# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
#
---
name: prek

on:  # yamllint disable-line rule:truthy
  pull_request:
  push:
    branches: [main]

permissions: {}

jobs:
  prek:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          persist-credentials: false
      # `uv` brings its own Python and is required by both:
      #  - the four `workspace-*` prek hooks in
      #    `.pre-commit-config.yaml`, which call
      #    `tools/dev/run-workspace-check.sh` to iterate over every
      #    workspace member declared in the root pyproject's
      #    `[tool.uv.workspace] members` list and invoke ruff /
      #    mypy / pytest in each via `uv run --directory`;
      #  - the `uv tool install prek` step below.
      # Minimum uv version is pinned in the root `pyproject.toml`
      # (`[tool.uv] required-version`).
      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
        with:
          enable-cache: true
      # Sync the uv workspace with the dev group so that
      # `ruff`, `mypy`, and `pytest` (declared at workspace root)
      # are present in the shared `.venv`. The `workspace-*` hooks
      # in `.pre-commit-config.yaml` call
      # `tools/dev/run-workspace-check.sh`, which invokes
      # `uv run --directory <member> <check>`; without the explicit
      # sync, the auto-sync uv runs on `uv run` only resolves
      # member runtime deps and the dev tools are missing.
      - name: Sync workspace (installs ruff / mypy / pytest from root dev group)
        # `--all-packages` is required — without it `uv sync` only
        # installs the root project's deps, and the root has
        # `package = false` so member packages and their
        # `[project.scripts]` entry points would be skipped.
        run: uv sync --all-packages --group dev
      # Cache prek's hook environments. The `lychee` hook is
      # `language: rust` with `additional_dependencies: [cli:lychee:…]`,
      # so prek `cargo install`s lychee into a hook env under
      # `~/.cache/prek` — a multi-minute compile. Caching that dir
      # reuses the built binary (and every other hook env) across runs;
      # keyed on the prek config so a hook/version change busts it.
      - name: Cache prek hook environments
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
        with:
          path: ~/.cache/prek
          key: prek-${{ runner.os }}-${{ hashFiles('.pre-commit-config.yaml') }}
          restore-keys: |
            prek-${{ runner.os }}-
      # Restore the lychee result cache so external-URL checks reuse
      # results across runs (`.lychee.toml` sets `max_cache_age = "7d"`).
      - name: Cache lychee link-check results
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
        with:
          path: .lycheecache
          key: cache-lychee-${{ github.sha }}
          restore-keys: |
            cache-lychee-
      # Install prek via uv (rather than via the `j178/prek-action`
      # action) so the `[tool.uv] exclude-newer` cooldown in the
      # root `pyproject.toml` applies to the prek install as well.
      - name: Install prek
        run: uv tool install prek
      - name: Run prek
        # GITHUB_TOKEN lets the `lychee` hook authenticate its
        # github.com link checks — unauthenticated requests get
        # rate-limited (429) once a run checks more than a handful of
        # GitHub URLs. lychee reads GITHUB_TOKEN automatically; the
        # job's `contents: read` scope is sufficient for link checking.
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        # `--skip workspace-pytest`: pytest already runs in CI as the
        # dedicated, path-filtered `tests` workflow matrix
        # (`.github/workflows/tests.yml`). Running it a second time here
        # (bundled across every workspace member) is pure duplication in
        # CI, so skip it — the hook still runs locally on `git commit` /
        # `prek run`, where there is no separate matrix.
        #
        # `--verbose`: without it prek renders a progress UI that a
        # non-TTY CI log buffers and only flushes at the end, so a long
        # run shows nothing while it works. Verbose prints each hook's
        # result and output as it completes, giving live progress in the
        # Actions log.
        run: >-
          prek run --show-diff-on-failure --color=always --all-files
          --verbose --skip workspace-pytest