main.yml

name: CI

on:
  push:
    branches:
      - main
    tags:
      - "**"
  pull_request: { }

env:
  CI: true
  # https://github.com/samuelcolvin/pytest-pretty#usage-with-github-actions
  COLUMNS: 180

permissions: { }

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false

      - name: Install uv
        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57  # v8.0.0
        with:
          version: "0.11.1"
          enable-cache: true  # zizmor: ignore[cache-poisoning] -- Job does not produce release artifacts and does not have sensitive permissions

      - name: Install dependencies
        run: uv sync --python 3.12 --frozen

      - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd  # v3.0.1
        with:
          extra_args: --all-files --verbose
        env:
          SKIP: no-commit-to-branch

  docs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false

      - name: Install uv
        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57  # v8.0.0
        with:
          version: "0.11.1"
          enable-cache: true  # zizmor: ignore[cache-poisoning] -- Job does not produce release artifacts and does not have sensitive permissions

      - run: uv sync --python 3.12 --frozen --group docs
      - run: uv pip install --upgrade mkdocs-material 'mkdocstrings-python<2.0.3' 'mkdocstrings<1' griffe==0.48.0
        env:
          UV_EXTRA_INDEX_URL: ${{ secrets.UV_EXTRA_INDEX_URL }}
      - run: |
          if [[ -n "$HEAD_REF" && "$REPOSITORY" != "$HEAD_REPO_FULL_NAME" ]]; then
            uv run --no-sync mkdocs build --no-strict
          else
            uv run --no-sync mkdocs build
          fi
        env:
          ALGOLIA_WRITE_API_KEY: ${{ secrets.ALGOLIA_WRITE_API_KEY }}
          HEAD_REF: ${{ github.head_ref }}
          REPOSITORY: ${{ github.repository }}
          HEAD_REPO_FULL_NAME: ${{ github.event.pull_request.head.repo.full_name }}

  test:
    name: test on Python ${{ matrix.python-version }}, pydantic ${{ matrix.pydantic-version }}, otel ${{ matrix.otel-version }}
    # Use Depot 4-core runners for maintainer PRs (faster CPUs/more cores)
    # Use 'ci:slow' label to force standard GitHub runners (e.g. during Depot outages)
    # Use 'ci:fast' label to opt-in fork PRs to Depot runners
    runs-on: >-
      ${{
        !contains(github.event.pull_request.labels.*.name, 'ci:slow')
        && (
          github.event.pull_request.head.repo.full_name == github.repository
          || contains(github.event.pull_request.labels.*.name, 'ci:fast')
        )
        && 'depot-ubuntu-24.04-4'
        || 'ubuntu-latest'
      }}
    strategy:
      fail-fast: false
      matrix:
        python-version: [ "3.9", "3.10", "3.11", "3.12", "3.13", "3.14" ]
        pydantic-version: [ "2" ] # i.e. the latest
        otel-version: [ "1" ] # i.e. the latest
        include:
          - python-version: "3.12"
            pydantic-version: "2.4"
            otel-version: "1" # i.e. the latest
          - python-version: '3.14'
            pydantic-version: '2'  # i.e. the latest
            otel-version: '1.39'
    env:
      PYTHON: ${{ matrix.python-version }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false

      - name: Ensure requests to production domains fail
        if: runner.os == 'Linux'
        run: |
          echo "203.0.113.0 logfire.dev" | sudo tee -a /etc/hosts
          echo "203.0.113.0 logfire-api.pydantic.dev" | sudo tee -a /etc/hosts
          echo "203.0.113.0 logfire.pydantic.dev" | sudo tee -a /etc/hosts

      - name: Install uv
        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57  # v8.0.0
        with:
          version: "0.11.1"
          enable-cache: true  # zizmor: ignore[cache-poisoning] -- Job does not produce release artifacts and does not have sensitive permissions

      - run: uv sync --python ${{ matrix.python-version }}

      - name: Install pydantic ${{ matrix.pydantic-version }}
        # installs the most recent patch on the minor version's track, ex 2.6.* -> 2.6.4
        run: uv pip install 'pydantic==${{ matrix.pydantic-version }}.*'

      - name: Install OTel SDK ${{ matrix.otel-version }}
        # installs the most recent patch on the minor version's track, ex 2.6.* -> 2.6.4
        run: |
          uv pip install 'opentelemetry-sdk==${{ matrix.otel-version }}.*'
          uv pip install 'opentelemetry-exporter-otlp-proto-http==${{ matrix.otel-version }}.*'

      - run: mkdir coverage
      - run: uv run --no-sync coverage run -m pytest --junitxml=coverage/test-results.xml
        env:
          COVERAGE_FILE: coverage/.coverage.${{ runner.os }}-py${{ matrix.python-version }}-pydantic-${{ matrix.pydantic-version }}-otel-${{ matrix.otel-version }}
      - name: store coverage files
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
        with:
          name: coverage-py${{ matrix.python-version }}-pydantic-${{ matrix.pydantic-version }}-otel-${{ matrix.otel-version }}
          path: coverage
          include-hidden-files: true

  coverage:
    runs-on: ubuntu-latest
    needs: [ test ]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false

      - name: Install uv
        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57  # v8.0.0
        with:
          version: "0.11.1"
          enable-cache: true  # zizmor: ignore[cache-poisoning] -- Job does not produce release artifacts and does not have sensitive permissions

      - name: Create venv
        run: uv venv --python 3.12

      - name: get coverage files
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          merge-multiple: true
          path: coverage

      - run: uv pip install coverage[toml]
      - run: uv run coverage combine coverage
      - run: uv run coverage xml
      - uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2  # v6.0.0
        with:
          file: ./coverage.xml
          env_vars: PYTHON
      - run: uv run coverage report --fail-under 100
      - name: Upload test results to Codecov
        uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3  #v1.2.1
        with:
          files: coverage/test-results.xml

  test-pyodide:
    name: test on Pyodide
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false

      - name: Install uv
        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57  # v8.0.0
        with:
          version: "0.11.1"
          enable-cache: true  # zizmor: ignore[cache-poisoning] -- Job does not produce release artifacts and does not have sensitive permissions

      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f  # v6.3.0
        with:
          node-version: "23"
          package-manager-cache: true  # zizmor: ignore[cache-poisoning] -- Job does not produce release artifacts and does not have sensitive permissions

      - run: make test-pyodide
        env:
          UV_PYTHON: ${{ matrix.python-version }}

  # https://github.com/marketplace/actions/alls-green#why used for branch protection checks
  check:
    if: always()
    needs: [ lint, docs, test, coverage, test-pyodide ]
    runs-on: ubuntu-latest
    steps:
      - name: Decide whether the needed jobs succeeded or failed
        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe  # v1.2.2
        with:
          jobs: ${{ toJSON(needs) }}

  trigger-docs:
    needs: [ check ]
    if: "success() && github.ref == 'refs/heads/main'"
    runs-on: ubuntu-latest
    steps:
      - name: Generate app token
        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859  # v3.0.0
        id: app-token
        with:
          app-id: ${{ vars.DOCS_APP_ID }}
          private-key: ${{ secrets.DOCS_APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          repositories: unified-docs

      - name: Trigger unified-docs deployment
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          gh api repos/pydantic/unified-docs/dispatches \
            --method POST \
            -f event_type=docs-update \
            -f "client_payload[source]=pydantic/logfire@${{ github.sha }}"

  release:
    needs: [ check ]
    if: "success() && startsWith(github.ref, 'refs/tags/')"
    runs-on: ubuntu-latest
    environment: release

    permissions:
      id-token: write

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false

      - name: Install uv
        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57  # v8.0.0
        with:
          version: "0.11.1"
          enable-cache: false

      - name: Set up Python 3.12
        run: uv python install 3.12

      - name: check GITHUB_REF matches package version
        uses: samuelcolvin/check-python-version@ee87cddb8049d2694cc03badc8569765a05cef00  # v5
        with:
          version_file_path: pyproject.toml

      - name: Build artifacts
        run: uv build --all

      - name: Publish logfire and logfire-api to PyPI
        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e  # v1.13.0
        with:
          skip-existing: true
          verbose: true