check-build-deploy.yaml

name: Check, build and deploy Discord bot service

"on":
    pull_request:
        branches: [main]
    push:
        branches: [main]
        tags: [v*]

concurrency:  # yamllint disable-line rule:key-ordering
    cancel-in-progress: true
    group: ${{github.workflow}}-${{github.event.pull_request.number || github.ref}}

permissions:
    contents: read

jobs:
    uv-check:
        name: Validate uv lockfile
        runs-on: ubuntu-latest

        steps:
            - uses: actions/checkout@v7
              with:
                fetch-depth: 0
                persist-credentials: false

            - name: Install uv
              uses: astral-sh/setup-uv@v10.3.3
              with:
                enable-cache: true

            - name: Check uv.lock (ensure all dependencies up to date)
              run: uv lock --check

    flake8:  # yamllint disable-line rule:key-ordering
        env:
            UV_FROZEN: "true"
            UV_NO_SYNC: "true"
            UV_PYTHON_DOWNLOADS: never
        name: Lint code with Flake8
        runs-on: ubuntu-latest

        steps:
            - uses: actions/checkout@v7
              with:
                persist-credentials: false

            - name: Set up Python
              uses: actions/setup-python@v7
              with:
                python-version-file: .python-version

            - name: Install uv
              uses: astral-sh/setup-uv@v10.3.3
              with:
                enable-cache: true

            - name: Install Flake8 from locked dependencies
              run: uv sync --only-group lint-format

            - name: Run Flake8
              run: uv run -- flake8

    mypy:  # yamllint disable-line rule:key-ordering
        env:
            UV_FROZEN: "true"
            UV_NO_SYNC: "true"
            UV_PYTHON_DOWNLOADS: never
        name: Type-check code with mypy
        needs: [uv-check]
        runs-on: ubuntu-latest

        strategy:
            fail-fast: false
            matrix:
                component: [package, tests]

        steps:
            - uses: actions/checkout@v7
              with:
                persist-credentials: false

            - name: Set up Python
              uses: actions/setup-python@v7
              with:
                python-version-file: .python-version

            - name: Install uv
              uses: astral-sh/setup-uv@v10.3.3
              with:
                enable-cache: true

            - name: Install mypy from locked dependencies
              run: |  # zizmor: ignore[template-injection]
                if [ "${{matrix.component}}" == "package" ]; then
                    ARGS=()
                elif [ "${{matrix.component}}" == "tests" ]; then
                    ARGS=("--group" "test")
                else
                    echo "Error: Unknown matrix.component value: '${{matrix.component}}'" >&2
                    exit 1
                fi

                uv sync --no-group dev --group type-check "${ARGS[@]}"

            - id: store-hashed-python-version
              name: Store hashed Python version
              run: echo "hashed_python_version=$(uv run -- python -VV | sha256sum | cut -d' ' -f1)"
                >> "$GITHUB_OUTPUT"

            - uses: actions/cache@v6
              with:
                key: mypy|${{steps.store-hashed-python-version.outputs.hashed_python_version}}|${{matrix.component}}
                path: ./.mypy_cache

            - name: Run mypy
              run: |  # zizmor: ignore[template-injection]
                if [ "${{matrix.component}}" == "package" ]; then
                    ARGS=("." "--exclude" "tests/")
                elif [ "${{matrix.component}}" == "tests" ]; then
                    ARGS=("tests/")
                else
                    echo "Error: Unknown matrix.component value: '${{matrix.component}}'" >&2
                    exit 1
                fi

                uv run -- mypy "${ARGS[@]}"

    pre-commit-PUSH:  # yamllint disable-line rule:key-ordering
        if: github.event_name == 'push'
        name: Verify pre-commit hooks (push)
        uses: $/.github/workflows/autofix-pre-commit.yaml
        with:
            skip-autofix: true

    pre-commit-PULL_REQUEST:  # yamllint disable-line rule:key-ordering
        if: github.event_name == 'pull_request'
        name: Verify pre-commit hooks and commit auto-fixes (pull_request)
        runs-on: ubuntu-latest

        steps:
            - timeout-minutes: 15
              uses: kachick/wait-other-jobs@v4.0.0
              with:
                skip-same-workflow: true
                wait-list: |
                    [
                        {
                            "workflowFile": "autofix-pre-commit.yaml",
                            "jobMatchMode": "prefix",
                            "jobName": "Run pre-commit hooks"
                        }
                    ]

    pymarkdown:  # yamllint disable-line rule:key-ordering
        env:
            UV_FROZEN: "true"
            UV_NO_SYNC: "true"
            UV_PYTHON_DOWNLOADS: never
        name: Lint Markdown files using PyMarkdown
        runs-on: ubuntu-latest

        steps:
            - uses: actions/checkout@v7
              with:
                persist-credentials: false

            - name: Set up Python
              uses: actions/setup-python@v7
              with:
                python-version-file: .python-version

            - name: Install uv
              uses: astral-sh/setup-uv@v10.3.3
              with:
                enable-cache: true

            - name: Install PyMarkdown from locked dependencies
              run: uv sync --only-group lint-format

            - name: Run PyMarkdown scan
              run: uv run -- pymarkdown scan .

    pytest:  # yamllint disable-line rule:key-ordering
        env:
            UV_FROZEN: "true"
            UV_NO_SYNC: "true"
            UV_PYTHON_DOWNLOADS: never
        name: Run test suite with pytest
        needs: [uv-check]
        permissions:
            id-token: write  # Needed to authenticate and publish coverage reports to Codecov
        runs-on: ubuntu-latest

        steps:
            - uses: actions/checkout@v7
              with:
                persist-credentials: false

            - name: Set up Python
              uses: actions/setup-python@v7
              with:
                python-version-file: .python-version

            - name: Install uv
              uses: astral-sh/setup-uv@v10.3.3
              with:
                enable-cache: true

            - name: Install pytest from locked dependencies
              run: uv sync --no-group dev --group test

            - id: store-hashed-python-version
              name: Store hashed Python version
              run: echo "hashed_python_version=$(uv run -- python -VV | sha256sum | cut -d' ' -f1)"
                >> "$GITHUB_OUTPUT"

            - uses: actions/cache@v6
              with:
                key: pytest|${{steps.store-hashed-python-version.outputs.hashed_python_version}}
                path: ./.pytest_cache

            - name: Run pytest
              run: uv run pytest --cov --cov-branch --cov-report=xml --junitxml=junit.xml

            - if: ${{!cancelled()}}
              name: Upload test results to Codecov
              uses: codecov/codecov-action@v7
              with:
                report_type: test_results
                use_oidc: true

            - if: ${{!cancelled()}}
              name: Upload coverage report to Codecov
              uses: codecov/codecov-action@v7
              with:
                use_oidc: true

    ruff-lint:  # yamllint disable-line rule:key-ordering
        env:
            UV_FROZEN: "true"
            UV_NO_SYNC: "true"
            UV_PYTHON_DOWNLOADS: never
        name: Lint code with ruff
        runs-on: ubuntu-latest

        steps:
            - uses: actions/checkout@v7
              with:
                persist-credentials: false

            - name: Set up Python
              uses: actions/setup-python@v7
              with:
                python-version-file: .python-version

            - name: Install uv
              uses: astral-sh/setup-uv@v10.3.3
              with:
                enable-cache: true

            - name: Install ruff from locked dependencies
              run: uv sync --only-group lint-format

            - id: store-hashed-python-version
              name: Store hashed Python version
              run: echo "hashed_python_version=$(uv run -- python -VV | sha256sum | cut -d' ' -f1)"
                >> "$GITHUB_OUTPUT"

            - uses: actions/cache@v6
              with:
                key: ruff|${{steps.store-hashed-python-version.outputs.hashed_python_version}}
                path: ./.ruff_cache

            - name: Run ruff check
              run: uv run -- ruff check --no-fix --output-format=github

    build-and-publish:  # yamllint disable-line rule:key-ordering
        env:
            IMAGE_NAME: ${{github.repository}}
            REGISTRY: ghcr.io
        environment: publish
        if: |
            always()
            && needs.mypy.result == 'success'
            && (
                needs.pre-commit-PUSH.result == 'success'
                || needs.pre-commit-PULL_REQUEST.result == 'success'
            )
            && needs.pytest.result == 'success'
            && needs.pymarkdown.result == 'success'
            && needs.ruff-lint.result == 'success'
            && needs.uv-check.result == 'success'
            && (
                github.event_name != 'pull_request'
                || github.event.pull_request.head.repo.full_name == 'CSSUoB/TeX-Bot-Py-V2'
            )
        name: Build and publish Docker image
        needs: [mypy, pre-commit-PUSH, pre-commit-PULL_REQUEST, pymarkdown, pytest, ruff-lint, uv-check]
        permissions:
            artifact-metadata: write  # Needed to correctly publish release artefacts
            attestations: write  # Needed to correctly publish container image attestations
            id-token: write  # Needed to authenticate to the GitHub container registry
            packages: write  # Needed to publish built container image to the GitHub container registry
        runs-on: ubuntu-latest

        steps:
            - name: Authenticate to container registry
              uses: docker/login-action@v4.7.0
              with:
                password: ${{secrets.GITHUB_TOKEN}}
                registry: ${{env.REGISTRY}}
                username: ${{github.actor}}

            - name: Set up Docker Buildx
              uses: docker/setup-buildx-action@v4

            - id: docker-extract-metadata
              name: Extract metadata (tags, labels) for Docker image
              uses: docker/metadata-action@v6.2.0
              with:
                images: ${{env.REGISTRY}}/${{env.IMAGE_NAME}}
                tags: |-
                    type=ref,event=branch,prefix=br-
                    type=ref,event=pr
                    type=semver,pattern={{version}}
                    type=semver,pattern={{major}}.{{minor}}
                    type=semver,pattern=v{{major}},enable=${{!startsWith(github.ref, 'refs/tags/v0.')}}

            - id: build-and-publish
              name: Build and publish Docker image
              uses: docker/build-push-action@v7
              with:
                labels: ${{steps.docker-extract-metadata.outputs.labels}}
                push: true
                tags: ${{steps.docker-extract-metadata.outputs.tags}}

            - name: Generate artifact attestation
              uses: actions/attest-build-provenance@v4
              with:
                push-to-registry: true
                subject-digest: ${{steps.build-and-publish.outputs.digest}}
                subject-name: ${{env.REGISTRY}}/${{env.IMAGE_NAME}}

    release:  # yamllint disable-line rule:key-ordering
        if: always() && github.ref_type == 'tag' && needs.build-and-publish.result == 'success'
        name: Create GitHub release
        needs: [build-and-publish]
        permissions:
            contents: write  # Needed to create release tags and upload assets
        runs-on: ubuntu-latest

        steps:
            - name: Create GitHub Release
              env:  # yamllint disable-line rule:key-ordering
                GITHUB_TOKEN: ${{github.token}}
                RELEASE_REPOSITORY: ${{github.repository}}
                RELEASE_TAG: ${{github.ref_name}}
              run: gh release create "${RELEASE_TAG}" --repo "${RELEASE_REPOSITORY}" --verify-tag
                --generate-notes --notes "$(git tag -l --format='%(contents:subject)%0a%0a%(contents:body)'
                "${RELEASE_TAG}")"