pytest.yml

name: PyTest

on:
  # Run tests on PRs to verify code doesn't break before merge
  pull_request:
    types: [opened, synchronize]
    branches: [main]
    paths-ignore:
      - "**.md"
      - "**.sh"
      - "**.xml"
      - ".github/**"
      - ".gitignore"
      - "Dockerfile"
      - "CODEOWNERS"
      - "LICENSE"
  # Run tests after merge and save coverage to Supabase as canonical source of truth
  push:
    branches: [main]
    paths-ignore:
      - "**.md"
      - "**.sh"
      - "**.xml"
      - ".github/**"
      - ".gitignore"
      - "Dockerfile"
      - "CODEOWNERS"
      - "LICENSE"
  # Allow manual trigger for debugging
  workflow_dispatch:

# Cancel older runs when new commits are pushed to the same PR/branch
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  actions: write
  checks: write
  contents: read
  issues: write
  # metadata: read
  pull-requests: write
  statuses: write # commit statuses
  # workflows: write

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v6

      - name: Set up Python 3.14
        uses: actions/setup-python@v6
        with:
          python-version: "3.14"

      - name: Install uv
        uses: astral-sh/setup-uv@v7

      - name: Install dependencies
        run: uv sync --frozen

      - name: Set PYTHONPATH
        run: echo "PYTHONPATH=$GITHUB_WORKSPACE" >> $GITHUB_ENV

      - name: Check initial disk space
        run: df -h

      - name: Check memory usage
        run: free -h

      - name: Run pytest
        env: # https://github.com/gitautoai/gitauto/settings/secrets/actions
          # GitHub credentials https://github.com/settings/apps/gitauto-for-dev
          GH_APP_ID: ${{ secrets.GH_APP_ID }}
          GH_APP_NAME: ${{ secrets.GH_APP_NAME }}
          GH_APP_USER_ID: ${{ secrets.GH_APP_USER_ID }}
          GH_APP_USER_NAME: ${{ secrets.GH_APP_USER_NAME }}
          GH_PRIVATE_KEY: ${{ secrets.GH_PRIVATE_KEY }}
          GH_WEBHOOK_SECRET: ${{ secrets.GH_WEBHOOK_SECRET }}

          # Anthropic credentials
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

          # OpenAI credentials
          OPENAI_API_KEY: ${{ secrets.STAGE_OPENAI_API_KEY }}
          OPENAI_ORG_ID: ${{ secrets.STAGE_OPENAI_ORG_ID }}

          # Resend credentials
          RESEND_API_KEY: ${{ secrets.RESEND_API_KEY }}

          # Sentry credentials
          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}

          # Supabase credentials
          SUPABASE_SERVICE_ROLE_KEY: ${{ secrets.STAGE_SUPABASE_SERVICE_ROLE_KEY }}
          SUPABASE_URL: ${{ secrets.STAGE_SUPABASE_URL }}

          # Stripe credentials
          STRIPE_API_KEY: ${{ secrets.STAGE_STRIPE_API_KEY }}

          # AWS credentials (SSM parameter validation in infrastructure tests)
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-west-1

          # Environment variables
          ENV: stage
          PRODUCT_ID: ${{ secrets.STAGE_PRODUCT_ID }}

        run: |
          if [ "${{ github.event_name }}" = "push" ] || [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            uv run pytest --cov-branch --cov=./ --cov-report=lcov:coverage/lcov.info
          else
            uv run pytest
          fi

      - name: Check resources on failure
        if: failure()
        run: |
          df -h
          du -sh coverage/ .pytest_cache/ || true

      - name: Upload coverage artifact
        if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
        uses: actions/upload-artifact@v4
        with:
          name: coverage-report
          path: coverage/lcov.info