CI.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: "-D warnings"

jobs:
  # README/CHANGELOG/CONTRIBUTING/SECURITY are generated by
  # @ktav-lang/polydoc from the root-docs/ unit trees. This job fails when a
  # committed artifact drifts from its source — which is what a hand-edit of
  # the artifact looks like. The artifacts live partly at the repo root and
  # partly under docs/<lang>/ (see the OUT_PATHS table in
  # scripts/build-docs.mjs), but all of them are generated: fix the unit
  # source and re-run the generator; never patch the artifact.
  docs:
    name: Docs (generated markdown)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v4
        with:
          node-version: '24'
          cache: 'npm'

      - name: Install Node dependencies
        run: npm ci

      - name: Generated docs are byte-identical to their source units
        run: node scripts/build-docs.mjs --check

  python-lint:
    name: Python lint + typecheck
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"
          cache: pip
      - name: Install lint tooling
        # ruff is pinned exactly (kept in sync with the "dev" extra in
        # pyproject.toml) so this gate only moves when someone deliberately
        # moves it — an unpinned install once went red on a Markdown-
        # formatting change nobody in this repo made.
        run: python -m pip install ruff==0.16.8 mypy
      - name: Ruff check
        run: ruff check .
      - name: Ruff format check
        run: ruff format --check .
      - name: Mypy
        run: mypy python

  rust-lint:
    name: Rust fmt + clippy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@v2
      - name: cargo fmt
        run: cargo fmt --check
      - name: cargo clippy
        run: cargo clippy --all-targets -- -D warnings

  test:
    name: Test ${{ matrix.os }} / Python ${{ matrix.python }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        python: ["3.9", "3.11", "3.13"]
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: recursive
      - uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python }}
          cache: pip
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Create venv
        run: python -m venv .venv
      - name: Export venv to PATH and VIRTUAL_ENV
        shell: python
        run: |
          import os, sys
          venv = os.path.abspath(".venv")
          bin_dir = os.path.join(venv, "Scripts" if sys.platform == "win32" else "bin")
          with open(os.environ["GITHUB_PATH"], "a") as f:
              f.write(bin_dir + "\n")
          with open(os.environ["GITHUB_ENV"], "a") as f:
              f.write(f"VIRTUAL_ENV={venv}\n")
      - name: Install test tooling
        run: python -m pip install --upgrade pip maturin pytest pytest-cov
      - name: Build extension (release)
        run: maturin develop --release
      - name: Pytest
        run: pytest -v

  # Guarantees the three OS × Python matrix all pass before merging; useful
  # as a required check in branch protection without listing every cell.
  test-summary:
    name: Test summary
    runs-on: ubuntu-latest
    needs: [test]
    if: always()
    steps:
      - name: Fail if any matrix job failed
        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
        run: exit 1