OpenShell/.github/workflows/branch-checks.yml

name: Branch Checks

on:
  push:
    branches:
      - "pull-request/[0-9]+"
  workflow_dispatch:

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: "0"
  MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

permissions:
  contents: read
  packages: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  pr_metadata:
    name: Resolve PR metadata
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    outputs:
      should_run: ${{ steps.gate.outputs.should_run }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - id: gate
        uses: ./.github/actions/pr-gate

  mise-lockfile:
    name: mise Lockfile
    needs: pr_metadata
    if: needs.pr_metadata.outputs.should_run == 'true'
    runs-on: linux-amd64-cpu8
    container:
      image: ghcr.io/nvidia/openshell/ci:latest
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Mark workspace as safe for git
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"

      - name: Verify mise.lock is in sync with mise.toml
        run: |
          mise lock
          if ! git diff --exit-code mise.lock; then
            echo "::error::mise.lock is out of sync with mise.toml. Run 'mise lock' locally and commit the result." >&2
            exit 1
          fi

  license-headers:
    name: License Headers
    needs: pr_metadata
    if: needs.pr_metadata.outputs.should_run == 'true'
    runs-on: linux-amd64-cpu8
    container:
      image: ghcr.io/nvidia/openshell/ci:latest
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Install tools
        run: mise install --locked

      - name: Check license headers
        run: mise run license:check

  rust:
    name: Rust (${{ matrix.runner }})
    needs: pr_metadata
    if: needs.pr_metadata.outputs.should_run == 'true'
    strategy:
      fail-fast: false
      matrix:
        runner: [linux-amd64-cpu8, linux-arm64-cpu8]
    runs-on: ${{ matrix.runner }}
    env:
      SCCACHE_GHA_ENABLED: "true"
      SCCACHE_GHA_VERSION: branch-checks-rust-${{ matrix.runner }}
    container:
      image: ghcr.io/nvidia/openshell/ci:latest
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Configure GHA sccache backend
        uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10

      - name: Install tools
        run: mise install --locked

      - name: Cache Rust target and registry
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2
        with:
          # Keep branch-check caches partitioned by runner architecture; lint
          # and test intentionally share the same job-local target directory.
          shared-key: rust-checks-${{ matrix.runner }}
          # Preserve compiled artifacts from failed lint/test runs so the next
          # push to the same PR branch does not start from a cold cache.
          cache-on-failure: "true"

      - name: Format
        run: mise run rust:format:check

      - name: Lint
        run: mise run rust:lint

      - name: Test
        run: mise run test:rust

      - name: sccache stats
        if: always()
        run: |
          set +e
          stats_bin="${SCCACHE_PATH:-sccache}"
          "$stats_bin" --show-stats
          status=$?
          if [ "$status" -ne 0 ]; then
            echo "::warning::sccache stats unavailable (exit $status)"
          fi
          exit 0

  python:
    name: Python (${{ matrix.runner }})
    needs: pr_metadata
    if: needs.pr_metadata.outputs.should_run == 'true'
    strategy:
      fail-fast: false
      matrix:
        runner: [linux-amd64-cpu8, linux-arm64-cpu8]
    runs-on: ${{ matrix.runner }}
    container:
      image: ghcr.io/nvidia/openshell/ci:latest
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Install tools
        run: mise install --locked

      - name: Install dependencies
        run: uv sync --frozen

      - name: Lint
        run: mise run python:lint

      - name: Test
        run: mise run test:python

  markdown:
    name: Markdown
    needs: pr_metadata
    if: needs.pr_metadata.outputs.should_run == 'true'
    runs-on: linux-amd64-cpu8
    container:
      image: ghcr.io/nvidia/openshell/ci:latest
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Install tools
        run: mise install --locked

      - name: Lint
        run: mise run markdown:lint