ci.yml

name: CI

on:
  push:
    branches: [master]
  pull_request:
  workflow_dispatch:

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

# Read-only by default. A job that needs more asks for it itself, so a
# compromised dependency in one step cannot push to the repository.
permissions:
  contents: read

env:
  PYTHONUNBUFFERED: "1"
  PIP_DISABLE_PIP_VERSION_CHECK: "1"
  FORCE_COLOR: "1"

jobs:
  lint:
    name: Lint and types
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v7
        with:
          python-version: "3.12"
          cache: pip
          cache-dependency-path: pyproject.toml
      - run: pip install -e ".[dev]"
      # No `ruff format --check` yet: twenty files predate the formatter and
      # reformatting them belongs in its own commit, not in a lint gate that
      # would be red from the day it lands. pre-commit formats what a
      # contributor touches in the meantime.
      - name: ruff check
        run: python -m ruff check .
      - name: mypy
        run: python -m mypy glia

  test:
    name: Tests (Python ${{ matrix.python-version }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.11", "3.12"]
    steps:
      - uses: actions/checkout@v7

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v7
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip
          cache-dependency-path: pyproject.toml

      - name: Install (dev extras)
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"

      - name: Tests (pytest, fully offline) + coverage gate
        run: python -m pytest -q --cov=glia --cov-report=term-missing --cov-fail-under=90

      - name: Examples run offline
        run: |
          for f in examples/0*.py; do
            echo "--- $f ---"
            python "$f"
          done

  platforms:
    name: Tests (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [windows-latest, macos-latest]
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v7
        with:
          python-version: "3.12"
          cache: pip
          cache-dependency-path: pyproject.toml
      - run: pip install -e ".[dev]"
      # The suite only, without the coverage gate and the examples loop. The
      # shell ships Windows and macOS binaries, so the library underneath them
      # has to be known to work there; the gate and the examples are already
      # measured once on Linux and measuring them three times says nothing new.
      - name: Tests
        run: python -m pytest -q

  build:
    name: Package builds and installs cleanly
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v7
        with:
          python-version: "3.12"
      - run: pip install build twine
      - name: Build the wheel and sdist
        run: python -m build
      - name: Check the metadata
        run: twine check dist/*
      # An editable install hides packaging mistakes: it puts the working tree
      # on the path, so a module missing from the wheel still imports and a
      # broken console script still resolves.
      - name: Install the wheel into a clean environment
        run: |
          python -m venv /tmp/fresh
          /tmp/fresh/bin/pip install dist/*.whl
          # The distribution is glia-agents and the import package is glia.
          # That mismatch is the one packaging mistake nobody notices locally.
          /tmp/fresh/bin/python -c "import glia; print(glia.__name__)"
          /tmp/fresh/bin/glia-shell --help > /dev/null
      - uses: actions/upload-artifact@v7
        with:
          name: dist
          path: dist/
          retention-days: 14

  ci:
    name: CI
    runs-on: ubuntu-latest
    if: always()
    needs: [lint, test, platforms, build]
    steps:
      # One aggregate check to require in branch protection. Without it, adding
      # a job to the matrix silently leaves it unrequired, and a red job stops
      # blocking merges.
      - name: Fail if any job did not succeed
        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
        run: |
          echo "One or more jobs failed:"
          echo '${{ toJSON(needs) }}'
          exit 1
      - run: echo "All checks passed."