ci.yml

name: CI

on:
  push:
    branches: [main]
    paths:
      - "src/**"
      - "tests/**"
      - "packages/**"
      - "pyproject.toml"
      - "uv.lock"
      - ".github/workflows/**"
  pull_request:
    branches: [main]
    paths:
      - "src/**"
      - "tests/**"
      - "packages/**"
      - "pyproject.toml"
      - "uv.lock"
      - ".github/workflows/**"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  security:
    name: Security Scan
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Run zizmor
        uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # v0.5.0
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          inputs: .github/workflows/
          token: ${{ secrets.GITHUB_TOKEN }}
          online-audits: false

  validate:
    name: Validate
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Set up uv
        uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0
        with:
          version: "0.10.2"
          enable-cache: true

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.14"

      - name: Create virtual environment
        run: uv sync --all-extras --dev

      - name: Run ruff check
        run: uv run ruff check

      - name: Run ruff format check
        run: uv run ruff format --check

      - name: Run ty type checker
        run: uvx ty check src packages/pretalx-client/src

  test-smoke:
    name: Test Smoke (3.14/Django ${{ matrix.django }}/${{ matrix.os }})
    needs: [validate]
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
    strategy:
      fail-fast: true
      matrix:
        os: [ubuntu-latest, windows-latest]
        django: ["5.2", "6.0"]
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Set up uv
        uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0
        with:
          version: "0.10.2"
          enable-cache: true

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.14"

      - name: Install dependencies
        run: uv sync --all-extras --dev

      - name: Install Django ${{ matrix.django }}
        if: matrix.django != '5.2'
        run: uv pip install --no-config 'django~=${{ matrix.django }}.0'

      - name: Run tests
        run: |
          uv run pytest tests/
          uv run pytest packages/pretalx-client/tests/

  test-full:
    name: Test (3.14/${{ matrix.os }})
    needs: [test-smoke]
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        os: [macos-latest]
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Set up uv
        uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0
        with:
          version: "0.10.2"
          enable-cache: true

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.14"

      - name: Install dependencies
        run: uv sync --all-extras --dev

      - name: Run tests
        run: |
          uv run pytest tests/ --cov=src/django_program --cov-report= --cov-fail-under=0
          uv run pytest packages/pretalx-client/tests/

      - name: Upload coverage data artifact
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
        with:
          name: coverage-data
          path: .coverage*
          include-hidden-files: true

  coverage:
    name: Coverage (3.14/macos-latest)
    needs: [test-full]
    runs-on: macos-latest
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Set up uv
        uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0
        with:
          version: "0.10.2"
          enable-cache: true

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.14"

      - name: Install dependencies
        run: uv sync --all-extras --dev

      - name: Download coverage data artifact
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          name: coverage-data
          path: .

      - name: Generate coverage report
        run: |
          uv run coverage report --show-missing --fail-under=100
          uv run coverage xml -o coverage.xml

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
        with:
          file: ./coverage.xml
          fail_ci_if_error: false
          token: ${{ secrets.CODECOV_TOKEN }}

  ci-success:
    name: CI Success
    runs-on: ubuntu-latest
    needs: [security, validate, test-smoke, test-full, coverage]
    if: always()
    permissions:
      contents: read
    steps:
      - name: Check CI results
        env:
          SECURITY_RESULT: ${{ needs.security.result }}
          VALIDATE_RESULT: ${{ needs.validate.result }}
          SMOKE_RESULT: ${{ needs.test-smoke.result }}
          FULL_RESULT: ${{ needs.test-full.result }}
          COVERAGE_RESULT: ${{ needs.coverage.result }}
        run: |
          for result in "${SECURITY_RESULT}" "${VALIDATE_RESULT}" "${SMOKE_RESULT}" "${FULL_RESULT}" "${COVERAGE_RESULT}"; do
            if [[ "${result}" != "success" ]]; then
              echo "CI failed! Result: ${result}"
              exit 1
            fi
          done

          echo "CI passed!"