ci_static_analysis_python.yml

# This workflow performs static analysis in Python.
name: Python Static Analysis

on:
  workflow_call:
    inputs:
      regenerate-code:
        description: "Regenerate code using smithy-dafny"
        required: false
        default: false
        type: boolean
      mpl-version:
        description: "MPL version to use"
        required: false
        type: string
      mpl-head:
        description: "Running on MPL HEAD"
        required: false
        default: false
        type: boolean

jobs:
  testPython:
    strategy:
      matrix:
        python-version: [3.11]
        os: [ubuntu-latest]
    runs-on: ${{ matrix.os }}
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: us-west-2
          role-to-assume: arn:aws:iam::370957321024:role/GitHub-CI-DDBEC-Dafny-Role-us-west-2
          role-session-name: DDBEC-Dafny-Python-Tests

      - uses: actions/checkout@v3
        with:
          submodules: recursive

      - name: Setup Python ${{ matrix.python-version }}
        uses: actions/setup-python@v4
        with:
          python-version: ${{ matrix.python-version }}

      - name: Setup Python ${{ matrix.python-version }} for running tests
        run: |
          python -m pip install --upgrade pip
          pip install --upgrade tox
          pip install poetry

      - name: Update MPL submodule if using MPL HEAD
        if: ${{ inputs.mpl-head == true }}
        working-directory: submodules/MaterialProviders
        run: |
          git checkout main
          git pull
          git submodule update --init --recursive
          git rev-parse HEAD

      - name: Install Smithy-Dafny codegen dependencies
        uses: ./.github/actions/install_smithy_dafny_codegen_dependencies

      - name: Regenerate code using smithy-dafny if necessary
        if: ${{ inputs.regenerate-code }}
        uses: ./.github/actions/polymorph_codegen
        with:
          dafny: ${{ env.DAFNY_VERSION }}
          library: DynamoDbEncryption
          diff-generated-code: false
          update-and-regenerate-mpl: true

      - name: Run static analysis
        working-directory: ./DynamoDbEncryption/runtimes/python
        run: |
          tox -e lint-check