ntc-ci.yml

---
# Reusable CI workflow for Network to Code projects.
#
# Supports two project types generated from NTC cookiecutters:
#   - "nautobot-app":   cookiecutter-nautobot-app (development/Dockerfile, invoke unittest, coverage comment)
#   - "python-library": cookiecutter-ntc python template (./Dockerfile, invoke pytest), e.g. pyntc, netutils
#
# Call it from a repo's .github/workflows/ci.yml:
#
#   jobs:
#     ci:
#       uses: "networktocode/github-reusable-workflows/.github/workflows/ntc-ci.yml@main"
#       with:
#         project_type: "nautobot-app"
#         project_name: "nautobot-golden-config"
#         min_nautobot_version: "3.1.0"
#
# The `on:` triggers, `concurrency` and `permissions` stay in the calling workflow.
name: "NTC CI"

on:  # yamllint disable-line rule:truthy rule:comments
  workflow_call:
    inputs:
      project_type:
        description: "'nautobot-app' or 'python-library'. Selects the docker build, test runner and default lint set."
        required: true
        type: "string"
      project_name:
        description: "Distribution / image name (e.g. nautobot-golden-config, pyntc, netutils). INVOKE_<NAME>_* env vars use it upper-cased with '-' replaced by '_'."
        required: true
        type: "string"
      min_nautobot_version:
        description: "nautobot-app only (required): lowest supported Nautobot version, used for the docker checks and the minimum unit test run."
        required: false
        type: "string"
        default: ""
      min_python_version:
        description: "Lowest supported Python version."
        required: false
        type: "string"
        default: "3.10"
      max_python_version:
        description: "Highest supported Python version."
        required: false
        type: "string"
        default: "3.14"
      python_versions:
        description: "python-library only: JSON list of Python versions for the docker checks and pytest matrices. Defaults to [min_python_version, max_python_version]."
        required: false
        type: "string"
        default: ""
      poetry_version:
        description: "Poetry version to install on the runners."
        required: false
        type: "string"
        default: "2.1.3"
      regenerate_lockfile:
        description: "'true' to lint against a freshly regenerated poetry.lock, 'false' to use the committed one. Defaults to true for nautobot-app and false for python-library."
        required: false
        type: "string"
        default: ""
      lint_checks:
        description: >-
          JSON list of lint checks to run, each an invoke task name ('ruff-format' and 'ruff-lint' map to the ruff task).
          Defaults to ruff-format, ruff-lint, djlint, yamllint, markdownlint for nautobot-app and
          ruff-format, ruff-lint, yamllint for python-library. Add 'mypy' for typed libraries.
        required: false
        type: "string"
        default: ""
      check_docs:
        description: "Run 'invoke build-and-check-docs'."
        required: false
        type: "boolean"
        default: true
      unittest_matrix:
        description: >-
          JSON object used as the unit test job's strategy.matrix. nautobot-app default: postgres on min Python for both
          min and stable Nautobot, plus mysql on max Python for stable Nautobot. python-library default: python_versions.
        required: false
        type: "string"
        default: ""
      unittest_runner:
        description: "Runner label for the unit test job (some apps pin ubuntu-22.04)."
        required: false
        type: "string"
        default: "ubuntu-latest"
      changelog_base_branches:
        description: "JSON list of PR base branches that require a towncrier fragment and get a coverage comment."
        required: false
        type: "string"
        default: >-
          ["develop"]
      coverage_minimum_green:
        description: "nautobot-app only: coverage percentage at or above which the coverage comment is green."
        required: false
        type: "number"
        default: 90
      coverage_minimum_orange:
        description: "nautobot-app only: coverage percentage at or above which the coverage comment is orange (below is red)."
        required: false
        type: "number"
        default: 80
    secrets:
      ARTIFACTORY_USERNAME:
        description: "Commercial projects only: username for the private artifactory-pypi Poetry source."
        required: false
      ARTIFACTORY_PASSWORD:
        description: "Commercial projects only: password for the private artifactory-pypi Poetry source."
        required: false

env:
  PROJECT_TYPE: "${{ inputs.project_type }}"
  PROJECT_NAME: "${{ inputs.project_name }}"
  # Empty for OSS projects; Poetry only uses them when pyproject.toml declares an "artifactory-pypi" source.
  POETRY_HTTP_BASIC_ARTIFACTORY_PYPI_USERNAME: "${{ secrets.ARTIFACTORY_USERNAME }}"
  POETRY_HTTP_BASIC_ARTIFACTORY_PYPI_PASSWORD: "${{ secrets.ARTIFACTORY_PASSWORD }}"

jobs:
  config:
    name: "Resolve configuration"
    runs-on: "ubuntu-latest"
    outputs:
      invoke_context_name: "${{ steps.resolve.outputs.invoke_context_name }}"
      regenerate_lockfile: "${{ steps.resolve.outputs.regenerate_lockfile }}"
      lint_matrix: "${{ steps.resolve.outputs.lint_matrix }}"
      docker_check_matrix: "${{ steps.resolve.outputs.docker_check_matrix }}"
      unittest_matrix: "${{ steps.resolve.outputs.unittest_matrix }}"
      is_feature_pr: "${{ steps.resolve.outputs.is_feature_pr }}"
    steps:
      - name: "Resolve invoke context, matrices and PR type"
        id: "resolve"
        env:
          MIN_NAUTOBOT_VERSION: "${{ inputs.min_nautobot_version }}"
          MIN_PYTHON_VERSION: "${{ inputs.min_python_version }}"
          MAX_PYTHON_VERSION: "${{ inputs.max_python_version }}"
          PYTHON_VERSIONS: "${{ inputs.python_versions }}"
          REGENERATE_LOCKFILE: "${{ inputs.regenerate_lockfile }}"
          LINT_CHECKS: "${{ inputs.lint_checks }}"
          UNITTEST_MATRIX: "${{ inputs.unittest_matrix }}"
          # A "feature PR" targets one of the changelog base branches and is not a release/main merge-back PR.
          IS_FEATURE_PR: >-
            ${{
              github.event_name == 'pull_request' &&
              contains(fromJSON(inputs.changelog_base_branches), github.base_ref) &&
              github.head_ref != 'main' &&
              !startsWith(github.head_ref, 'release')
            }}
        run: |
          case "$PROJECT_TYPE" in
            nautobot-app)
              if [ -z "$MIN_NAUTOBOT_VERSION" ]; then
                echo "::error::min_nautobot_version is required when project_type is 'nautobot-app'"
                exit 1
              fi
              ;;
            python-library) ;;
            *) echo "::error::project_type must be 'nautobot-app' or 'python-library' (got '$PROJECT_TYPE')"; exit 1 ;;
          esac

          INVOKE_CONTEXT_NAME=$(echo "$PROJECT_NAME" | tr '[:lower:]-' '[:upper:]_')

          if [ -z "$REGENERATE_LOCKFILE" ]; then
            [ "$PROJECT_TYPE" = "nautobot-app" ] && REGENERATE_LOCKFILE="true" || REGENERATE_LOCKFILE="false"
          fi
          case "$REGENERATE_LOCKFILE" in
            true|false) ;;
            *) echo "::error::regenerate_lockfile must be 'true' or 'false' (got '$REGENERATE_LOCKFILE')"; exit 1 ;;
          esac

          if [ -z "$PYTHON_VERSIONS" ]; then
            PYTHON_VERSIONS=$(jq -cn --arg a "$MIN_PYTHON_VERSION" --arg b "$MAX_PYTHON_VERSION" '[$a, $b] | unique')
          fi

          if [ -z "$LINT_CHECKS" ]; then
            if [ "$PROJECT_TYPE" = "nautobot-app" ]; then
              LINT_CHECKS='["ruff-format", "ruff-lint", "djlint", "yamllint", "markdownlint"]'
            else
              LINT_CHECKS='["ruff-format", "ruff-lint", "yamllint"]'
            fi
          fi
          # Map check names to invoke commands; anything not in the map is used as the invoke task name.
          LINT_MATRIX=$(echo "$LINT_CHECKS" | jq -c '
            {"ruff-format": "ruff --action format", "ruff-lint": "ruff --action lint"} as $map
            | {include: map({check: ., command: ($map[.] // .)})}')

          if [ "$PROJECT_TYPE" = "nautobot-app" ]; then
            DOCKER_CHECK_MATRIX=$(jq -cn --arg py "$MIN_PYTHON_VERSION" --arg nb "$MIN_NAUTOBOT_VERSION" \
              '{"python-version": [$py], "nautobot-version": [$nb]}')
          else
            DOCKER_CHECK_MATRIX=$(echo "$PYTHON_VERSIONS" | jq -c '{"python-version": .}')
          fi

          if [ -z "$UNITTEST_MATRIX" ]; then
            if [ "$PROJECT_TYPE" = "nautobot-app" ]; then
              UNITTEST_MATRIX=$(jq -cn \
                --arg min_py "$MIN_PYTHON_VERSION" \
                --arg max_py "$MAX_PYTHON_VERSION" \
                --arg min_nb "$MIN_NAUTOBOT_VERSION" \
                '{
                  "python-version": [$min_py],
                  "db-backend": ["postgresql"],
                  "nautobot-version": ["stable"],
                  "include": [
                    {"python-version": $min_py, "db-backend": "postgresql", "nautobot-version": $min_nb},
                    {"python-version": $max_py, "db-backend": "mysql", "nautobot-version": "stable"}
                  ]
                }')
            else
              UNITTEST_MATRIX=$(echo "$PYTHON_VERSIONS" | jq -c '{"python-version": .}')
            fi
          fi

          {
            echo "invoke_context_name=$INVOKE_CONTEXT_NAME"
            echo "regenerate_lockfile=$REGENERATE_LOCKFILE"
            echo "lint_matrix=$LINT_MATRIX"
            echo "docker_check_matrix=$DOCKER_CHECK_MATRIX"
            echo "unittest_matrix=$UNITTEST_MATRIX"
            echo "is_feature_pr=$IS_FEATURE_PR"
          } >> "$GITHUB_OUTPUT"

          echo "Project type: $PROJECT_TYPE"
          echo "Invoke context: $INVOKE_CONTEXT_NAME"
          echo "Regenerate lockfile: $REGENERATE_LOCKFILE"
          echo "Lint matrix: $LINT_MATRIX"
          echo "Docker check matrix: $DOCKER_CHECK_MATRIX"
          echo "Unittest matrix: $UNITTEST_MATRIX"
          echo "Feature PR: $IS_FEATURE_PR"

  prepare-lockfile:
    name: "Prepare poetry.lock"
    needs: "config"
    runs-on: "ubuntu-latest"
    steps:
      - name: "Check out repository code"
        uses: "actions/checkout@v7"
      - name: "Setup environment"
        if: "needs.config.outputs.regenerate_lockfile == 'true'"
        uses: "networktocode/github-reusable-workflows/.github/actions/setup-poetry-environment@main"
        with:
          poetry-version: "${{ inputs.poetry_version }}"
          poetry-install-options: "--only-root"
      - name: "Regenerate poetry.lock"
        if: "needs.config.outputs.regenerate_lockfile == 'true'"
        run: "poetry lock --regenerate"
      - name: "Upload poetry.lock"
        uses: "actions/upload-artifact@v7"
        with:
          name: "poetry-lock"
          path: "poetry.lock"

  lint:
    name: "Linting: ${{ matrix.check }}"
    needs:
      - "config"
      - "prepare-lockfile"
    runs-on: "ubuntu-latest"
    strategy:
      fail-fast: false
      matrix: "${{ fromJSON(needs.config.outputs.lint_matrix) }}"
    steps:
      - name: "Configure invoke to run locally"
        run: |
          echo "INVOKE_${{ needs.config.outputs.invoke_context_name }}_LOCAL=True" >> "$GITHUB_ENV"
      - name: "Check out repository code"
        uses: "actions/checkout@v7"
      - name: "Download poetry.lock artifact"
        uses: "actions/download-artifact@v8"
        with:
          name: "poetry-lock"
      - name: "Setup environment"
        uses: "networktocode/github-reusable-workflows/.github/actions/setup-poetry-environment@main"
        with:
          poetry-version: "${{ inputs.poetry_version }}"
      - name: "Linting: ${{ matrix.check }}"
        run: "poetry run invoke ${{ matrix.command }}"

  check-docs-build:
    name: "Check docs build"
    needs:
      - "config"
      - "prepare-lockfile"
    if: "inputs.check_docs"
    runs-on: "ubuntu-latest"
    steps:
      - name: "Configure invoke to run locally"
        run: |
          echo "INVOKE_${{ needs.config.outputs.invoke_context_name }}_LOCAL=True" >> "$GITHUB_ENV"
      - name: "Check out repository code"
        uses: "actions/checkout@v7"
      - name: "Download poetry.lock artifact"
        uses: "actions/download-artifact@v8"
        with:
          name: "poetry-lock"
      - name: "Setup environment"
        uses: "networktocode/github-reusable-workflows/.github/actions/setup-poetry-environment@main"
        with:
          poetry-version: "${{ inputs.poetry_version }}"
          poetry-install-options: "--only dev,docs"
      - name: "Check Docs Build"
        run: "poetry run invoke build-and-check-docs"

  poetry:
    name: "Check poetry.lock"
    needs:
      - "config"
    runs-on: "ubuntu-latest"
    steps:
      - name: "Configure invoke to run locally"
        run: |
          echo "INVOKE_${{ needs.config.outputs.invoke_context_name }}_LOCAL=True" >> "$GITHUB_ENV"
      - name: "Check out repository code"
        uses: "actions/checkout@v7"
      - name: "Setup environment"
        uses: "networktocode/github-reusable-workflows/.github/actions/setup-poetry-environment@main"
        with:
          poetry-version: "${{ inputs.poetry_version }}"
      - name: "Checking: poetry lock file"
        run: "poetry run invoke lock --check"

  check-in-docker:
    name: "Checks in docker (Python ${{ matrix.python-version }}${{ matrix.nautobot-version && format(', Nautobot {0}', matrix.nautobot-version) || '' }})"
    needs:
      - "config"
      - "lint"
      - "poetry"
    runs-on: "ubuntu-latest"
    strategy:
      fail-fast: true
      matrix: "${{ fromJSON(needs.config.outputs.docker_check_matrix) }}"
    env:
      INVOKE_CONTEXT_NAME: "${{ needs.config.outputs.invoke_context_name }}"
      PYTHON_VERSION: "${{ matrix.python-version }}"
      NAUTOBOT_VERSION: "${{ matrix.nautobot-version }}"
    steps:
      - name: "Check out repository code"
        uses: "actions/checkout@v7"
      - name: "Setup environment"
        uses: "networktocode/github-reusable-workflows/.github/actions/setup-poetry-environment@main"
        with:
          poetry-version: "${{ inputs.poetry_version }}"
      - name: "Configure invoke environment and image tag"
        run: |
          {
            echo "INVOKE_${INVOKE_CONTEXT_NAME}_PYTHON_VER=$PYTHON_VERSION"
            if [ "$PROJECT_TYPE" = "nautobot-app" ]; then
              echo "INVOKE_${INVOKE_CONTEXT_NAME}_NAUTOBOT_VER=$NAUTOBOT_VERSION"
              echo "DOCKERFILE=./development/Dockerfile"
              echo "IMAGE_TAG=$PROJECT_NAME/nautobot:$NAUTOBOT_VERSION-py$PYTHON_VERSION"
              echo "CACHE_SCOPE=$NAUTOBOT_VERSION-py$PYTHON_VERSION"
            else
              IMAGE_VER="$(poetry version -s)-py$PYTHON_VERSION"
              echo "INVOKE_${INVOKE_CONTEXT_NAME}_IMAGE_NAME=$PROJECT_NAME"
              echo "INVOKE_${INVOKE_CONTEXT_NAME}_IMAGE_VER=$IMAGE_VER"
              echo "DOCKERFILE=./Dockerfile"
              echo "IMAGE_TAG=$PROJECT_NAME:$IMAGE_VER"
              echo "CACHE_SCOPE=$PROJECT_NAME-$IMAGE_VER-py$PYTHON_VERSION"
            fi
          } >> "$GITHUB_ENV"
      - name: "Constrain Nautobot version and regenerate lock file"
        if: "inputs.project_type == 'nautobot-app'"
        run: >-
          env "INVOKE_${INVOKE_CONTEXT_NAME}_LOCAL=true"
          poetry run invoke lock --constrain-nautobot-ver --constrain-python-ver="$PYTHON_VERSION"
      - name: "Set up Docker Buildx"
        id: "buildx"
        uses: "docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069"  # v4.4.1
      - name: "Build"
        uses: "docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc"  # v7.4.0
        with:
          builder: "${{ steps.buildx.outputs.name }}"
          context: "./"
          push: false
          load: true
          tags: "${{ env.IMAGE_TAG }}"
          file: "${{ env.DOCKERFILE }}"
          cache-from: "type=gha,scope=${{ env.CACHE_SCOPE }}"
          cache-to: "type=gha,scope=${{ env.CACHE_SCOPE }}"
          build-args: |
            PYTHON_VER=${{ env.PYTHON_VERSION }}
            ${{ inputs.project_type == 'nautobot-app' && format('NAUTOBOT_VER={0}', env.NAUTOBOT_VERSION) || '' }}
            ${{ inputs.project_type == 'nautobot-app' && 'CI=true' || '' }}
          secrets: |
            "artifactory_username=${{ secrets.ARTIFACTORY_USERNAME }}"
            "artifactory_password=${{ secrets.ARTIFACTORY_PASSWORD }}"
      - name: "Linting: pylint"
        run: "poetry run invoke pylint"
      - name: "Checking: App Config"
        if: "inputs.project_type == 'nautobot-app'"
        run: "poetry run invoke validate-app-config"
      - name: "Checking: migrations"
        if: "inputs.project_type == 'nautobot-app'"
        run: "poetry run invoke check-migrations"

  unittest:
    name: "Unit tests (Python ${{ matrix.python-version }}${{ matrix.nautobot-version && format(', Nautobot {0}', matrix.nautobot-version) || '' }}${{ matrix.db-backend && format(', {0}', matrix.db-backend) || '' }})"
    needs:
      - "config"
      - "check-in-docker"
    strategy:
      fail-fast: true
      matrix: "${{ fromJSON(needs.config.outputs.unittest_matrix) }}"
    runs-on: "${{ inputs.unittest_runner }}"
    env:
      INVOKE_CONTEXT_NAME: "${{ needs.config.outputs.invoke_context_name }}"
      PYTHON_VERSION: "${{ matrix.python-version }}"
      NAUTOBOT_VERSION: "${{ matrix.nautobot-version }}"
    steps:
      - name: "Configure invoke environment"
        run: |
          {
            echo "INVOKE_${INVOKE_CONTEXT_NAME}_PYTHON_VER=$PYTHON_VERSION"
            if [ "$PROJECT_TYPE" = "nautobot-app" ]; then
              echo "INVOKE_${INVOKE_CONTEXT_NAME}_NAUTOBOT_VER=$NAUTOBOT_VERSION"
            else
              echo "INVOKE_${INVOKE_CONTEXT_NAME}_LOCAL=True"
            fi
          } >> "$GITHUB_ENV"
      - name: "Check out repository code"
        uses: "actions/checkout@v7"
      - name: "Setup environment"
        uses: "networktocode/github-reusable-workflows/.github/actions/setup-poetry-environment@main"
        with:
          poetry-version: "${{ inputs.poetry_version }}"
          # Libraries run pytest locally, so the host interpreter must match the matrix entry.
          # Apps run tests inside the docker image; the host only needs a Poetry environment for invoke.
          python-version: "${{ inputs.project_type == 'python-library' && matrix.python-version || '3.11' }}"
      # ---- nautobot-app: build the Nautobot image and run the tests inside it ----
      - name: "Constrain Nautobot version and regenerate lock file"
        if: "inputs.project_type == 'nautobot-app'"
        run: >-
          env "INVOKE_${INVOKE_CONTEXT_NAME}_LOCAL=true"
          poetry run invoke lock --constrain-nautobot-ver --constrain-python-ver="$PYTHON_VERSION"
      - name: "Set up Docker Buildx"
        if: "inputs.project_type == 'nautobot-app'"
        id: "buildx"
        uses: "docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069"  # v4.4.1
      - name: "Build"
        if: "inputs.project_type == 'nautobot-app'"
        uses: "docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc"  # v7.4.0
        with:
          builder: "${{ steps.buildx.outputs.name }}"
          context: "./"
          push: false
          load: true
          tags: "${{ env.PROJECT_NAME }}/nautobot:${{ env.NAUTOBOT_VERSION }}-py${{ env.PYTHON_VERSION }}"
          file: "./development/Dockerfile"
          cache-from: "type=gha,scope=${{ env.NAUTOBOT_VERSION }}-py${{ env.PYTHON_VERSION }}"
          cache-to: "type=gha,scope=${{ env.NAUTOBOT_VERSION }}-py${{ env.PYTHON_VERSION }}"
          build-args: |
            NAUTOBOT_VER=${{ env.NAUTOBOT_VERSION }}
            PYTHON_VER=${{ env.PYTHON_VERSION }}
            CI=true
          secrets: |
            "artifactory_username=${{ secrets.ARTIFACTORY_USERNAME }}"
            "artifactory_password=${{ secrets.ARTIFACTORY_PASSWORD }}"
      - name: "Use Mysql invoke settings when needed"
        if: "inputs.project_type == 'nautobot-app' && matrix.db-backend == 'mysql'"
        run: "cp invoke.mysql.yml invoke.yml"
      - name: "Run Tests"
        if: "inputs.project_type == 'nautobot-app'"
        run: "poetry run invoke unittest"
      # ---- python-library: run pytest on the host interpreter ----
      - name: "Run Tests"
        if: "inputs.project_type == 'python-library'"
        run: "poetry run invoke pytest"

  unittest_report:
    name: "Unit tests with coverage (Python ${{ inputs.max_python_version }}, Nautobot stable, postgresql)"
    needs:
      - "config"
      - "check-in-docker"
    if: "inputs.project_type == 'nautobot-app'"
    runs-on: "ubuntu-latest"
    permissions:
      pull-requests: "write"
      contents: "write"
    env:
      INVOKE_CONTEXT_NAME: "${{ needs.config.outputs.invoke_context_name }}"
      PYTHON_VERSION: "${{ inputs.max_python_version }}"
      NAUTOBOT_VERSION: "stable"
    steps:
      - name: "Configure invoke versions"
        run: |
          {
            echo "INVOKE_${INVOKE_CONTEXT_NAME}_PYTHON_VER=$PYTHON_VERSION"
            echo "INVOKE_${INVOKE_CONTEXT_NAME}_NAUTOBOT_VER=$NAUTOBOT_VERSION"
          } >> "$GITHUB_ENV"
      - name: "Check out repository code"
        uses: "actions/checkout@v7"
      - name: "Setup environment"
        uses: "networktocode/github-reusable-workflows/.github/actions/setup-poetry-environment@main"
        with:
          poetry-version: "${{ inputs.poetry_version }}"
      - name: "Constrain Nautobot version and regenerate lock file"
        run: >-
          env "INVOKE_${INVOKE_CONTEXT_NAME}_LOCAL=true"
          poetry run invoke lock --constrain-nautobot-ver --constrain-python-ver="$PYTHON_VERSION"
      - name: "Set up Docker Buildx"
        id: "buildx"
        uses: "docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069"  # v4.4.1
      - name: "Build"
        uses: "docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc"  # v7.4.0
        with:
          builder: "${{ steps.buildx.outputs.name }}"
          context: "./"
          push: false
          load: true
          tags: "${{ env.PROJECT_NAME }}/nautobot:${{ env.NAUTOBOT_VERSION }}-py${{ env.PYTHON_VERSION }}"
          file: "./development/Dockerfile"
          cache-from: "type=gha,scope=${{ env.NAUTOBOT_VERSION }}-py${{ env.PYTHON_VERSION }}"
          cache-to: "type=gha,scope=${{ env.NAUTOBOT_VERSION }}-py${{ env.PYTHON_VERSION }}"
          build-args: |
            NAUTOBOT_VER=${{ env.NAUTOBOT_VERSION }}
            PYTHON_VER=${{ env.PYTHON_VERSION }}
            CI=true
          secrets: |
            "artifactory_username=${{ secrets.ARTIFACTORY_USERNAME }}"
            "artifactory_password=${{ secrets.ARTIFACTORY_PASSWORD }}"
      - name: "Copy credentials"
        run: "cp development/creds.example.env development/creds.env"
      - name: "Run Tests"
        run: "poetry run invoke unittest --coverage"
      - name: "Generate Coverage Comment"
        if: "needs.config.outputs.is_feature_pr == 'true'"
        id: "coverage_comment"
        uses: "py-cov-action/python-coverage-comment-action@e5fb2218463c3377f3504b0c5b5646ed53da7a2f"  # v4.5
        with:
          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
          MINIMUM_GREEN: "${{ inputs.coverage_minimum_green }}"
          MINIMUM_ORANGE: "${{ inputs.coverage_minimum_orange }}"
          ANNOTATE_MISSING_LINES: true
          ANNOTATION_TYPE: "warning"
      - name: "Store Pull Request comment to be posted"
        if: "needs.config.outputs.is_feature_pr == 'true'"
        uses: "actions/upload-artifact@v7"
        with:
          name: "python-coverage-comment-action"
          path: "python-coverage-comment-action.txt"

  changelog:
    name: "Check changelog fragment"
    needs:
      - "config"
      - "prepare-lockfile"
    if: "needs.config.outputs.is_feature_pr == 'true'"
    runs-on: "ubuntu-latest"
    steps:
      - name: "Check out repository code"
        uses: "actions/checkout@v7"
        with:
          fetch-depth: "0"
      - name: "Download poetry.lock artifact"
        uses: "actions/download-artifact@v8"
        with:
          name: "poetry-lock"
      - name: "Setup environment"
        uses: "networktocode/github-reusable-workflows/.github/actions/setup-poetry-environment@main"
        with:
          poetry-version: "${{ inputs.poetry_version }}"
      - name: "Check for changelog entry"
        run: |
          git fetch --no-tags origin +refs/heads/${{ github.base_ref }}:refs/remotes/origin/${{ github.base_ref }}
          poetry run towncrier check --compare-with origin/${{ github.base_ref }}