pr.yml

name: PR checks

on:
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  ci-complete:
    # The required check. Needs every other job: on a stacked pull request
    # above the lowest unmerged one it fails, because those jobs were skipped
    # and a skipped job would count as passing; otherwise it passes only when
    # every job passed. See docs/engineering/skills/github-prs.md.
    name: CI complete
    if: ${{ always() }}
    needs: [test, lint, pyright, quality-guards, docker-build, test-integration]
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
    - name: Checkout the gate script
      uses: actions/checkout@v6
      with:
        sparse-checkout: .github/scripts/check_ci_complete.sh
        sparse-checkout-cone-mode: false

    - name: Require full CI, with every job passing
      env:
        JOB_RESULTS: ${{ toJSON(needs) }}
        PULL_REQUEST_BASE_REF: ${{ github.event.pull_request.base.ref }}
        STACK_BASE_REF: ${{ github.event.pull_request.stack.base.ref }}
      run: bash .github/scripts/check_ci_complete.sh

  test:
    name: Test
    # Full CI runs only on the lowest unmerged pull request in a stack.
    if: ${{ !github.event.pull_request.stack || github.event.pull_request.stack.base.ref == github.event.pull_request.base.ref }}
    runs-on: ubuntu-latest
    strategy:
      matrix:
        # Each entry is a uv project tested in its own locked environment.
        # For the gateway this is the parity guarantee: the same lock the
        # Modal image installs with uv_sync(frozen=True).
        project:
          - projects/policyengine-simulation-executor
          - projects/policyengine-simulation-entry
          - projects/policyengine-simulation-gateway
          - libs/policyengine-simulation-contract
          - libs/policyengine-simulation-observability
          - libs/policyengine-stage12-persistence
          - libs/policyengine-fastapi

    steps:
    - uses: actions/checkout@v6

    - name: Set up Python
      uses: actions/setup-python@v6
      with:
        python-version: '3.13'

    - name: Install uv
      uses: astral-sh/setup-uv@v8.1.0
      with:
        enable-cache: true

    - name: Install dependencies
      working-directory: ${{ matrix.project }}
      run: uv sync --frozen --extra test

    - name: Run tests
      working-directory: ${{ matrix.project }}
      run: uv run --frozen pytest tests/ -v

  lint:
    name: Lint
    # Full CI runs only on the lowest unmerged pull request in a stack.
    if: ${{ !github.event.pull_request.stack || github.event.pull_request.stack.base.ref == github.event.pull_request.base.ref }}
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v6

    - name: Set up Python
      uses: actions/setup-python@v6
      with:
        python-version: '3.13'

    - name: Install uv
      uses: astral-sh/setup-uv@v8.1.0

    - name: Install ruff
      # Pinned so a ruff release cannot change CI results; see ruff.toml.
      run: uv tool install ruff==0.15.22

    - name: Run ruff format check
      run: uv run --frozen ruff format --check projects/*/src libs/*/src

    - name: Run ruff check
      run: uv run --frozen ruff check .

  quality-guards:
    name: Quality guards
    # Full CI runs only on the lowest unmerged pull request in a stack.
    if: ${{ !github.event.pull_request.stack || github.event.pull_request.stack.base.ref == github.event.pull_request.base.ref }}
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v6
      with:
        # The rules registry guard compares baselines with the base branch.
        fetch-depth: 0

    - name: Set up Python
      uses: actions/setup-python@v6
      with:
        python-version: '3.13'

    - name: Install uv (the Pyright check's tests run the pinned Pyright)
      uses: astral-sh/setup-uv@v8.1.0

    - name: Test the rules registry tool
      run: python -m unittest discover -s scripts/rules/tests -t .

    - name: Install shellcheck (for the ci-scripts guard)
      run: pip install "shellcheck-py==0.11.0.1"

    - name: Run quality guards
      run: python scripts/run_quality_guards.py

  pyright:
    name: Pyright
    # Full CI runs only on the lowest unmerged pull request in a stack.
    if: ${{ !github.event.pull_request.stack || github.event.pull_request.stack.base.ref == github.event.pull_request.base.ref }}
    runs-on: ubuntu-latest
    strategy:
      # Each package passes or fails on its own; report every one.
      fail-fast: false
      matrix:
        # Each entry is a uv package, type-checked in its own locked
        # environment with the Pyright version pinned in
        # scripts/rules/pyright.py. The Pyright rules in rules/registry.toml
        # list the same packages, and the rules guard fails when one is
        # missing here.
        package:
          - libs/policyengine-simulation-contract
          - libs/policyengine-simulation-observability
          - libs/policyengine-stage12-persistence
          - libs/policyengine-fastapi
          - projects/policyengine-simulation-entry
          - projects/policyengine-simulation-gateway
          - projects/policyengine-simulation-executor
          - projects/policyengine-apis-integ

    steps:
    - uses: actions/checkout@v6

    - name: Set up Python
      uses: actions/setup-python@v6
      with:
        python-version: '3.13'

    - name: Install uv
      uses: astral-sh/setup-uv@v8.1.0
      with:
        enable-cache: true

    - name: Generate API clients
      # apis-integ installs the generated client from its output directory.
      if: matrix.package == 'projects/policyengine-apis-integ'
      run: ./scripts/generate-clients.sh

    - name: Run Pyright in the package's locked environment
      env:
        PACKAGE: ${{ matrix.package }}
      run: python -m scripts.rules pyright --sync "$PACKAGE"

  docker-build:
    name: Docker build
    needs: [test, lint]  # Only run if tests and linting pass
    runs-on: ubuntu-latest
    strategy:
      matrix:
        service: [simulation-entry, simulation-executor]

    steps:
    - uses: actions/checkout@v6

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v4

    - name: Build Docker image
      uses: docker/build-push-action@v7
      with:
        context: .
        file: projects/policyengine-${{ matrix.service }}/Dockerfile
        push: false
        tags: policyengine-${{ matrix.service }}:test
        cache-from: type=gha
        cache-to: type=gha,mode=max
        platforms: linux/amd64

  test-integration:
    name: Test integration
    needs: docker-build  # Only run if docker builds succeed
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v6

    - name: Set up Python
      uses: actions/setup-python@v6
      with:
        python-version: '3.13'

    - name: Install uv
      uses: astral-sh/setup-uv@v8.1.0
      with:
        enable-cache: true

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v4

    - name: Generate API clients
      run: |
        ./scripts/generate-clients.sh

    # After the clients exist: policyengine-apis-integ depends on the generated
    # client by path, so its lock can only be checked once it is generated.
    - name: Check every uv.lock matches its pyproject.toml
      run: .github/scripts/check-uv-locks.sh

    - name: Start services
      run: .github/scripts/start-local-services.sh deployment/docker-compose.yml

    - name: Install integration test dependencies
      working-directory: projects/policyengine-apis-integ
      run: uv sync --frozen --extra test

    - name: Run integration tests (local services only)
      working-directory: projects/policyengine-apis-integ
      # Run tests against local Docker services only (not Modal staging)
      run: uv run --frozen pytest tests/ -v -m "not requires_gcp and not beta_only"

    - name: Show service logs on failure
      if: failure()
      run: |
        docker compose -f deployment/docker-compose.yml logs

    - name: Stop services
      if: always()
      run: |
        docker compose -f deployment/docker-compose.yml down