.github/workflows/python-ci.yml

#
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
#

name: "Python CI"

on:
  push:
    branches:
    - 'main'
  pull_request:
    paths:
    - '**'                              # Include all files and directories in the repository by default.
    - '!.github/workflows/**'           # Exclude all workflow files
    - '.github/workflows/python-ci.yml' # except the current file.
    - '!.github/ISSUE_TEMPLATE/**'      # Exclude files and directories that don't impact tests or code like templates, metadata, and documentation.
    - '!.gitignore'
    - '!.asf.yml'
    - '!mkdocs/**'
    - '!.gitattributes'
    - '!README.md'
    - '!CONTRIBUTING.md'
    - '!LICENSE'
    - '!NOTICE'

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  lint-and-unit-test:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    strategy:
      max-parallel: 15
      fail-fast: true
      matrix:
        python: ['3.10', '3.11', '3.12', '3.13', '3.14']

    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false
    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
      with:
        python-version: ${{ matrix.python }}
    - name: Install UV
      uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
      with:
        enable-cache: true
    - name: Install system dependencies
      run: sudo apt-get update && sudo apt-get install -y libkrb5-dev # for kerberos
    - name: Check uv.lock is up to date
      run: uv lock --check
    - name: Install
      run: make install
    - name: Run linters
      run: make lint
    - name: Run unit tests with coverage
      run: COVERAGE=1 make test
    - name: Generate coverage report (85%) # Coverage threshold should only increase over time — never decrease it!
      run: COVERAGE_FAIL_UNDER=85 make coverage-report

  cibw-dev-env-smoke-test:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false
    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
      with:
        python-version: '3.12'
    - name: Install UV
      uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
      with:
        enable-cache: true
    # Why this exists:
    # Catch import-time regressions (e.g., global conftest optional deps)
    # in the same dev-only environment used by cibuildwheel wheel tests.
    # Keep this in sync with wheel build test setup in
    # .github/workflows/pypi-build-artifacts.yml:
    #   CIBW_BEFORE_TEST: uv sync --directory {project} --only-group dev --no-install-project
    #   CIBW_TEST_COMMAND: uv run --directory {project} pytest tests/avro/test_decoder.py
    - name: Mirror wheel CIBW_BEFORE_TEST
      run: uv sync --directory . --only-group dev --no-install-project
    - name: Mirror wheel CIBW_TEST_COMMAND
      run: uv run --directory . pytest tests/avro/test_decoder.py