OpenShell/.github/workflows/branch-checks.yml

name: Branch Checks

on:
  pull_request:

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: "0"
  MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

permissions:
  contents: read
  packages: read

jobs:
  mise-lockfile:
    name: mise Lockfile
    runs-on: build-amd64
    container:
      image: ghcr.io/nvidia/openshell/ci:latest
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v4

      - name: Mark workspace as safe for git
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"

      - name: Detect mise config changes
        id: changed
        uses: tj-actions/changed-files@aa08304bd477b800d468db44fe10f6c61f7f7b11 # v42.1.0
        with:
          files: |
            mise.toml
            mise.lock

      - name: Verify mise.lock is in sync with mise.toml
        if: steps.changed.outputs.any_changed == 'true'
        run: |
          mise lock
          if ! git diff --exit-code mise.lock; then
            echo "::error::mise.lock is out of sync with mise.toml. Run 'mise lock' locally and commit the result." >&2
            exit 1
          fi

  license-headers:
    name: License Headers
    runs-on: build-amd64
    container:
      image: ghcr.io/nvidia/openshell/ci:latest
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v4

      - name: Install tools
        run: mise install --locked

      - name: Check license headers
        run: mise run license:check

  rust:
    name: Rust (${{ matrix.runner }})
    strategy:
      fail-fast: false
      matrix:
        runner: [build-amd64, build-arm64]
    runs-on: ${{ matrix.runner }}
    container:
      image: ghcr.io/nvidia/openshell/ci:latest
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v4

      - name: Install tools
        run: mise install --locked

      - name: Configure sccache remote cache
        if: vars.SCCACHE_MEMCACHED_ENDPOINT != ''
        run: echo "SCCACHE_MEMCACHED_ENDPOINT=${{ vars.SCCACHE_MEMCACHED_ENDPOINT }}" >> "$GITHUB_ENV"

      - name: Cache Rust target and registry
        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
        with:
          # Separate caches for clippy (check-like) vs test (full build)
          # so they don't thrash each other's artifacts
          shared-key: rust-checks-${{ matrix.runner }}
          # Cache the sccache directory too
          cache-directories: .cache/sccache

      - name: Format
        run: mise run rust:format:check

      - name: Lint
        run: mise run rust:lint

      - name: Test
        run: mise run test:rust

      - name: sccache stats
        if: always()
        run: mise x -- sccache --show-stats

  python:
    name: Python (${{ matrix.runner }})
    strategy:
      fail-fast: false
      matrix:
        runner: [build-amd64, build-arm64]
    runs-on: ${{ matrix.runner }}
    container:
      image: ghcr.io/nvidia/openshell/ci:latest
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v4

      - name: Install tools
        run: mise install --locked

      - name: Install dependencies
        run: uv sync --frozen

      - name: Lint
        run: mise run python:lint

      - name: Test
        run: mise run test:python

  markdown:
    name: Markdown
    runs-on: build-amd64
    container:
      image: ghcr.io/nvidia/openshell/ci:latest
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v4

      - name: Install tools
        run: mise install

      - name: Lint
        run: mise run markdown:lint