python-ci.yml

name: Delphi Python Tests

concurrency:
  group: python-ci-${{ github.ref }}
  cancel-in-progress: true

on:
  push:
    branches: [ edge, stable ]
    paths: &paths
      - 'delphi/**/*.py'
      - 'delphi/requirements*.txt'
      - 'delphi/Dockerfile'
      - 'scripts/*install.sh'
      - 'scripts/application_stop.sh'
      - 'scripts/validate_service.sh'
      - 'scripts/test-deploy-hooks.sh'
      - 'scripts/run-import-dry-run.py'
      - 'docker-compose*.yml'
      - '.github/workflows/python-ci.yml'
      - 'ci/test-migrations.sh'
      - 'ci/local/delphi-python.sh'
      - 'ci/local/delphi_python_results.py'
      - 'ci/local/delphi-test-durations.json'
      - 'ci/local/test-images.sh'
      - '.github/workflows/test-images.yml'
      - 'docker-compose.test.yml'
      - 'server/Dockerfile-db'
      - 'server/postgres/**'
      - 'queue-rs/polis-migrate/**'
      # server/src so a new server-side wildcard runs the projection-gate sweep
      - 'server/src/**'
      # Representative payload tests execute the probe planner and independent gate.
      - 'ci/private_cert/**'
      - 'ci/probe_box/**'
  pull_request:
    branches:
      - edge
      - stable
      - 'jc/**'
    paths: *paths
  # Manual trigger: lets repo write-access users run CI on any branch
  # (including spr/edge/* stack branches, which `pull_request` no longer
  # auto-triggers for). UI: Actions → Delphi Python Tests → "Run workflow".
  # CLI: `gh workflow run "Delphi Python Tests" --ref <branch>`.
  workflow_dispatch:

jobs:
  # Every step of the check lives in ci/local/delphi-python.sh, which runs the
  # same way on any Docker host. Hosted CI builds the stack's images once
  # (test-images.yml), splits the suite into shards (each also parallel inside
  # its job) that run from those images, and the `test` job puts the shards
  # back together: it proves every test ran in exactly one shard, adds up the
  # counts and combines coverage.
  images:
    uses: ./.github/workflows/test-images.yml
    with:
      # The suite runs against Postgres and the delphi image (math-python runs it too).
      images: postgres,delphi

  shard:
    name: test shard ${{ matrix.shard }}
    needs: images
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2, 3, 4, 5, 6]

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Download the test images
      uses: actions/download-artifact@v4
      with:
        name: test-images
        path: ${{ runner.temp }}/test-images

    - name: Load the test images
      run: |
        bash ci/local/test-images.sh load "$RUNNER_TEMP/test-images"
        rm -rf "$RUNNER_TEMP/test-images"
        df -h /

    - name: Delphi pytest (shard ${{ matrix.shard }}/${{ strategy.job-total }})
      env:
        POLIS_TEST_IMAGES: ci
        DELPHI_CHECK_OUT: ${{ github.workspace }}/delphi-results/shard-${{ matrix.shard }}
        # The runner is discarded after the job; tearing the stack down only costs time.
        DELPHI_CHECK_KEEP: '1'
      run: bash ci/local/delphi-python.sh --shard ${{ matrix.shard }}/${{ strategy.job-total }}

    - name: Upload shard results
      if: always()
      uses: actions/upload-artifact@v4
      with:
        name: delphi-shard-${{ matrix.shard }}
        path: |
          delphi-results/shard-${{ matrix.shard }}
          !delphi-results/shard-${{ matrix.shard }}/stack
        if-no-files-found: ignore

  test:
    needs: shard
    if: always()
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Every shard passed
      run: |
        echo "shards: ${{ needs.shard.result }}"
        test "${{ needs.shard.result }}" = success

    - name: Download shard results
      uses: actions/download-artifact@v4
      with:
        pattern: delphi-shard-*
        path: delphi-results

    - name: Combine shards (counts, coverage)
      env:
        DELPHI_CHECK_OUT: ${{ github.workspace }}/delphi-results/combined
      run: |
        bash ci/local/delphi-python.sh combine delphi-results/delphi-shard-*
        cp delphi-results/combined/coverage-comment.md coverage-comment.md

    - name: Upload Coverage Report
      uses: actions/upload-artifact@v4
      with:
        name: coverage-report
        path: coverage-comment.md

    - name: Post Coverage Comment
      if: github.event_name == 'pull_request'
      uses: actions/github-script@v6
      with:
        github-token: ${{ secrets.GITHUB_TOKEN }}
        script: |
          const fs = require('fs');
          const commentBody = fs.readFileSync('coverage-comment.md', 'utf8');
          const marker = '<!-- delphi-coverage-report -->';
          const body = `${marker}\n## Delphi Coverage Report\n\n${commentBody}`;

          try {
            // Find existing coverage comment
            const { data: comments } = await github.rest.issues.listComments({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
            });

            const existingComment = comments.find(c => c.body.includes(marker));

            if (existingComment) {
              // Delete existing comment so new one appears after latest commit
              await github.rest.issues.deleteComment({
                comment_id: existingComment.id,
                owner: context.repo.owner,
                repo: context.repo.repo,
              });
              console.log('Existing coverage comment deleted.');
            }

            // Always create a new comment
            await github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: body
            });
            console.log('Coverage comment posted successfully.');
          } catch (error) {
            if (error.status === 403) {
              console.log('Note: Could not post coverage comment to PR.');
              console.log('This is expected for PRs from forks due to GitHub token permissions.');
              console.log('Coverage report is in the log of the test job and in the coverage-report artifact.');
            } else {
              console.log(`Unexpected error posting comment: ${error.message}`);
            }
          }