ci.yaml

name: CI

on:
  push:
    branches: [main, develop]
  pull_request:
  workflow_dispatch:
  workflow_call:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  lint:
    name: lint
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Set up mise and the pinned tools
        uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0
        with:
          version: 2026.9.18
          install: true
          cache: true

      - name: Run lint checks
        env:
          SKILL_SCAN_BASE: ${{ github.event.pull_request.base.sha }}
        run: mise run lint

  test:
    name: test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up mise and the tools the tests need
        uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0
        with:
          version: 2026.9.18
          install: true
          install_args: python uv
          cache: true

      # The helpers are POSIX sh and the suite runs them with the system's: dash
      # on Ubuntu, bash 3.2 in POSIX mode on macOS.
      - name: Show the sh the suite runs on
        run: ls -l /bin/sh

      - name: Run tests
        run: mise run test

      - name: Upload test reports
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: test-reports-${{ matrix.os }}
          path: reports/
          if-no-files-found: warn
          retention-days: 14

  # BusyBox ash and BusyBox awk, the smallest userland the helpers claim to run
  # on. Alpine has no bash of its own; bash is installed only because a few of
  # the suite's stand-in binaries are written in it.
  test-alpine:
    name: test (alpine)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Run tests on BusyBox
        run: |
          docker run --rm -v "$PWD":/src:ro \
            alpine:3.22@sha256:5291449c3df73caf6ed85e649dec1b9e818b39a5d8c871e97afc13e9cd5e8fa8 \
            sh -c '
              apk add --no-cache git python3 py3-pytest bash jq
              git config --global user.name ci
              git config --global user.email ci@example.test
              git config --global init.defaultBranch main
              git config --global --add safe.directory "*"
              cp -r /src /work && cd /work
              DELIVERY_TEST_SH=/bin/sh python3 -m pytest -q -p no:cacheprovider tests/unit
            '