experiment.yaml

name: Next-Gen CI Pipeline

on:
  pull_request:
    branches: [ main, preview ]
  # Native Merge Queue support for exhaustive batching
  merge_group:
    types: [checks_requested]

# Stop burning money on abandoned iterative commits
concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  # ==========================================
  # 1. DISCOVERY ENGINE (The Router)
  # ==========================================
  discover:
    runs-on: ubuntu-latest
    outputs:
      packages: ${{ steps.changes.outputs.all_changed_files }}
      # Expose the dynamic Python matrix to downstream jobs
      python_versions: ${{ steps.set-python.outputs.matrix }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          
      - name: Detect Changed Packages
        id: changes
        uses: tj-actions/changed-files@v44
        with:
          files: packages/**
          dir_names: true               
          dir_names_max_depth: 2        
          json: true                    
          escape_json: false

      - name: Determine Python Matrix (Risk-Tiering)
        id: set-python
        run: |
          if [[ "${{ github.event_name }}" == "merge_group" ]]; then
            echo "Merge Queue detected. Deploying exhaustive matrix."
            echo 'matrix=["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]' >> $GITHUB_OUTPUT
          else
            echo "Pull Request detected. Deploying Min/Max Boundary matrix."
            echo 'matrix=["3.9", "3.14"]' >> $GITHUB_OUTPUT
          fi

  # ==========================================
  # 2. STATIC ANALYSIS (Grouped for Speed)
  # ==========================================
  static-checks:
    needs: discover
    if: ${{ needs.discover.outputs.packages != '[]' }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false 
      matrix:
        package: ${{ fromJSON(needs.discover.outputs.packages) }}
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v5
        with:
          python-version: "3.14" 
          enable-cache: true
          cache-dependency-glob: "${{ matrix.package }}/setup.py"

      - name: Run Lint and MyPy
        run: |
          cd ${{ matrix.package }}
          export NOX_DEFAULT_VENV_BACKEND=uv
          uvx --with 'nox[uv]' nox -s lint mypy lint_setup_py

  # ==========================================
  # 3. DOCUMENTATION BUILD
  # ==========================================
  docs-build:
    needs: discover
    if: ${{ needs.discover.outputs.packages != '[]' }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        package: ${{ fromJSON(needs.discover.outputs.packages) }}
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v5
        with:
          python-version: "3.10"
          enable-cache: true
          cache-dependency-glob: "${{ matrix.package }}/setup.py"

      - name: Build Docs and DocFX
        run: |
          cd ${{ matrix.package }}
          export NOX_DEFAULT_VENV_BACKEND=uv
          uvx --with 'nox[uv]' nox -s docs docfx

  # ==========================================
  # 4. UNIT TESTS (Dynamic 2D Matrix + Retries)
  # ==========================================
  unit-tests:
    needs: discover
    if: ${{ needs.discover.outputs.packages != '[]' }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        package: ${{ fromJSON(needs.discover.outputs.packages) }}
        # Reads the array generated by the Discovery job
        python: ${{ fromJSON(needs.discover.outputs.python_versions) }}
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v5
        with:
          python-version: ${{ matrix.python }}
          enable-cache: true
          cache-dependency-glob: "${{ matrix.package }}/setup.py"

      - name: Execute Unit Tests (With Shock Absorbers)
        run: |
          cd ${{ matrix.package }}
          export NOX_DEFAULT_VENV_BACKEND=uv
          
          # 3-Attempt retry loop to mask legacy flaky tests
          for i in 1 2 3; do
            echo "Attempt $i of 3 for Python ${{ matrix.python }}..."
            if uvx --with 'nox[uv]' nox -s unit-${{ matrix.python }}; then
              echo "Tests passed successfully!"
              exit 0
            fi
            echo "Tests failed. Waiting 5 seconds before retrying..."
            sleep 5
          done
          
          echo "::error::Tests failed after 3 attempts. This is a hard failure."
          exit 1

  # ==========================================
  # 5. SYSTEM TESTS
  # ==========================================
  # ==========================================
  # 5. SYSTEM TESTS
  # ==========================================
  system-tests:
    needs: discover
    if: ${{ needs.discover.outputs.packages != '[]' }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        package: ${{ fromJSON(needs.discover.outputs.packages) }}
        python: ["3.11"] 
    steps:
      - uses: actions/checkout@v4
      - id: 'auth'
        name: 'Authenticate to Google Cloud'
        uses: 'google-github-actions/auth@v2'
        with:
          workload_identity_provider: ${{ secrets.WIF_PROVIDER }}
          service_account: ${{ secrets.WIF_SERVICE_ACCOUNT }}

      - uses: astral-sh/setup-uv@v5
        with:
          python-version: ${{ matrix.python }}
          enable-cache: true
          cache-dependency-glob: "${{ matrix.package }}/setup.py"

      - name: Execute System Tests
        env:
          RUN_SYSTEM_TESTS: "true"
          # ADDED: Inject the required environment variables for the tests
          PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }} # Update to match your legacy YAML's secret name
        run: |
          cd ${{ matrix.package }}
          export NOX_DEFAULT_VENV_BACKEND=uv
          
          # FIXED: Append the exact matrix version to stop Nox from running all versions sequentially
          uvx --with 'nox[uv]' nox -s system-${{ matrix.python }}

  # ==========================================
  # 6. THE GATEKEEPER (Status Check Rollup)
  # ==========================================
  presubmit-passed:
    if: always() 
    needs: 
      - discover
      - static-checks
      - docs-build
      - unit-tests
      - system-tests
    runs-on: ubuntu-latest
    steps:
      - name: Evaluate Pipeline Status
        run: |
          if [[ "${{ contains(needs.*.result, 'failure') }}" == "true" || "${{ contains(needs.*.result, 'cancelled') }}" == "true" ]]; then
            echo "::error::One or more required CI jobs failed or were cancelled."
            exit 1
          fi
          
          if [[ "${{ needs.discover.outputs.packages }}" == "[]" ]]; then
            echo "No Python packages changed. Safely bypassing execution."
            exit 0
          fi
          
          echo "All dynamically generated CI jobs completed successfully."