qa-analysis.yml

name: Quality Assurance

on:
  workflow_dispatch:
  push:
    branches:
      - main
  # PRs trigger for all the default events
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  FORCE_COLOR: 3
  COLUMNS: 120
  CPM_USE_LOCAL_PACKAGES: "TRUE"

jobs:
  cpp-changes:
    name: Detect C++ file changes
    runs-on: ubuntu-slim
    outputs:
      any: ${{ steps.detect.outputs.any_changed }}
      files: ${{ steps.detect.outputs.all_changed_files }}

    steps:
      - uses: actions/checkout@v7.0.1
        with:
          fetch-depth: 0

      - name: Detect C++ file changes
        id: detect
        uses: tj-actions/changed-files@v47.0.6
        with:
          matrix: true
          files: |
            cpp/monoprop/**/*.cpp
            cpp/monoprop/**/*.h
            cpp/monoprop/**/*.inl
            cpp/include/monoprop/**/*.h
            cpp/include/monoprop/**/*.inl

  coverage-run:
    name: Collect coverage [mpi:${{ matrix.mpi }}]
    runs-on: ubuntu-26.04
    strategy:
      fail-fast: false
      matrix:
        mpi: ["off", "on"]
    steps:
      - uses: actions/checkout@v7.0.1
        with:
          fetch-depth: 0

      - name: Set up the build environment
        uses: ./.github/actions/setup
        with:
          cache-suffix: coverage-mpi-${{ matrix.mpi }}
          mpi: ${{ matrix.mpi }}

      - name: Collect coverage
        run: |
          just code-coverage-collect \
            "${{ matrix.mpi }}" \
            build/editable/Coverage \
            coverage-data

      - name: Upload coverage data
        uses: actions/upload-artifact@v7
        with:
          name: coverage-mpi-${{ matrix.mpi }}
          path: coverage-data
          include-hidden-files: true
          if-no-files-found: error
          retention-days: 1

  code-coverage:
    name: Check code coverage
    runs-on: ubuntu-26.04
    needs: [coverage-run]

    steps:
      - uses: actions/checkout@v7.0.1
        with:
          fetch-depth: 0

      - name: Set up the build environment
        uses: ./.github/actions/setup
        with:
          cache-suffix: coverage-report

      - name: Download coverage data
        uses: actions/download-artifact@v8
        with:
          pattern: coverage-mpi-*
          path: coverage-input

      - name: Combine coverage
        run: |
          just code-coverage-aggregate \
            coverage-input/coverage-mpi-off \
            coverage-input/coverage-mpi-on \
            .

      - name: Upload combined coverage to Codecov
        uses: codecov/codecov-action@v7.0.0
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: python-coverage.xml, cpp-coverage-through-python-bindings.xml, cpp-coverage.xml
          flags: cpp
          disable_search: true
          fail_ci_if_error: true

      - name: Upload coverage reports for SonarQube
        uses: actions/upload-artifact@v7
        with:
          name: coverage-reports
          path: |
            python-coverage.xml
            cpp-coverage-through-python-bindings-sonar.xml
            cpp-coverage-sonar.xml
          if-no-files-found: error
          retention-days: 1

  gcc-asan-ubsan:
    name: GCC ASan+LSan+UBSan
    runs-on: ubuntu-26.04
    permissions:
      contents: read
    # The build type also selects the tree the test recipes run against.
    env:
      SKBUILD_CMAKE_BUILD_TYPE: "AsanUbsan"
      SKBUILD_CMAKE_DEFINE: "monoprop_SANITIZER=asan-ubsan"

    steps:
      - uses: actions/checkout@v7.0.1
        with:
          fetch-depth: 0

      - name: Set up the build environment
        uses: ./.github/actions/setup
        with:
          cache-suffix: gcc-asan-ubsan

      - name: Install package
        run: just build --group workspace-test

      - name: Run C++ unit tests
        run: just test-cpp-asan

      - name: Run Python tests
        run: just test-py-asan

      - name: Show sanitizer reports
        if: failure()
        run: just sanitizer-reports

  gcc-tsan:
    # TSan cannot load instrumented _core into stock CPython; Python coverage needs an
    # instrumented interpreter. C++ tests cover the relevant partition and ShmComm paths.
    name: GCC ThreadSanitizer (C++)
    runs-on: ubuntu-26.04
    permissions:
      contents: read
    env:
      SKBUILD_CMAKE_BUILD_TYPE: "Tsan"
      SKBUILD_CMAKE_DEFINE: "monoprop_SANITIZER=tsan"

    steps:
      - uses: actions/checkout@v7.0.1
        with:
          fetch-depth: 0

      - name: Set up the build environment
        uses: ./.github/actions/setup
        with:
          cache-suffix: gcc-tsan

      - name: Install package
        run: just build --group workspace-test

      - name: Run C++ partition and ShmComm tests
        run: just test-cpp-tsan

  sonarqube-analysis:
    name: SonarQube analysis
    runs-on: ubuntu-26.04
    needs: [code-coverage]

    steps:
      - uses: actions/checkout@v7.0.1
        with:
          fetch-depth: 0

      - name: Set up the build environment
        uses: ./.github/actions/setup
        with:
          cache-suffix: sonarqube-mpi
          mpi: "on"

      - name: Install package
        env:
          SKBUILD_CMAKE_DEFINE: "monoprop_ENABLE_CXX_UNIT_TESTS=OFF"
          monoprop_ENABLE_MPI: "ON"
        run: just build

      - name: Download coverage reports
        uses: actions/download-artifact@v8
        with:
          name: coverage-reports

      - name: SonarQube Scan
        uses: SonarSource/sonarqube-scan-action@v8.2.1
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        with:
          args: >
            -Dsonar.cfamily.compile-commands=build/editable/Release/compile_commands.json

  clang-tidy:
    needs: [cpp-changes]
    # Skip when no production C++ sources or headers changed.
    if: ${{ needs.cpp-changes.outputs.any == 'true' }}

    permissions:
      contents: read

    name: clang-tidy analysis
    runs-on: ubuntu-26.04
    continue-on-error: true

    steps:
      - uses: actions/checkout@v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set up the build environment
        uses: ./.github/actions/setup
        with:
          cache-suffix: clang-tidy-mpi
          mpi: "on"

      - name: Build (generates compile_commands.json)
        env:
          SKBUILD_CMAKE_DEFINE: "CMAKE_CXX_COMPILER=clang++;monoprop_ENABLE_CXX_UNIT_TESTS=OFF"
          monoprop_ENABLE_MPI: "ON"
        run: just build

      - name: Register clang-tidy problem matcher
        run: echo "::add-matcher::.github/problem-matchers/clang-tidy.json"

      - name: Run clang-tidy via run-clang-tidy
        env:
          CHANGED_CXX_FILES: ${{ needs.cpp-changes.outputs.files }}
          FORCE_COLOR: "0"
        run: |
          set -o pipefail

          mapfile -t changed_cpp_files < <(
            jq -r --arg workspace "$GITHUB_WORKSPACE/" \
              '.[] | select(endswith(".cpp")) | $workspace + .' <<< "$CHANGED_CXX_FILES"
          )

          if jq -e 'any(.[]; test("\\.(h|inl)$"))' <<< "$CHANGED_CXX_FILES" > /dev/null; then
            mapfile -t clang_tidy_inputs < <(
              jq -r --arg source_root "$GITHUB_WORKSPACE/cpp/monoprop/" \
                '.[].file | select(startswith($source_root)) | select(endswith(".cpp"))' \
                build/editable/Release/compile_commands.json
            )
          else
            clang_tidy_inputs=("${changed_cpp_files[@]}")
          fi

          line_filter=$(jq -cn \
            --arg workspace "$GITHUB_WORKSPACE/" \
            --argjson files "$CHANGED_CXX_FILES" \
            '$files | map({name: ($workspace + .), lines: [[1, 2147483647]]})')

          run-clang-tidy \
            -p build/editable/Release \
            -source-filter='^${{ github.workspace }}/cpp/monoprop/.*$' \
            -header-filter='^(.*/)?cpp/(include/)?monoprop/.*$' \
            -exclude-header-filter='^.*/src/monoprop/bindings/.*$' \
            -line-filter="$line_filter" \
            -extra-arg=-fno-color-diagnostics \
            -j "$(nproc)" \
            "${clang_tidy_inputs[@]}" \
            2>&1 | tee /tmp/clang-tidy-output.txt

      - name: Remove clang-tidy problem matcher
        if: always()
        run: echo "::remove-matcher owner=clang-tidy::"