python-ci.yml

#
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
#

name: "Python CI"

on:
  push:
    branches:
    - 'main'
  pull_request:
  merge_group:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  lint-and-unit-test:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    strategy:
      max-parallel: 15
      fail-fast: true
      matrix:
        python: ['3.10', '3.11', '3.12', '3.13', '3.14']

    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false
    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
      with:
        python-version: ${{ matrix.python }}
    - name: Install UV
      uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
      with:
        enable-cache: true
    - name: Install system dependencies
      run: sudo apt-get update && sudo apt-get install -y libkrb5-dev # for kerberos
    - name: Check uv.lock is up to date
      run: uv lock --check
    - name: Install
      run: make install
    - name: Run linters
      run: make lint
    - name: Run unit tests with coverage
      run: COVERAGE=1 make test
    - name: Generate coverage report (85%) # Coverage threshold should only increase over time — never decrease it!
      run: COVERAGE_FAIL_UNDER=85 make coverage-report

  windows-unit-test:
    runs-on: windows-latest
    timeout-minutes: 15
    strategy:
      fail-fast: true
      matrix:
        python: ['3.12']

    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false
    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
      with:
        python-version: ${{ matrix.python }}
    - name: Install UV
      uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
      with:
        enable-cache: true
    - name: Install
      run: uv sync --all-extras --no-extra hive-kerberos
    - name: Run unit tests
      run: uv run python -m pytest tests/ -m "(unmarked or parametrize) and not integration" --ignore=tests/integration -v -x

  cibw-dev-env-smoke-test:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false
    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
      with:
        python-version: '3.12'
    - name: Install UV
      uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
      with:
        enable-cache: true
    # Why this exists:
    # Catch import-time regressions (e.g., global conftest optional deps)
    # in the same dev-only environment used by cibuildwheel wheel tests.
    # Keep this in sync with wheel build test setup in
    # .github/workflows/pypi-build-artifacts.yml:
    #   CIBW_BEFORE_TEST: uv sync --directory {project} --only-group dev --no-install-project
    #   CIBW_TEST_COMMAND: uv run --directory {project} pytest tests/avro/test_decoder.py
    - name: Mirror wheel CIBW_BEFORE_TEST
      run: uv sync --directory . --only-group dev --no-install-project
    - name: Mirror wheel CIBW_TEST_COMMAND
      run: uv run --directory . pytest tests/avro/test_decoder.py

  python-ci-required:
    if: ${{ always() }}
    needs: [lint-and-unit-test, windows-unit-test, cibw-dev-env-smoke-test]
    runs-on: ubuntu-latest
    steps:
    - name: Verify Python CI jobs succeeded
      env:
        RESULTS: ${{ join(needs.*.result, ' ') }}
      run: |
        read -ra results <<< "$RESULTS"
        for result in "${results[@]}"; do
          test "$result" = "success"
        done