ci.yml

name: ci
on:
  push: ~
  pull_request: ~
jobs:
  test:
    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write

    strategy:
      fail-fast: false
      matrix:
        python-version: [ "3.10", "3.11", "3.12", "3.13", "3.14", "pypy-3.10", "pypy-3.11" ]
        regex: [ "1", "0" ]

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Install uv
        uses: astral-sh/setup-uv@v8.2.0
        with:
          python-version: ${{ matrix.python-version }}
          enable-cache: true

      - name: Git User config
        run: |
          git config --global user.email "action@github.com"
          git config --global user.name "github-actions"

      - name: Sync dependencies
        run: uv sync --no-dev --group test

      - name: Sync regex backend
        run: uv sync --no-dev --group test --extra native
        if: ${{ matrix.regex == '1' }}

      - name: Tests
        # --no-sync: keep the env from the sync step above; a bare `uv run` would
        # re-sync with the default dev group, pulling deps that don't build on PyPy.
        run: uv run --no-sync coverage run -m pytest
        env:
          REBULK_REGEX_ENABLED: ${{ matrix.regex }}

      - name: Coverage report
        # Fails the job below the fail_under threshold set in .coveragerc.
        run: uv run --no-sync coverage report

      - name: Coverage XML
        run: uv run --no-sync coverage xml

      - name: Build
        run: uv build

      - name: Codecov
        uses: codecov/codecov-action@v7
        with:
          use_oidc: true

  declared-keys-check:
    # Dedicated signal: run the suite with the opt-in declared-key value_type
    # contract check enabled, turning each declared Key.value_type into an
    # actively-enforced contract (see debug.CHECK_DECLARED_KEYS / issue #68).
    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository
    runs-on: ubuntu-latest

    strategy:
      fail-fast: false
      matrix:
        regex: [ "1", "0" ]

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Install uv
        uses: astral-sh/setup-uv@v8.2.0
        with:
          python-version: "3.14"
          enable-cache: true

      - name: Sync dependencies
        run: uv sync --no-dev --group test

      - name: Sync regex backend
        run: uv sync --no-dev --group test --extra native
        if: ${{ matrix.regex == '1' }}

      - name: Tests (declared-key contract check on)
        run: uv run --no-sync pytest
        env:
          REBULK_REGEX_ENABLED: ${{ matrix.regex }}
          REBULK_CHECK_DECLARED_KEYS: "1"

  pre-commit:
    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Install uv
        uses: astral-sh/setup-uv@v8.2.0
        with:
          python-version: "3.14"
          enable-cache: true

      - name: Sync dependencies
        run: uv sync --group dev

      # Runs the whole .pre-commit-config.yaml (ruff, ruff-format, mypy) — the same
      # hooks developers run locally, so CI and local stay in sync from one config.
      - name: Run pre-commit
        run: uv run pre-commit run --all-files --show-diff-on-failure

  commit-messages:
    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Install uv
        uses: astral-sh/setup-uv@v8.2.0
        with:
          python-version: "3.14"
          enable-cache: true

      - name: Sync dependencies
        run: uv sync --group dev

      # commitizen (same [tool.commitizen] config + pinned version as the local commit-msg hook).
      - name: Check commit messages
        run: |
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            git fetch --quiet origin "${{ github.base_ref }}"
            range="origin/${{ github.base_ref }}..HEAD"
          else
            before="${{ github.event.before }}"
            # No usable "before": a new branch (empty/zero sha) or a force-push
            # whose "before" commit is now orphaned and unreachable here.
            if [ -z "$before" ] || [ "$before" = "0000000000000000000000000000000000000000" ] \
              || ! git cat-file -e "$before^{commit}" 2>/dev/null; then
              range="HEAD~1..HEAD"
            else
              range="$before..${{ github.sha }}"
            fi
          fi
          echo "Checking commit messages in range: $range"
          uv run cz check --rev-range "$range"

  release:
    if: ${{ github.ref == 'refs/heads/main' && github.event_name == 'push' }}
    needs: [ test, pre-commit ]

    runs-on: ubuntu-latest

    environment: pypi

    permissions:
      contents: write   # semantic-release pushes the version commit + tag and creates the GitHub release
      id-token: write   # PyPI trusted publishing (OIDC), no long-lived token needed

    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Install uv
        uses: astral-sh/setup-uv@v8.2.0
        with:
          python-version: "3.14"
          enable-cache: true

      - name: Git User config
        run: |
          git config --global user.email "action@github.com"
          git config --global user.name "github-actions"

      - name: Sync dependencies
        run: uv sync --group dev

      - name: Bump version
        run: uv run semantic-release version
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload to PyPI
        run: uv publish --trusted-publishing always

      - name: Publish release
        run: uv run semantic-release publish
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Merge main to develop
        uses: robotology/gh-action-nightly-merge@v1.5.2
        with:
          stable_branch: 'main'
          development_branch: 'develop'
          allow_ff: true
          user_name: github-actions
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}