superset-python-unittest.yml

# Python unit tests
name: Python-Unit

# Least-privilege default for GITHUB_TOKEN. Jobs that need more (e.g. OIDC for
# codecov uploads) opt in via their own job-level `permissions:` block.
permissions:
  contents: read

on:
  push:
    branches:
      - "master"
      - "[0-9].[0-9]*"
  pull_request:
    types: [synchronize, opened, reopened, ready_for_review]

# cancel previous workflow jobs for PRs
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

jobs:
  changes:
    runs-on: ubuntu-26.04
    timeout-minutes: 10
    permissions:
      contents: read
      pull-requests: read
    outputs:
      python: ${{ steps.check.outputs.python }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Check for file changes
        id: check
        uses: ./.github/actions/change-detector/
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

  unit-tests:
    needs: changes
    if: needs.changes.outputs.python == 'true'
    runs-on: ubuntu-26.04
    timeout-minutes: 30
    permissions:
      id-token: write
    strategy:
      matrix:
        # Full version spread on push (master/release) + nightly; current only
        # on PRs to cut runner cost (cross-version breaks are caught at merge).
        python-version: ${{ github.event_name == 'pull_request' && fromJSON('["current"]') || fromJSON('["current", "next"]') }}
    env:
      PYTHONPATH: ${{ github.workspace }}
      # Promotes the SQLAlchemy 2.0 deprecation warnings already locked in as
      # errors via pytest.ini's `filterwarnings` to actually run in CI, so a
      # regression on those fails the build instead of relying on a
      # contributor remembering to set this locally. See the migration
      # battleplan: https://github.com/apache/superset/discussions/40273
      SQLALCHEMY_WARN_20: "1"
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          submodules: recursive
      - name: Setup Python
        uses: ./.github/actions/setup-backend/
        with:
          python-version: ${{ matrix.python-version }}
      - name: Python unit tests
        env:
          SUPERSET_TESTENV: true
          SUPERSET_SECRET_KEY: not-a-secret
        run: |
          pytest --durations-min=0.5 --cov-report= --cov=superset ./tests/common ./tests/unit_tests --cache-clear --maxfail=50 --junit-xml=test-results/junit-unit.xml
      - name: Python 100% coverage unit tests
        env:
          SUPERSET_TESTENV: true
          SUPERSET_SECRET_KEY: not-a-secret
        run: |
          pytest --durations-min=0.5 --cov=superset/sql/ ./tests/unit_tests/sql/ --cache-clear --cov-fail-under=100 --junit-xml=test-results/junit-sql-coverage.xml
          pytest --durations-min=0.5 --cov=superset/semantic_layers/ ./tests/unit_tests/semantic_layers/ --cache-clear --cov-fail-under=100 --junit-xml=test-results/junit-semantic-layers-coverage.xml
      - name: Upload code coverage
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        with:
          flags: python,unit
          verbose: true
          use_oidc: true
          slug: apache/superset
      # Uploaded even when a pytest step above fails, since that is exactly
      # when the JUnit results are needed downstream, to annotate the PR with
      # the failing tests. Consumed by the "Python Unit Test Results" workflow
      # via workflow_run (see that workflow for why it can't just be a step
      # here: it needs to run with write permissions, which this PR-triggered
      # job can't safely have on a fork PR).
      - name: Upload JUnit test results
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: junit-results-${{ matrix.python-version }}
          path: test-results/
          retention-days: 7

  # Uploads the raw pull_request event payload so the "Python Unit Test
  # Results" workflow (running via workflow_run, in base-branch context) can
  # look up which PR/commit to annotate without checking out untrusted code.
  event-file:
    runs-on: ubuntu-26.04
    timeout-minutes: 5
    steps:
      - name: Upload event file
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: Event File
          path: ${{ github.event_path }}
          retention-days: 7

  # Stable required-status-check anchor. `unit-tests` is a matrix job gated on
  # change detection, so on non-Python PRs it is skipped and never produces its
  # `unit-tests (current)` context (a job-level skip happens before matrix
  # expansion). This always-running job reports a single context that branch
  # protection can require: it passes when unit-tests succeeded or was skipped,
  # and fails only on a real failure.
  unit-tests-required:
    needs: [changes, unit-tests]
    if: always()
    runs-on: ubuntu-26.04
    timeout-minutes: 5
    permissions:
      contents: read
      actions: read
    steps:
      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
        with:
          expand-composite-actions: true

      - name: Check unit-tests result
        env:
          RESULT: ${{ needs.unit-tests.result }}
        run: |
          if [ "$RESULT" != "success" ] && [ "$RESULT" != "skipped" ]; then
            echo "unit-tests did not pass (result: $RESULT)"
            exit 1
          fi
          echo "unit-tests result: $RESULT"