ci-python-package.yaml

name: CI Python Package Plugins

on:
  push:
    branches: [main]
    paths:
      - "Makefile"
      - "pyproject.toml"
      - "uv.lock"
      - "plugins/python/**"
      - "plugins/tests/**"
      - "tools/**"
      - "tests/**"
      - ".github/workflows/ci-python-package.yaml"
      - ".github/workflows/release-python-package.yaml"
  pull_request:
    branches: [main]
    paths:
      - "Makefile"
      - "pyproject.toml"
      - "uv.lock"
      - "plugins/python/**"
      - "plugins/tests/**"
      - "tools/**"
      - "tests/**"
      - ".github/workflows/ci-python-package.yaml"
      - ".github/workflows/release-python-package.yaml"
  workflow_dispatch:

concurrency:
  group: ci-python-package-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.head_ref || github.ref_name }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read
  pull-requests: read

jobs:
  validate-and-detect:
    runs-on: ubuntu-latest
    outputs:
      python_plugins: ${{ steps.detect.outputs.python_plugins }}
      has_python_plugins: ${{ steps.detect.outputs.has_python_plugins }}
      python_plugin_count: ${{ steps.detect.outputs.python_plugin_count }}
      python_release_validation_tags: ${{ steps.detect.outputs.python_release_validation_tags }}
      has_python_release_validation_tags: ${{ steps.detect.outputs.has_python_release_validation_tags }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"

      - id: detect
        shell: bash
        run: |
          set -euo pipefail
          if [[ "${GITHUB_EVENT_NAME}" == "pull_request" ]]; then
            selection="$(python3 tools/plugin_catalog.py ci-selection . diff "${{ github.event.pull_request.base.sha }}" "${{ github.event.pull_request.head.sha }}")"
          elif [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
            selection="$(python3 tools/plugin_catalog.py ci-selection . all '' '')"
          elif [[ "${{ github.event.before }}" == "0000000000000000000000000000000000000000" ]]; then
            selection="$(python3 tools/plugin_catalog.py ci-selection . all '' '')"
          else
            selection="$(python3 tools/plugin_catalog.py ci-selection . diff "${{ github.event.before }}" "${{ github.sha }}")"
          fi

          selection="$(printf '%s' "${selection}" | python3 tools/validate_ci_selection.py)"
          python_plugins="$(printf '%s' "${selection}" | python3 -c 'import json, sys; print(json.dumps(json.load(sys.stdin)["python_plugins"]))')"
          has_python_plugins="$(printf '%s' "${selection}" | python3 -c 'import json, sys; print(str(json.load(sys.stdin)["has_python_plugins"]).lower())')"
          python_plugin_count="$(printf '%s' "${selection}" | python3 -c 'import json, sys; print(json.load(sys.stdin)["python_plugin_count"])')"
          python_release_validation_tags="$(printf '%s' "${selection}" | python3 -c 'import json, sys; print(json.dumps(json.load(sys.stdin)["python_release_validation_tags"]))')"
          has_python_release_validation_tags="$(printf '%s' "${selection}" | python3 -c 'import json, sys; print(str(json.load(sys.stdin)["has_python_release_validation_tags"]).lower())')"
          {
            echo "python_plugins=${python_plugins}"
            echo "has_python_plugins=${has_python_plugins}"
            echo "python_plugin_count=${python_plugin_count}"
            echo "python_release_validation_tags=${python_release_validation_tags}"
            echo "has_python_release_validation_tags=${has_python_release_validation_tags}"
          } >> "$GITHUB_OUTPUT"

  build-test:
    needs: validate-and-detect
    if: needs.validate-and-detect.outputs.has_python_plugins == 'true'
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        plugin: ${{ fromJson(needs.validate-and-detect.outputs.python_plugins) }}
    runs-on: ${{ matrix.os }}
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"

      - name: Install uv
        run: python -m pip install uv==0.9.30

      - name: Sync plugin environment
        working-directory: plugins/python/${{ matrix.plugin }}
        run: make sync

      - name: Plugin CI build verification
        if: matrix.os == 'ubuntu-latest'
        working-directory: plugins/python/${{ matrix.plugin }}
        run: make ci-build

      - name: Plugin CI verification
        if: matrix.os != 'ubuntu-latest'
        working-directory: plugins/python/${{ matrix.plugin }}
        run: make ci

  release-validation:
    if: github.event_name == 'pull_request' && needs.validate-and-detect.outputs.has_python_release_validation_tags == 'true'
    needs: validate-and-detect
    strategy:
      fail-fast: false
      matrix:
        tag: ${{ fromJson(needs.validate-and-detect.outputs.python_release_validation_tags) }}
    permissions:
      contents: read
      pull-requests: read
      id-token: write
    uses: ./.github/workflows/release-python-package.yaml
    with:
      tag: ${{ matrix.tag }}
      repository: testpypi
      publish_enabled: false

  create-release-tags:
    needs:
      - validate-and-detect
      - build-test
      - release-validation
    if: >-
      ${{
        always() &&
        github.event_name == 'push' &&
        github.ref == 'refs/heads/main' &&
        needs.validate-and-detect.outputs.has_python_release_validation_tags == 'true' &&
        needs.build-test.result == 'success' &&
        (needs.release-validation.result == 'success' || needs.release-validation.result == 'skipped')
      }}
    runs-on: ubuntu-latest
    permissions:
      actions: write
      contents: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Create release tags for bumped plugin versions
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAGS: ${{ needs.validate-and-detect.outputs.python_release_validation_tags }}
        run: |
          set -euo pipefail
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          while IFS= read -r tag; do
            if [[ ! "${tag}" =~ ^[a-zA-Z0-9._-]+$ ]]; then
              echo "ERROR: unexpected characters in tag '${tag}'; aborting." >&2
              exit 1
            fi
            if remote_sha="$(git ls-remote --exit-code --tags origin "refs/tags/${tag}" | awk '{print $1}')"; then
              if [[ "${remote_sha}" != "${GITHUB_SHA}" ]]; then
                echo "FATAL: tag '${tag}' already exists at ${remote_sha}, expected ${GITHUB_SHA}." >&2
                exit 1
              fi
              echo "Tag ${tag} already exists remotely at ${GITHUB_SHA}; skipping tag creation."
            else
              if git show-ref --verify --quiet "refs/tags/${tag}"; then
                local_sha="$(git rev-list -n 1 "${tag}")"
                if [[ "${local_sha}" != "${GITHUB_SHA}" ]]; then
                  echo "FATAL: local tag '${tag}' exists at ${local_sha}, expected ${GITHUB_SHA}." >&2
                  exit 1
                fi
              else
                git tag "${tag}" "${GITHUB_SHA}"
              fi
              git push origin "refs/tags/${tag}" || {
                if remote_sha="$(git ls-remote --exit-code --tags origin "refs/tags/${tag}" | awk '{print $1}')" &&
                  [[ "${remote_sha}" == "${GITHUB_SHA}" ]]; then
                  echo "Tag ${tag} already exists remotely at ${GITHUB_SHA}; skipping."
                else
                  echo "FATAL: push of '${tag}' failed." >&2
                  exit 1
                fi
              }
            fi
            gh workflow run release-python-package.yaml \
              --ref "${tag}" \
              -f "tag=${tag}" \
              -f repository=pypi \
              -f publish_enabled=true
            release_run_url="$(gh run list -w release-python-package.yaml --limit 1 --json url --jq '.[0].url')"
            echo "Dispatched PyPI release workflow for ${tag}: ${release_run_url}"
          done < <(python3 -c 'import json, os; [print(tag) for tag in json.loads(os.environ["RELEASE_TAGS"])]')