ci.yml

name: CI

on:
  push:
    branches:
      - main
    tags:
      - '**'
  pull_request: {}

env:
  CI: true
  COLUMNS: 120
  UV_PYTHON: 3.12
  UV_FROZEN: '1'

jobs:
  server-lint:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '18.x'

      - run: npm install
      - run: npm run lint
      - run: npm run build

  cli-lint:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - uses: astral-sh/setup-uv@v5
        with:
          enable-cache: true

      - run: uv sync
        working-directory: cli

      - uses: pre-commit/action@v3.0.0
        with:
          extra_args: --all-files --verbose
        env:
          SKIP: lint-js

  cli-test:
    name: cli-test-${{ matrix.os }}-py${{ matrix.python-version }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu, macos]
        python-version: ['3.9', '3.10', '3.11', '3.12', '3.13']

    runs-on: ${{ matrix.os }}-latest
    env:
      UV_PYTHON: ${{ matrix.python-version }}

    steps:
      - uses: actions/checkout@v4

      - uses: astral-sh/setup-uv@v5
        with:
          enable-cache: true

      - run: mkdir coverage

      - run: uv run coverage run -m pytest
        working-directory: cli
        env:
          COVERAGE_FILE: ../coverage/.coverage.${{ matrix.os }}-py${{ matrix.python-version }}

      - name: store coverage files
        uses: actions/upload-artifact@v4
        with:
          name: coverage-${{ matrix.os }}-py${{ matrix.python-version }}
          path: coverage
          include-hidden-files: true

  cli-coverage-check:
    # dogfooding! use smokeshow to view our coverage report
    needs: [cli-test]
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - uses: astral-sh/setup-uv@v5
        with:
          enable-cache: true

      - name: get coverage files
        uses: actions/download-artifact@v4
        with:
          merge-multiple: true
          path: cli

      - run: uv sync
        working-directory: cli

      - name: build coverage
        run: |
          uv run coverage combine
          uv run coverage html -i
        working-directory: cli

      - run: uv run -m smokeshow upload htmlcov
        working-directory: cli
        env:
          SMOKESHOW_GITHUB_STATUS_DESCRIPTION: CLI Coverage {coverage-percentage}
          SMOKESHOW_GITHUB_COVERAGE_THRESHOLD: 90
          SMOKESHOW_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SMOKESHOW_GITHUB_PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}

  deploy-cf-staging:
    runs-on: ubuntu-latest
    needs: [server-lint]
    environment: cloudflare-staging-deploy

    steps:
      - uses: actions/checkout@v4

      - uses: cloudflare/wrangler-action@v3
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          command: >
            deploy
            --var GITHUB_SHA:${{ github.sha }}
            --var GITHUB_REF:${{ github.ref }}
            --var POSTGREST_ROOT:${{ secrets.POSTGREST_ROOT }}
            --var POSTGREST_APIKEY:${{ secrets.POSTGREST_APIKEY }}

  check:  # Used for branch protection
    if: always()
    needs: [server-lint, cli-lint, cli-test, cli-coverage-check, deploy-cf-staging]
    runs-on: ubuntu-latest

    steps:
      - name: Decide whether the needed jobs succeeded or failed
        uses: re-actors/alls-green@release/v1
        id: all-green
        with:
          jobs: ${{ toJSON(needs) }}

  deploy-cf-prod:
    if: "success() && github.ref == 'refs/heads/main'"
    runs-on: ubuntu-latest
    needs: [check]
    environment: cloudflare-production-deploy

    steps:
      - uses: actions/checkout@v4

      - uses: cloudflare/wrangler-action@v3
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          command: >
            deploy
            -e production
            --var GITHUB_SHA:${{ github.sha }}
            --var GITHUB_REF:${{ github.ref }}
            --var POSTGREST_ROOT:${{ secrets.POSTGREST_ROOT }}
            --var POSTGREST_APIKEY:${{ secrets.POSTGREST_APIKEY }}

  release:
    needs: [check]
    if: "success() && startsWith(github.ref, 'refs/tags/')"
    runs-on: ubuntu-latest
    environment: release-cli

    permissions:
      id-token: write

    steps:
      - uses: actions/checkout@v4

      - uses: astral-sh/setup-uv@v5
        with:
          enable-cache: true

      - name: check GITHUB_REF matches package version
        uses: samuelcolvin/check-python-version@v4.1
        with:
          version_file_path: 'cli/pyproject.toml'

      - run: uv build

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          skip-existing: true
          packages-dir: cli/dist/