python_ci.yaml

name: python-ci

on:
  release:
    types: [ created ]
  pull_request:
  push:
    branches:
      - main
    paths:
      - 'python/**'
      - 'rust/crates/sift_stream_bindings/**'
      - '.github/workflows/python_ci.yaml'
  workflow_call:

permissions:
  contents: read
  pull-requests: read

jobs:
  changes:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    outputs:
      python: ${{ steps.filter.outputs.python }}
    steps:
      - uses: actions/checkout@v4
      - uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: |
            python:
              - 'python/**'
              - 'rust/crates/sift_stream_bindings/**'
              - '.github/workflows/python_ci.yaml'

  static-checks:
    needs: [changes]
    if: |
      always() &&
      (github.event_name != 'pull_request' || needs.changes.outputs.python == 'true')
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: python
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Set up uv
        uses: astral-sh/setup-uv@v6
        with:
          enable-cache: true

      - name: Set up just
        uses: extractions/setup-just@v4

      - name: Verify lockfile is up to date
        run: uv lock --check

      - name: Install dependencies
        run: uv sync --extra dev-all

      - name: Lint
        run: just lint

      - name: Format
        run: just fmt-check

      - name: MyPy
        run: just mypy

      # Re-run mypy with --platform=win32 so typeshed evaluates platform-gated
      # stubs (e.g. fcntl) as if we were on Windows. Catches imports that
      # would only fail at runtime on Windows.
      - name: MyPy (Windows platform)
        run: just mypy-win

      - name: Pyright
        run: just pyright

      - name: Check Stubs Generation
        working-directory: .
        run: just python::stubs-check

      - name: Check Extras Generation
        working-directory: .
        run: just python::extras-check

      - name: Sync Stubs Mypy
        working-directory: python/lib
        run: |
          uv run stubtest \
            --mypy-config-file ../pyproject.toml \
            sift_client.resources.sync_stubs

  test-python:
    needs: [changes]
    if: |
      always() &&
      (github.event_name != 'pull_request' || needs.changes.outputs.python == 'true')
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: python
    strategy:
      fail-fast: false
      matrix:
        # Floor (3.8, per `requires-python`). This is the bug class local
        # checks miss (devs run a newer Python; modern syntax slips into
        # code that runs on 3.8). Ceiling testing is rarely useful in
        # practice — Python's deprecation cycle is long and the project's
        # stdlib usage is conservative — so it stays available locally as
        # `just test-ceiling` rather than running on every PR.
        # The full 3.8-3.14 install matrix lives in `python_build.yaml`.
        python-version: ["3.8"]
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Set up uv
        uses: astral-sh/setup-uv@v6
        with:
          enable-cache: true

      - name: Set up just
        uses: extractions/setup-just@v4

      - name: Install dependencies (Python ${{ matrix.python-version }})
        run: uv sync --python ${{ matrix.python-version }} --extra dev-all

      # The venv is synced to the matrix Python above, so `just test`
      # (uv run pytest) collects against that interpreter.
      - name: Pytest Unit Tests (Python ${{ matrix.python-version }})
        run: just test

      # Disabling integration tests that interact with Sift until a better solution is implemented
      # - name: Pytest Integration Tests
      #   env:
      #     SIFT_GRPC_URI: ${{ vars.SIFT_GRPC_URI }}
      #     SIFT_REST_URI: ${{ vars.SIFT_REST_URI }}
      #     SIFT_API_KEY: ${{ secrets.SIFT_API_KEY }}
      #     SIFT_REPORT_TEST_SYSTEM_NAME: github-actions
      #   run: |
      #     uv run --python ${{ matrix.python-version }} --no-project --with-editable '.[dev-all]' pytest -m "integration"

  # Run the pytest-plugin test subset against pytest 7/8/9 to catch breakage
  # from pytest internals the plugin reads (see the private-surface inventory in
  # steps.py). The subset is self-contained (drives inner pytester sessions, no
  # third-party-plugin imports), so each cell installs only the project + a
  # target pytest + pytest-randomly — sidestepping the pinned plugin stack and
  # the locked pytest==8.2.2 (we don't pull the dev extra). The full suite still
  # runs on the locked pytest in `test-python`. pytest uses `~=` bounded to the
  # major so new minors/patches are picked up automatically (early break
  # detection); pytest-randomly is pinned per cell to its Python-floor-compatible
  # release (it is kept so the suite runs under randomized order). Keep this
  # subset free of third-party-plugin imports or the lean install breaks.
  test-pytest-compat:
    needs: [changes]
    if: |
      always() &&
      (github.event_name != 'pull_request' || needs.changes.outputs.python == 'true')
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: python
    strategy:
      fail-fast: false
      matrix:
        # pytest line <-> compatible Python <-> compatible pytest-randomly pin
        include:
          - { python-version: "3.8",  pytest-spec: "~=7.4", randomly-version: "3.15.0" }
          - { python-version: "3.9",  pytest-spec: "~=8.4", randomly-version: "3.16.0" }
          - { python-version: "3.10", pytest-spec: "~=9.0", randomly-version: "4.1.0" }
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Set up uv
        uses: astral-sh/setup-uv@v6
        with:
          enable-cache: true

      - name: Plugin tests (Python ${{ matrix.python-version }}, pytest ${{ matrix.pytest-spec }})
        # The plugin imports grpc, and runpytest_subprocess forks the session;
        # fork support keeps grpc's epoll engine from aborting in the parent on
        # CI Linux (see the suite's conftest).
        env:
          GRPC_ENABLE_FORK_SUPPORT: "1"
        run: |
          uv run --python ${{ matrix.python-version }} --no-project --with-editable '.' \
            --with "pytest${{ matrix.pytest-spec }}" \
            --with "pytest-randomly==${{ matrix.randomly-version }}" \
            pytest lib/sift_client/_tests/pytest_plugin -m "plugin_compat"

  python-ci-status:
    if: always()
    needs: [changes, static-checks, test-python, test-pytest-compat]
    runs-on: ubuntu-latest
    steps:
      - name: Check result
        run: |
          static="${{ needs.static-checks.result }}"
          tests="${{ needs.test-python.result }}"
          compat="${{ needs.test-pytest-compat.result }}"
          if [[ ("$static" == "success" || "$static" == "skipped") && ("$tests" == "success" || "$tests" == "skipped") && ("$compat" == "success" || "$compat" == "skipped") ]]; then
            echo "python-ci passed (static-checks: $static, test-python: $tests, test-pytest-compat: $compat)"
          else
            echo "python-ci failed (static-checks: $static, test-python: $tests, test-pytest-compat: $compat)"
            exit 1
          fi