code_check.yml

name: Code Check

# Validates every PR against `main`. The four steps mirror the local
# `codecheck` shell function in docker/custom_commands.sh:
#   1. ruff check          — lint + import order (per pyproject.toml)
#   2. ruff format --check — black-compatible formatter, read-only
#   3. mypy                — static type checks
#   4. pytest -x           — full test suite, stop on first failure
# Plus a build smoke-test (sdist + wheel) on the lowest supported Python
# so packaging issues surface in the PR rather than during release.
#
# Branch protection on `main` should require this check to pass before
# auto-release.yml gets to run (which only fires on PR-merge).

on:
  pull_request:
    branches: [main]
    types: [opened, synchronize, reopened]
  # Allow re-running the gate manually from the Actions tab if needed
  workflow_dispatch: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  code_check:
    name: Code Check (Python ${{ matrix.python-version }})
    runs-on: ubuntu-latest
    strategy:
      # Don't abort the matrix on a single-version failure — we want to see
      # whether the issue is version-specific.
      fail-fast: false
      matrix:
        # Lower bound (project's `requires-python = ">=3.10"`) + a current
        # interpreter. Expand here if a downstream user reports a
        # 3.11/3.13-specific issue.
        python-version: ["3.10", "3.12"]

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip
          cache-dependency-path: pyproject.toml

      - name: Install dev extras
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"

      - name: Lint — ruff check
        run: ruff check dailybot_cli tests

      - name: Format — ruff format --check
        run: ruff format --check dailybot_cli tests

      - name: Type check — mypy
        run: mypy dailybot_cli

      - name: Tests — pytest
        run: pytest -x

  installer_checksums:
    name: Installer checksums in sync
    runs-on: ubuntu-latest
    # Cheap check, no Python needed — fail fast on this and developers see
    # immediately that they forgot to regenerate the .sha256 alongside their
    # install.sh edit. The auto-regenerate workflow on `main` will fix it
    # post-merge anyway, but catching it pre-merge is friendlier for reviewers
    # (the diff stays self-consistent).
    steps:
      - uses: actions/checkout@v6
      - name: Verify install.sh.sha256 matches install.sh
        run: |
          if [ ! -f install.sh.sha256 ]; then
            echo "::error file=install.sh::install.sh.sha256 is missing. Run: shasum -a 256 install.sh > install.sh.sha256"
            exit 1
          fi
          shasum -a 256 -c install.sh.sha256 || {
            echo ""
            echo "::error file=install.sh.sha256::install.sh.sha256 is out of sync with install.sh."
            echo "Regenerate it locally and commit:"
            echo "    shasum -a 256 install.sh > install.sh.sha256"
            echo "    git add install.sh.sha256 && git commit -m 'chore(installer): regenerate install.sh.sha256'"
            exit 1
          }
      - name: Verify install.ps1.sha256 matches install.ps1 (if present)
        run: |
          if [ -f install.ps1 ]; then
            if [ ! -f install.ps1.sha256 ]; then
              echo "::error file=install.ps1::install.ps1.sha256 is missing. Run: shasum -a 256 install.ps1 > install.ps1.sha256"
              exit 1
            fi
            shasum -a 256 -c install.ps1.sha256 || {
              echo "::error file=install.ps1.sha256::install.ps1.sha256 is out of sync with install.ps1."
              exit 1
            }
          fi

  build_smoke_test:
    name: Build smoke-test (sdist + wheel)
    runs-on: ubuntu-latest
    needs: code_check
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"
          cache: pip
          cache-dependency-path: pyproject.toml

      - name: Install build + twine
        run: |
          python -m pip install --upgrade pip
          pip install build twine

      - name: Build sdist + wheel
        run: python -m build

      - name: Validate metadata (twine check)
        run: twine check dist/*

      - name: Inspect artifacts
        run: ls -la dist/