ci.yml

name: CI

on:
  pull_request:
  push:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  tests:
    name: Tests (Python ${{ matrix.python-version }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install -e .[dev]

      - name: Run tests
        run: python -m pytest -m "not integration"

  coverage:
    name: Code coverage
    runs-on: ubuntu-latest
    needs: tests

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"
          cache: pip

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install -e .[dev]

      - name: Run tests with coverage
        run: >-
          python -m pytest
          -m "not integration"
          --cov=glpi_python_client
          --cov-report=term-missing
          --cov-report=xml
          --cov-fail-under=95

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v4
        with:
          files: ./coverage.xml
          fail_ci_if_error: false
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  quality:
    name: Lint, typing, and docs
    runs-on: ubuntu-latest

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"
          cache: pip

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install -e .[dev]

      - name: Run Ruff
        run: python -m ruff check .

      - name: Run mypy
        run: python -m mypy glpi_python_client

      # The sync client tree is generated from the async one and checked in.
      # This catches a _sync/ left stale by an edit to _async/. It does NOT
      # catch a token collision -- that is deterministic, so regenerating
      # reproduces it and the diff stays clean. test_unasync_codegen.py
      # covers that case.
      - name: Check the generated sync tree is up to date
        run: python unasync_build.py --check

      # The unit suite lives inside the package directory, so a lost
      # exclusion pattern silently republishes it. Assert the built wheel,
      # not just the config that is supposed to produce it.
      - name: Build the wheel and assert it ships no tests
        run: |
          python -m build --wheel --outdir dist_check .
          python - <<'PY'
          import glob, sys, zipfile

          wheel = sorted(glob.glob("dist_check/*.whl"))[-1]
          names = zipfile.ZipFile(wheel).namelist()
          shipped = [n for n in names if "/tests/" in n or n.endswith("conftest.py")]
          if shipped:
              sys.exit("wheel ships test files:\n  " + "\n  ".join(shipped))
          if "glpi_python_client/testing/utils.py" not in names:
              sys.exit("wheel is missing the documented testing helpers")
          print(f"wheel is clean: {len(names)} entries, no tests")
          PY

      - name: Build documentation
        run: python -m sphinx -W --keep-going -b html docs docs/_build/html

  publish-readthedocs:
    name: Publish latest docs
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    needs:
      - tests
      - coverage
      - quality
    runs-on: ubuntu-latest
    env:
      READTHEDOCS_BASE_URL: ${{ vars.READTHEDOCS_BASE_URL }}
      READTHEDOCS_PROJECT: ${{ secrets.READTHEDOCS_PROJECT }}
      READTHEDOCS_TOKEN: ${{ secrets.READTHEDOCS_TOKEN }}
      READTHEDOCS_VERSION: ${{ vars.READTHEDOCS_MAIN_VERSION }}

    steps:
      - name: Trigger Read the Docs latest build
        shell: bash
        run: |
          set -euo pipefail
          if [ -z "${READTHEDOCS_TOKEN:-}" ] || [ -z "${READTHEDOCS_PROJECT:-}" ]; then
            echo "Read the Docs secrets are not configured; skipping latest build."
            exit 0
          fi

          base_url="${READTHEDOCS_BASE_URL:-https://app.readthedocs.org}"
          version="${READTHEDOCS_VERSION:-latest}"

          curl --fail --silent --show-error --location \
            --request POST \
            --header "Authorization: Token ${READTHEDOCS_TOKEN}" \
            "${base_url}/api/v3/projects/${READTHEDOCS_PROJECT}/versions/${version}/builds/"