HaClient/.github/workflows/ci.yml at 06ca7ddc0f6b2f08ebe1476b11ff7e99f336eb09 · graphras-com/HaClient · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
name: CI

on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  # ── Detect project layout ──────────────────────────────────────────
  detect-stack:
    name: Detect stack
    runs-on: ubuntu-latest
    outputs:
      has-python: ${{ steps.detect.outputs.has-python }}
      has-docker: ${{ steps.detect.outputs.has-docker }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Detect components
        id: detect
        run: |
          has_python=false
          has_docker=false

          if [ -f pyproject.toml ] || [ -f setup.py ] || [ -f requirements.txt ]; then
            has_python=true
          fi

          if [ -f Dockerfile ]; then
            has_docker=true
          fi

          echo "has-python=${has_python}" >> "$GITHUB_OUTPUT"
          echo "has-docker=${has_docker}" >> "$GITHUB_OUTPUT"

  # ── Python ────────────────────────────────────────────────────────
  py-lint:
    name: Python Lint
    if: needs.detect-stack.outputs.has-python == 'true'
    needs: [detect-stack]
    uses: ./.github/workflows/python-lint.yml
    with:
      python-version: ${{ vars.CI_PYTHON_VERSION || '3.11' }}
      install-spec: ${{ vars.CI_PYTHON_INSTALL_SPEC || '.[dev]' }}

  py-build:
    name: Python Build
    if: needs.detect-stack.outputs.has-python == 'true'
    needs: [detect-stack]
    uses: ./.github/workflows/python-ci.yml
    with:
      python-version: ${{ vars.CI_PYTHON_VERSION || '3.11' }}
      install-spec: ${{ vars.CI_PYTHON_INSTALL_SPEC || '.[dev]' }}

  py-typecheck:
    name: Python Type Check
    if: needs.detect-stack.outputs.has-python == 'true'
    needs: [detect-stack]
    uses: ./.github/workflows/python-typecheck.yml
    with:
      python-version: ${{ vars.CI_PYTHON_VERSION || '3.11' }}
      install-spec: ${{ vars.CI_PYTHON_INSTALL_SPEC || '.[dev]' }}

  py-test:
    name: Python Test
    if: needs.detect-stack.outputs.has-python == 'true'
    needs: [detect-stack]
    uses: ./.github/workflows/python-tests.yml
    with:
      python-versions: ${{ vars.CI_PYTHON_TEST_VERSIONS || '["3.11","3.12","3.13"]' }}
      install-spec: ${{ vars.CI_PYTHON_INSTALL_SPEC || '.[dev]' }}
      coverage-target: ${{ vars.CI_PYTHON_COVERAGE_TARGET || 'haclient' }}
      coverage-threshold: ${{ fromJSON(vars.CI_PYTHON_COVERAGE_THRESHOLD || '95') }}

  # ── Security ──────────────────────────────────────────────────────
  secrets-scan:
    name: Secrets
    needs: [detect-stack]
    uses: ./.github/workflows/python-gitleaks.yml
    secrets:
      GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}

  # ── Quality gate ──────────────────────────────────────────────────
  quality-gate:
    name: Quality gate
    if: always()
    needs: [detect-stack, py-lint, py-build, py-typecheck, py-test, secrets-scan]
    runs-on: ubuntu-latest
    steps:
      - name: Check required job results
        env:
          PY_LINT: ${{ needs.py-lint.result }}
          PY_BUILD: ${{ needs.py-build.result }}
          PY_TYPECHECK: ${{ needs.py-typecheck.result }}
          PY_TEST: ${{ needs.py-test.result }}
          SECRETS_SCAN: ${{ needs.secrets-scan.result }}
        run: |
          results=("$PY_LINT" "$PY_BUILD" "$PY_TYPECHECK" "$PY_TEST" "$SECRETS_SCAN")
          for result in "${results[@]}"; do
            if [ "$result" = "failure" ] || [ "$result" = "cancelled" ]; then
              exit 1
            fi
          done

  # ── Release ───────────────────────────────────────────────────────
  release:
    name: Release
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    needs: [detect-stack, quality-gate]
    uses: ./.github/workflows/python-release.yml
    permissions:
      contents: write