canopeum_backend_pr_validation.yml

name: Backend PR validation

on:
  push:
    branches:
      - main
    paths:
      - "canopeum_backend/**"
      - ".github/workflows/canopeum_backend_pr_validation.yml"
  pull_request:
    branches:
      - main
      - production
    paths:
      - "canopeum_backend/**"
      - ".github/workflows/canopeum_backend_pr_validation.yml"

env:
  # Since the Django mypy extention RUNS the config file, we need a non-empty secret to avoid
  # ImproperlyConfigured("The SECRET_KEY setting must not be empty.")
  SECRET_KEY_DJANGO_CANOPEUM: mypy-ext

jobs:
  django-test:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: canopeum_backend
    steps:
      - uses: actions/checkout@v4
      - name: Install uv
        uses: astral-sh/setup-uv@v3
        with:
          enable-cache: true
          cache-dependency-glob: "canopeum_backend/uv.lock"
      - run: uv sync --locked
      - name: Run Django Tests
        run: uv run manage.py test
  mypy:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: canopeum_backend
    steps:
      - uses: actions/checkout@v4
      - name: Install uv
        uses: astral-sh/setup-uv@v3
        with:
          enable-cache: true
          cache-dependency-glob: "canopeum_backend/uv.lock"
      - run: uv sync --locked
      - run: uv run mypy . --python-version=3.12

  pyright:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: canopeum_backend
    steps:
      - uses: actions/checkout@v4
      - name: Install uv
        uses: astral-sh/setup-uv@v3
        with:
          enable-cache: true
          cache-dependency-glob: "canopeum_backend/uv.lock"
      - run: uv sync --locked
      - run: echo "$PWD/.venv/bin" >> $GITHUB_PATH
      - uses: jakebailey/pyright-action@v2
        with:
          version: PATH
          python-version: "3.12"
          working-directory: canopeum_backend

  Ruff-Autofixes:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: canopeum_backend
    # Only run autofixes on PRs
    if: ${{ github.event_name == 'pull_request' }}
    steps:
      - uses: actions/checkout@v4
        with:
          repository: ${{ github.event.pull_request.head.repo.full_name }}
          ref: ${{ github.event.pull_request.head.ref }}
          # Token with Contents permissions to allow retriggering workflow
          token: ${{ secrets.PR_AUTOFIX_PAT }}
      - name: Get Ruff version
        id: ruff_version
        # We need an exact value, feature request for any valid range specifier
        # https://github.com/astral-sh/ruff-action/issues/11
        run: |
          $Env:RUFF_VERSION=Select-String -path pyproject.toml -pattern 'ruff ?[=<>~]?= ?(.+?)"' | %{ $_.Matches[0].Groups[1].Value }
          echo $Env:RUFF_VERSION
          echo "RUFF_VERSION=$Env:RUFF_VERSION" >> $Env:GITHUB_OUTPUT
        shell: pwsh
      - uses: astral-sh/ruff-action@v1
        with:
          version: ${{ steps.ruff_version.outputs.RUFF_VERSION }}
          args: check --fix
      - uses: astral-sh/ruff-action@v1
        # Format even on lint failure
        if: ${{ !cancelled() }}
        with:
          version: ${{ steps.ruff_version.outputs.RUFF_VERSION }}
          args: format
      - name: Commit autofixes
        uses: EndBug/add-and-commit@v9
        # TODO: Prevent infinite loops, github.event.head_commit.author.name is not accessible in this context
        # if: ${{ github.event.head_commit.author.name != 'github-actions' }}
        # Push autofixes even on failure
        if: ${{ !cancelled() }}
        with:
          default_author: github_actions