test.yml

#
# Copyright 2026 ABSA Group Limited
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

name: "Static analysis & tests"

on:
  push:
    branches: [ "master" ]
  pull_request:
    types: [ opened, synchronize, reopened ]
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  detect:
    name: Detect Python Changes
    runs-on: ubuntu-latest
    outputs:
      python_changed: ${{ steps.changes.outputs.python_changed }}
      docs_changed: ${{ steps.changes.outputs.docs_changed }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Check whether Python-related files changed
        id: changes
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail

          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            echo "python_changed=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
            changed_files=$(gh api \
              "repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files" \
              --paginate --jq '.[] | .filename, (.previous_filename // empty)')
          else
            changed_files=$(git diff --name-only --no-renames "${{ github.sha }}~1" "${{ github.sha }}")
          fi

          if echo "$changed_files" | grep -E '(\.py$|(^|/)requirements(-dev)?\.txt$|(^|/)pyproject\.toml$|(^|/)tests/fixtures/|[-.]schema\.json$|^Makefile$|^action\.yml$|^\.github/workflows/test\.yml$)' > /dev/null; then
            echo "python_changed=true" >> "$GITHUB_OUTPUT"
          else
            echo "python_changed=false" >> "$GITHUB_OUTPUT"
          fi

          # A Markdown, `action.yml` or other non-Python file the pages anchor runs the tests job too: tests/docs/
          # checks every tracked page, its anchors, examples and option lists against `action.yml`, and the root tests
          # read `action.yml`, the shell script and its example configuration. tests/docs/test_ci_filter.py keeps this
          # list complete.
          if echo "$changed_files" | grep -E '(\.([Mm][Dd]|[Mm][Aa][Rr][Kk][Dd][Oo][Ww][Nn])$|^action\.yml$|\.sh$|\.example$|^\.github/(dependabot\.yml|workflows/[^/]+\.ya?ml)$)' > /dev/null; then
            echo "docs_changed=true" >> "$GITHUB_OUTPUT"
          else
            echo "docs_changed=false" >> "$GITHUB_OUTPUT"
          fi

  static-checks:
    needs: detect
    if: needs.detect.outputs.python_changed == 'true'
    runs-on: ubuntu-latest
    name: ${{ matrix.task.name }} (Python 3.10)
    strategy:
      fail-fast: false
      matrix:
        task:
          - name: Black Format Check
            target: format-check
          - name: Ruff and Pylint Analysis
            target: lint
          - name: Mypy Type Check
            target: types
          - name: Undeclared Imports (deptry)
            target: deptry
          - name: No Vendored Schemas
            target: no-vendored-schemas
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
        with:
          python-version: "3.10"
          cache: 'pip'
          cache-dependency-path: |
            requirements*.txt
            packages/**/pyproject.toml
            apps/**/pyproject.toml

      - name: Install dependencies
        run: make install

      - name: Run ${{ matrix.task.name }}
        run: make ${{ matrix.task.target }}

  tests:
    needs: detect
    if: needs.detect.outputs.python_changed == 'true' || needs.detect.outputs.docs_changed == 'true'
    runs-on: ubuntu-latest
    name: Python Tests (Python ${{ matrix.python-version }})
    strategy:
      fail-fast: false
      matrix:
        python-version: [ "3.10", "3.11", "3.12", "3.13", "3.14" ]
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
        with:
          python-version: ${{ matrix.python-version }}
          cache: 'pip'
          cache-dependency-path: |
            requirements*.txt
            packages/**/pyproject.toml
            apps/**/pyproject.toml

      - name: Install dependencies
        run: make install

      - name: Run tests with coverage
        run: make coverage

  qa-gate:
    needs: [ detect, static-checks, tests ]
    if: always()
    runs-on: ubuntu-latest
    name: QA Gate
    steps:
      - name: Fail if any required job failed or was cancelled
        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
        run: |
          echo "::error::a required job failed or was cancelled."
          exit 1