ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  # Fail if uv.lock is stale rather than silently resolving something else.
  UV_FROZEN: "1"

jobs:
  lint:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
        with: { enable-cache: true }
      - run: uv sync --all-packages --group lint
      - run: uv run ruff format --check --diff .
        id: fmt
      # Report both failures rather than stopping at the first.
      - run: uv run ruff check --output-format=github .
        if: success() || steps.fmt.conclusion == 'failure'

  lock:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
      - run: uv lock --check

  typecheck:
    # One OS, because pythonPlatform is "All": pyright checks every platform's
    # branch wherever it runs, so three runners did identical work and would
    # have reported identical results. It used to be three because the default
    # setting skips the other platforms' code as unreachable -- which also
    # meant a mistake in the POSIX console could only be caught by a POSIX
    # runner, so the matrix was buying less than it looked.
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
        with: { enable-cache: true }
      - run: uv sync --all-packages --all-groups
      - run: uv run pyright

  test:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-24.04, macos-15, windows-2025, windows-11-arm]
        python: ["3.11", "3.12", "3.13", "3.14"]
    runs-on: ${{ matrix.os }}
    env:
      PYTHONDEVMODE: "1"
      PYTHONWARNDEFAULTENCODING: "1"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
        with:
          enable-cache: true
          python-version: ${{ matrix.python }}
      - run: uv sync --all-packages --all-groups
      - run: uv run coverage run -m pytest -v -m "not hardware"
      - run: uv run coverage combine
        if: always()
      - run: uv run coverage xml
        if: always()
      # Named per runner so that the coverage job can put them in one folder,
      # and kept as data rather than only as XML: a report combined across the
      # runners needs what each of them measured, not each one's conclusion.
      - name: Name the coverage data after this runner
        if: always()
        run: mv .coverage .coverage.${{ matrix.os }}-${{ matrix.python }}
        shell: bash
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        if: always()
        with:
          name: coverage-xml-${{ matrix.os }}-${{ matrix.python }}
          path: coverage.xml
          if-no-files-found: ignore
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        if: always()
        with:
          name: coverage-data-${{ matrix.os }}-${{ matrix.python }}
          # Hidden files are skipped unless asked for, and every coverage data
          # file begins with a dot.
          include-hidden-files: true
          path: .coverage.${{ matrix.os }}-${{ matrix.python }}
          if-no-files-found: ignore

  coverage:
    # The gate, and the only place the number means anything. One runner on
    # its own reads two or three points lower, because the other platforms'
    # backends -- the AF_UNIX listener, the named pipe, the two ways of reading
    # a keystroke -- count as missed there and are only credited once the runs
    # are put together. Measured: Windows alone 85%, Linux alone 84%, the two
    # combined 87%, with ipc/backend/posix.py going from 0% to 91% and
    # console/windows.py from 0% to 47%.
    needs: test
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
        with: { enable-cache: true }
      - run: uv sync --all-packages --all-groups
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          # The data files only. Flattening the XML reports as well would put
          # several files called coverage.xml in one folder.
          pattern: coverage-data-*
          path: coverage-data
          merge-multiple: true
      - run: uv run coverage combine coverage-data
      # Explicit rather than the fail_under in pyproject.toml, which is the
      # weaker number a single-runner report is measured against.
      - run: uv run coverage report --fail-under=85

  build:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
      - run: uv build --all-packages
      # What PyPI will say about these before PyPI is the one saying it. The
      # metadata is only rendered at upload, so without this a broken readme
      # or an unrecognised classifier is found at the worst moment.
      - run: uvx twine check --strict dist/*
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with: { name: dist, path: dist/ }