ci.yml

# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

name: ci

on:
  pull_request:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  checks:
    name: checks
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: jdx/mise-action@f5be966e4a917d54244728e6a5fdcd1d93a35e6c # v5.2.6

      # fetch-core.sh reads proto/ and sdk/conformance from NVIDIA/OpenShell
      # at the pinned ref (public, no credentials).
      - name: Format, lint, typecheck, proto and fixture drift
        run: mise run check

  test:
    name: test (${{ matrix.python }})
    runs-on: ubuntu-latest
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        # Keep in sync with requires-python and the classifiers in pyproject.toml.
        python: ["3.11", "3.12", "3.13", "3.14"]
    env:
      UV_PYTHON: ${{ matrix.python }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: jdx/mise-action@f5be966e4a917d54244728e6a5fdcd1d93a35e6c # v5.2.6

      - name: Unit tests
        run: mise run test

  build:
    name: build
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          # setuptools-scm reads the version from git history.
          fetch-depth: 0

      - uses: jdx/mise-action@f5be966e4a917d54244728e6a5fdcd1d93a35e6c # v5.2.6

      - name: Build, verify, and install the wheel and sdist
        run: mise run build

  e2e:
    name: e2e
    uses: ./.github/workflows/e2e.yml

  # The one required status check. Its name matches ai-openshell/sdk-go, so
  # rulesets can require `ci` in every SDK repository regardless of the jobs
  # each one runs.
  ci:
    name: ci
    if: always()
    needs: [checks, test, build]
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Require every job to succeed
        env:
          RESULTS: ${{ join(needs.*.result, ' ') }}
        run: |
          for result in $RESULTS; do
            if [ "$result" != success ]; then
              echo "::error::a required job finished with '$result' ($RESULTS)"
              exit 1
            fi
          done