.base_ref == 'main' && startsWith(github.head_ref, 'release/')
        env:
          RELEASE_BRANCH: ${{ github.head_ref }}
        run: |
          test "$(uv run python scripts/check_release.py)" = "${RELEASE_BRANCH#release/}"
          uv run python scripts/check_release.py --notes
      - name: Run tests
        run: uv run pytest

  package:
    name: Package build and wheel smoke
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install uv
        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          enable-cache: true
      - name: Build wheel and source distribution
        run: uv build
      - name: Smoke-test built wheel
        run: |
          set -euo pipefail
          uv venv --python 3.12 "$RUNNER_TEMP/package-smoke"
          uv pip install --python "$RUNNER_TEMP/package-smoke/bin/python" dist/*.whl
          "$RUNNER_TEMP/package-smoke/bin/python" -c "import dataiku_mcp"