python-package.yml

# This workflow will install Python dependencies, run tests and lint with a variety of Python versions
# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python

name: Python package

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]

permissions:
  contents: read

jobs:
  # -- Windows: unit tests only (no MySQL) ------------------------------------
  windows-unit:
    runs-on: windows-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.12", "3.13"]
    steps:
    - uses: actions/checkout@v4
    - name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@v5
      with:
        python-version: ${{ matrix.python-version }}
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        python -m pip install pdm
        pdm install
        pdm install -G dev
    - name: Run unit tests
      run: pdm run test-unit

  # -- Linux: full test suite + coverage + SonarCloud ------------------------
  build:

    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.11", "3.12", "3.13"]

    services:
      mysql:
        image: mysql:8.0
        env:
          MYSQL_ROOT_PASSWORD: rootpass
          MYSQL_DATABASE: dashboard_test
        ports:
          - 3306:3306
        options: >-
          --health-cmd="mysqladmin ping -h 127.0.0.1 -uroot -prootpass"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=10

    env:
      DB_HOST: 127.0.0.1
      DB_PORT: 3306
      DB_TEST_NAME: dashboard_test
      DB_TEST_USER: dashboard_test
      DB_TEST_PASSWORD: testpass
      DB_TEST_MIGRATE_USER: dashboard_test_admin
      DB_TEST_MIGRATE_PASSWORD: testpass

    steps:
    - uses: actions/checkout@v4
    - name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@v5
      with:
        python-version: ${{ matrix.python-version }}
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        python -m pip install pdm
        pdm install
        pdm install -G dev
    - name: Wait for MySQL & create test users
      run: |
        for i in {1..30}; do
          if mysqladmin ping -h 127.0.0.1 -uroot -prootpass --silent; then
            break
          fi
          sleep 2
        done
        mysql -h 127.0.0.1 -uroot -prootpass <<-SQL
          CREATE USER IF NOT EXISTS 'dashboard_test'@'%' IDENTIFIED BY 'testpass';
          CREATE USER IF NOT EXISTS 'dashboard_test_admin'@'%' IDENTIFIED BY 'testpass';
          GRANT ALL ON dashboard_test.* TO 'dashboard_test'@'%';
          GRANT ALL ON dashboard_test.* TO 'dashboard_test_admin'@'%';
          GRANT CREATE ON *.* TO 'dashboard_test_admin'@'%';
          FLUSH PRIVILEGES;
        SQL
    - name: Build with pdm
      run: |
        pdm build
    - name: Test with pytest
      run: |
        pdm run test-ci
    # JS toolchain (#251): Vitest produces coverage/lcov.info that Sonar
    # consumes alongside the Python coverage.xml. Only run on the 3.13
    # job so we don't reinstall Node + npm deps three times.
    - name: Set up Node.js
      if: matrix.python-version == '3.13'
      uses: actions/setup-node@v4
      with:
        node-version: '22'
    - name: Install JS dependencies
      if: matrix.python-version == '3.13'
      run: npm ci
    - name: Run JS tests with coverage
      if: matrix.python-version == '3.13'
      run: pdm run js-test
    - name: Upload coverage reports to Codecov
      uses: codecov/codecov-action@v5
      with:
        token: ${{ secrets.CODECOV_TOKEN }}
    - name: Upload coverage.xml for SonarCloud job
      if: matrix.python-version == '3.13'
      uses: actions/upload-artifact@v4
      with:
        name: coverage-xml
        path: coverage.xml
        if-no-files-found: error
        retention-days: 1
    - name: Upload JS lcov.info for SonarCloud job
      if: matrix.python-version == '3.13'
      uses: actions/upload-artifact@v4
      with:
        name: coverage-lcov
        path: coverage/lcov.info
        if-no-files-found: error
        retention-days: 1

  sonarcloud:
    name: SonarCloud
    needs: build
    runs-on: ubuntu-latest
    # Fork PRs cannot read SONAR_TOKEN; skip the scan there to avoid a hard fail.
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    steps:
    - uses: actions/checkout@v4
      with:
        # SonarCloud uses git blame to attribute issues to authors / new code.
        fetch-depth: 0
    - name: Download coverage.xml
      uses: actions/download-artifact@v4
      with:
        name: coverage-xml
    - name: Download JS lcov.info
      uses: actions/download-artifact@v4
      with:
        name: coverage-lcov
        # Sonar reads it from ``coverage/lcov.info`` per
        # sonar-project.properties.
        path: coverage
    - name: SonarCloud Scan
      uses: SonarSource/sonarqube-scan-action@v6
      env:
        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        SONAR_HOST_URL: https://sonarcloud.io