name: CI

on:
  push:
    branches:
      - main
  pull_request:
  workflow_dispatch:
    inputs:
      force:
        description: "Force a release of this version type (passes through to python-semantic-release)"
        required: false
        default: ""
        type: choice
        options:
          - ""
          - patch
          - minor
          - major
          - prerelease

concurrency:
  group: ${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

env:
  POETRY_VIRTUALENVS_IN_PROJECT: "true"

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.10"
      - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1

  # Make sure commit messages follow the conventional commits convention:
  # https://www.conventionalcommits.org
  commitlint:
    name: Lint Commit Messages
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6.2.1

  test:
    strategy:
      fail-fast: false
      matrix:
        python-version:
          - "3.10"
          - "3.11"
          - "3.12"
          - "3.13"
          - "3.14"
          - "3.14t"
        os:
          - ubuntu-latest
          - macOS-latest
          - windows-latest
        extension:
          - "skip_cython"
          - "use_cython"
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Set up uv
        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          enable-cache: true
      - name: Install poetry
        run: uv tool install poetry
      - name: Set up Python
        id: setup-python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ matrix.python-version }}
          allow-prereleases: true
          cache: "poetry"
      - name: Cache poetry venv
        id: cache-venv
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            .venv
            src/bluetooth_data_tools/**/*.so
          key: venv-v2-${{ runner.os }}-py${{ steps.setup-python.outputs.python-version }}-${{ matrix.extension }}-${{ hashFiles('poetry.lock', 'pyproject.toml', 'build_ext.py', 'src/bluetooth_data_tools/**/*.py', 'src/bluetooth_data_tools/**/*.pyx', 'src/bluetooth_data_tools/**/*.pxd', 'src/bluetooth_data_tools/**/*.h') }}
      - name: Install Dependencies
        if: steps.cache-venv.outputs.cache-hit != 'true'
        run: |
          if [ "${{ matrix.extension }}" = "skip_cython" ]; then
            SKIP_CYTHON=1 poetry install --only=main,dev
          else
            # Without this the extensions can silently fail to compile and the
            # job still passes -- testing the pure-Python path a second time.
            # Verbose so the build backend's compiler output reaches the log;
            # poetry otherwise reports only "Failed to install".
            REQUIRE_CYTHON=1 poetry install --only=main,dev -vvv
          fi
        shell: bash
      - name: Test with Pytest
        run: poetry run pytest --cov-report=xml -v -Wdefault --cov=bluetooth_data_tools --cov-report=term-missing:skip-covered tests
        shell: bash
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        with:
          token: ${{ secrets.CODECOV_TOKEN }}

  benchmark:
    strategy:
      fail-fast: false
      matrix:
        python-version:
          - "3.13"
        os:
          - ubuntu-latest
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Set up uv
        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          enable-cache: true
      - name: Install poetry
        run: uv tool install poetry
      - name: Set up Python
        id: setup-python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ matrix.python-version }}
          cache: "poetry"
      - name: Cache poetry venv
        id: cache-venv
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            .venv
            src/bluetooth_data_tools/**/*.so
          key: venv-v2-${{ runner.os }}-benchmark-py${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('poetry.lock', 'pyproject.toml', 'build_ext.py', 'src/bluetooth_data_tools/**/*.py', 'src/bluetooth_data_tools/**/*.pyx', 'src/bluetooth_data_tools/**/*.pxd', 'src/bluetooth_data_tools/**/*.h') }}
      - name: Install Dependencies
        if: steps.cache-venv.outputs.cache-hit != 'true'
        run: poetry install --only=main,dev,benchmark
        env:
          REQUIRE_CYTHON: 1
      - name: Run benchmarks
        run: |
          poetry run pytest bench --benchmark-autosave
          echo '# Benchmark Results' >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
          poetry run pytest-benchmark compare --columns=mean,ops >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
        shell: bash

  codspeed_benchmark:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Set up uv
        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          enable-cache: true
      - name: Install poetry
        run: uv tool install poetry
      - name: Setup Python 3.13
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: 3.13
          cache: "poetry"
      - name: Install Dependencies
        run: |
          REQUIRE_CYTHON=1 poetry install --only=main,dev
        shell: bash
      - name: Run benchmarks
        uses: CodSpeedHQ/action@88472375d0a4572cf70a9f1fe3a4e0ab8da1b924 # v5.0.1
        with:
          token: ${{ secrets.CODSPEED_TOKEN }}
          run: poetry run pytest --no-cov -vvvvv --codspeed tests/benchmarks
          mode: instrumentation

  # Dry run on PRs and non-main pushes. No environment, no publish
  # permissions, no OIDC, so PR runs carry no release blast radius.
  release-dry-run:
    needs:
      - test
      - lint
      - commitlint
    if: github.ref_name != 'main'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          ref: ${{ github.ref }}
      - name: Create local branch name
        env:
          BRANCH: ${{ github.head_ref || github.ref_name }}
        run: git switch -C "$BRANCH"
      - name: Test release
        uses: python-semantic-release/python-semantic-release@39dd2052f2ce8282a5d932c31d58a2ca06d2550e # v10.6.1
        with:
          no_operation_mode: true

  # Real release, only on main. The release environment and write/OIDC
  # permissions are scoped to this job so they never apply to PR runs.
  release:
    needs:
      - test
      - lint
      - commitlint
    if: github.ref_name == 'main'
    runs-on: ubuntu-latest
    environment: release
    concurrency:
      group: release-${{ github.ref }}
      cancel-in-progress: false
    permissions:
      id-token: write
      contents: write
    outputs:
      released: ${{ steps.release.outputs.released }}
      newest_release_tag: ${{ steps.release.outputs.tag }}

    steps:
      # Mint a short-lived installation token for the release-bot GitHub
      # App, which is in the main ruleset's bypass_actors list so PSR's
      # version-bump commit/tag push isn't blocked by required checks.
      # Per PSR's docs, the same token must be passed to actions/checkout
      # (via `token`) so its persisted http.extraheader doesn't override
      # PSR's URL-embedded auth at push time and re-attribute the push
      # to github-actions[bot].
      - name: Generate release App token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: ${{ secrets.RELEASE_APP_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          ref: ${{ github.ref }}
          token: ${{ steps.app-token.outputs.token || github.token }}

      - name: Create local branch name
        env:
          BRANCH: ${{ github.ref_name }}
        run: git switch -C "$BRANCH"

      # On main branch: actual PSR + upload to PyPI & GitHub
      - name: Release
        uses: python-semantic-release/python-semantic-release@39dd2052f2ce8282a5d932c31d58a2ca06d2550e # v10.6.1
        id: release
        with:
          github_token: ${{ steps.app-token.outputs.token }}
          force: ${{ inputs.force }}

      - name: Publish package distributions to PyPI
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        if: steps.release.outputs.released == 'true'

      - name: Publish package distributions to GitHub Releases
        uses: python-semantic-release/upload-to-gh-release@0a92b5d7ebfc15a84f9801ebd1bf706343d43711 # v9.8.9
        if: steps.release.outputs.released == 'true'
        with:
          github_token: ${{ steps.app-token.outputs.token }}

  build_wheels:
    needs: [release]
    if: needs.release.outputs.released == 'true'
    name: Wheels for ${{ matrix.os }} (${{ matrix.musl == 'musllinux' && 'musllinux' || 'manylinux' }}) ${{ matrix.qemu }} ${{ matrix.pyver }}
    runs-on: ${{ matrix.os }}
    strategy:
      # One broken target must not cancel the other 18 and hide which
      # platforms are actually failing.
      fail-fast: false
      matrix:
        os:
          [
            windows-latest,
            ubuntu-24.04-arm,
            ubuntu-latest,
            macos-15-intel,
            macos-latest,
          ]
        qemu: [""]
        musl: [""]
        pyver: [""]
        include:
          - os: ubuntu-latest
            musl: "musllinux"
          - os: ubuntu-24.04-arm
            musl: "musllinux"
          # qemu is slow, make a single
          # runner per Python version
          - os: ubuntu-latest
            qemu: armv7l
            musl: "musllinux"
            pyver: cp310
          - os: ubuntu-latest
            qemu: armv7l
            musl: "musllinux"
            pyver: cp311
          - os: ubuntu-latest
            qemu: armv7l
            musl: "musllinux"
            pyver: cp312
          - os: ubuntu-latest
            qemu: armv7l
            musl: "musllinux"
            pyver: cp313
          - os: ubuntu-latest
            qemu: armv7l
            musl: "musllinux"
            pyver: cp314
          - os: ubuntu-latest
            qemu: armv7l
            musl: "musllinux"
            pyver: cp314t
          # qemu is slow, make a single
          # runner per Python version
          - os: ubuntu-latest
            qemu: armv7l
            musl: ""
            pyver: cp310
          - os: ubuntu-latest
            qemu: armv7l
            musl: ""
            pyver: cp311
          - os: ubuntu-latest
            qemu: armv7l
            musl: ""
            pyver: cp312
          - os: ubuntu-latest
            qemu: armv7l
            musl: ""
            pyver: cp313
          - os: ubuntu-latest
            qemu: armv7l
            musl: ""
            pyver: cp314
          - os: ubuntu-latest
            qemu: armv7l
            musl: ""
            pyver: cp314t
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ needs.release.outputs.newest_release_tag }}
          fetch-depth: 0
      # Used to host cibuildwheel
      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"
      - name: Set up QEMU
        if: ${{ matrix.qemu }}
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
        with:
          platforms: all
          # This should be temporary
          # xref https://github.com/docker/setup-qemu-action/issues/188
          # xref https://github.com/tonistiigi/binfmt/issues/215
          image: tonistiigi/binfmt:qemu-v8.1.5
        id: qemu
      - name: Prepare emulation
        if: ${{ matrix.qemu }}
        run: |
          if [[ -n "${{ matrix.qemu }}" ]]; then
            # Build emulated architectures only if QEMU is set,
            # use default "auto" otherwise
            echo "CIBW_ARCHS_LINUX=${{ matrix.qemu }}" >> $GITHUB_ENV
          fi
      - name: Limit to a specific Python version on slow QEMU
        if: ${{ matrix.pyver }}
        run: |
          if [[ -n "${{ matrix.pyver }}" ]]; then
            echo "CIBW_BUILD=${{ matrix.pyver }}*" >> $GITHUB_ENV
          fi
      - name: Build wheels
        uses: pypa/cibuildwheel@4726cd35bb13f7bde50cf2761f2499ac7b3aa32c # v4.1.1
        env:
          CIBW_SKIP: cp36-* cp37-* cp38-* cp39-* pp* ${{ matrix.musl == 'musllinux' && '*manylinux*' || '*musllinux*' }}
          REQUIRE_CYTHON: 1

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: wheels-${{ matrix.os }}-${{ matrix.musl }}-${{ matrix.pyver }}-${{ matrix.qemu }}
          path: ./wheelhouse/*.whl

  upload_pypi:
    needs: [build_wheels]
    runs-on: ubuntu-latest
    environment: release
    permissions:
      id-token: write # IMPORTANT: this permission is mandatory for trusted publishing

    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          # unpacks default artifact into dist/
          # if `name: artifact` is omitted, the action will create extra parent dir
          path: dist
          pattern: wheels-*
          merge-multiple: true

      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        # To test: repository_url: https://test.pypi.org/legacy/
