ci.yml

name: CI

on:
  push:
    branches:
      - main
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+*"
  pull_request:

# Set default permissions to read-only for all jobs
permissions:
  contents: read

# Ensure only one workflow instance runs at a time. For branches other than the
# default branch, cancel the pending jobs in the group. For the default branch,
# queue them up. This avoids cancelling jobs that are in the middle of deploying
# to production.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != format('refs/heads/{0}', github.event.repository.default_branch) }}

jobs:
  check-go:
    name: Check Go
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - uses: actions/setup-go@v5
      - run: go version
      - uses: astral-sh/setup-uv@v7
      - name: Check formatting
        run: ./script/check.sh go
  check-stubs:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v5

      # Minimum supported python here.
    - run: echo 'UV_PYTHON=3.9' | tee -a "${GITHUB_ENV}"
    - name: Setup uv
      uses: astral-sh/setup-uv@v7
    - run: ./script/init.sh

    - name: Setup Node.js for pyright
      uses: actions/setup-node@v5
      with:
        node-version: '24'

    - name: Generate type stubs
      run: uv tool run nox -s stubs

    - name: Check for stub changes
      run: |
        if ! git diff --exit-code python/; then
          echo "ERROR: Type stub files are out of date!"
          echo "Generated stubs differ from committed versions:"
          git diff python/
          echo ""
          echo "Run 'script/check.sh python' locally and commit the updated .pyi files"
          exit 1
        fi
        echo "All stub files are up to date"
  lint-go:
    name: Go Code Linting
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - uses: actions/setup-go@v5
      - run: go version
      - uses: astral-sh/setup-uv@v7
      - uses: golangci/golangci-lint-action@v8.0.0
        name: Run golangci-lint
        with:
          version: v2.4.0
  test-go:
    name: Test Go
    runs-on: ubuntu-latest-4-cores
    strategy:
      fail-fast: false
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - uses: actions/setup-go@v5
      - uses: astral-sh/setup-uv@v7
      - run: ./script/init.sh
      - run: ./script/test.sh go

  test-go-legacy-cog:
    if: github.event_name == 'pull_request'
    name: "SmokeTest: Test Go Test Harness with legacy Cog"
    runs-on: ubuntu-latest-4-cores
    strategy:
      fail-fast: false
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - uses: actions/setup-go@v5
      - run: go version
      - uses: astral-sh/setup-uv@v7
      - run: ./script/init.sh
      - run: ./script/test.sh go
        env:
          LEGACY_COG: true

  test-set-uid:
    name: Test Set UID for procedure mode
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - uses: astral-sh/setup-uv@v7
      - run: ./script/init.sh
      - run: ./script/test-setuid.sh

  test-setuid-cleanup:
    name: Test Set UID cleanup in one-shot mode
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - uses: astral-sh/setup-uv@v7
      - run: ./script/init.sh
      - name: Run setuid cleanup test
        run: ./script/test-setuid-cleanup.sh
        env:
          PORT: 8080

  build-python:
    name: Build & verify python package
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - uses: hynek/build-and-inspect-python-package@v2
        id: baipp
    outputs:
      python-versions: ${{ steps.baipp.outputs.supported_python_classifiers_json_array }}

  check-python:
    name: Check with Python ${{ matrix.python-version }}
    needs: [build-python]
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ${{ fromJson(needs.build-python.outputs.python-versions) }}
    steps:
      - run: echo 'UV_PYTHON=${{ matrix.python-version }}' | tee -a "${GITHUB_ENV}"
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - uses: astral-sh/setup-uv@v7
      - run: ./script/check.sh python

  test-python:
    name: Test with Python ${{ matrix.python-version }}
    needs: [build-python]
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ${{ fromJson(needs.build-python.outputs.python-versions) }}
    steps:
      - run: echo 'UV_PYTHON=${{ matrix.python-version }}' | tee -a "${GITHUB_ENV}"
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - uses: astral-sh/setup-uv@v7
      - run: ./script/test.sh python

  release:
    name: Release
    needs:
      - check-go
      - lint-go
      - test-go
      - test-python
      - test-set-uid
      - test-setuid-cleanup
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - uses: astral-sh/setup-uv@v7
      - run: ./script/init.sh
      - run: ./script/build.sh
        env:
          CLET: 1
      - name: Upload to R2
        run: aws s3 sync dist s3://replicate-pipelines-runtime
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_ACCESS_KEY_SECRET }}
          AWS_ENDPOINT_URL: ${{ secrets.R2_S3_ENDPOINT }}
      - run: ./script/build.sh
      - uses: softprops/action-gh-release@v2.3.3
        with:
          files: dist/coglet-*.whl
          prerelease: ${{ contains(github.ref, '.dev') }}