ci.yml

# SPDX-FileCopyrightText: Copyright (C) 2025 Opal Health Informatics Group at the Research Institute of the McGill University Health Centre <john.kildea@mcgill.ca>
#
# SPDX-License-Identifier: AGPL-3.0-or-later
name: ci

on:
  push:
    branches:
      - main
  pull_request:
  workflow_dispatch:
  merge_group:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false
      - uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b # v7.2.0
        id: setup-uv
        with:
          # renovate: datasource=pypi dependency=uv
          version: "0.9.22"
      - name: Install dependencies
        # docs dependencies required to type check scripts in docs/
        run: uv sync --locked --group docs
      - name: Run ruff check
        if: '!cancelled()'
        uses: astral-sh/ruff-action@57714a7c8a2e59f32539362ba31877a1957dded1 # v3.5.1
      - name: Run ruff format
        if: '!cancelled()'
        uses: astral-sh/ruff-action@57714a7c8a2e59f32539362ba31877a1957dded1 # v3.5.1
        with:
          args: "format --check"
      - name: Run mypy
        if: '!cancelled()'
        # create minimal env file for mypy
        run: |
          cp .env.sample .env
          # generate secret key
          SECRET_KEY=$(python -c "import secrets; print(secrets.token_urlsafe())")
          sed -i "s/^SECRET_KEY=.*/SECRET_KEY=$SECRET_KEY/" .env
          uv run mypy .
      - uses: mschoettle/pre-commit-action@0ffaba63d7e205c4109d6a3ca4ced5fc4decd04b # v4.2.3
        if: '!cancelled()'
        env:
          SKIP: ruff,ruff-format,mypy,markdownlint-cli2,reuse-lint-file
      - uses: opalmedapps/actions/actions/check-thirdparty-notice@main
        if: '!cancelled()'
        with:
          pyproject-file: './pyproject.toml'
          package-file: './opal/static/thirdparty/package.json'

  django-checks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false
      - uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b # v7.2.0
        id: setup-uv
        with:
          # renovate: datasource=pypi dependency=uv
          version: "0.9.22"
      - name: Install dependencies
        run: uv sync --locked --no-dev
      - name: Configure environment file
        # create minimal env file for management commands
        run: |
          cp .env.sample .env
          # generate secret key
          SECRET_KEY=$(python -c "import secrets; print(secrets.token_urlsafe())")
          sed -i "s/^SECRET_KEY=.*/SECRET_KEY=$SECRET_KEY/" .env
      - name: Check for model changes with no migration
        if: '!cancelled()'
        run: uv run python manage.py makemigrations --dry-run --check
      - name: Check for stale translation files
        if: '!cancelled()'
        run: |
          sudo apt update && sudo apt install gettext
          uv run python manage.py makemessages --add-location file -l fr
          # due to git LFS the LFS-tracked files show up in the diff, limit the diff to only .po files
          git diff --ignore-matching-lines=POT-Creation-Date --exit-code -- *.po
      - name: Check for fuzzy translation strings
        if: '!cancelled()'
        run: |
          FUZZY_STRINGS=$(grep --include=\*.po -rnw './opal' -e "#, fuzzy" -B01 -A02 | grep -E '#[~]?\| msgid' -B02 -A01 || true)
          if [[ $FUZZY_STRINGS ]]; then
            echo "$FUZZY_STRINGS"
            (! echo "$FUZZY_STRINGS" | grep -q .)
          fi
      - name: Check for commented out translation strings
        if: '!cancelled()'
        run: |
          COMMENTED_STRINGS=$(grep --include=\*.po -rnw './opal' -e "#~ msgid" -B01 -A03 || true)
          if [[ $COMMENTED_STRINGS ]]; then
            echo "$COMMENTED_STRINGS"
            (! echo "$COMMENTED_STRINGS" | grep -q .)
          fi
      - name: Run check management command
        if: '!cancelled()'
        run: uv run python manage.py check --fail-level WARNING
      - name: Validate templates
        if: '!cancelled()'
        run: uv run python manage.py validate_templates

  test:
    runs-on: ubuntu-latest
    env:
      DB_ROOT_PASSWORD: "root-password"
      DB_PASSWORD: "user-password"
      DB_USER: citest
    container: python:3.14.2-alpine3.22
    services:
      db:
        image: mariadb:10.11.15-jammy
        env:
          MARIADB_ROOT_PASSWORD: ${{ env.DB_ROOT_PASSWORD }}
          # ensure that user has permissions for test DB to be used by pytest
          MARIADB_DATABASE: test_opal
          MARIADB_USER: ${{ env.DB_USER }}
          MARIADB_PASSWORD: ${{ env.DB_PASSWORD }}

    steps:
      - name: Install Git
        run: |
          apk add --no-cache git git-lfs
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false
          lfs: true
      - name: Install dependencies
        run: |
          pip install uv
          echo "Installed uv version is $(uv --version)"
          # install dependencies for mysqlclient
          apk add --no-cache build-base mariadb-dev mariadb-client chromium
          uv sync --locked
          chromium --version
      - name: Prepare environment
        # set up env file for DB service
        # use sample env file
        # create additional DBs for legacy DB tests (OpalDB & QuestionnaireDB)
        run: |
          cp .env.sample .env
          sed -i "s/^DATABASE_USER=.*/DATABASE_USER=$DB_USER/" .env
          sed -i "s/^DATABASE_PASSWORD=.*/DATABASE_PASSWORD=$DB_PASSWORD/" .env
          sed -i "s/^DATABASE_HOST=.*/DATABASE_HOST=db/" .env
          # set up legacy DB connection
          # reuse the same database as for the other tests to make it easier
          sed -i "s/^LEGACY_DATABASE_HOST=.*/LEGACY_DATABASE_HOST=db/" .env
          sed -i "s/^LEGACY_DATABASE_PORT=.*/LEGACY_DATABASE_PORT=3306/" .env
          sed -i "s/^LEGACY_DATABASE_USER=.*/LEGACY_DATABASE_USER=$DB_USER/" .env
          sed -i "s/^LEGACY_DATABASE_PASSWORD=.*/LEGACY_DATABASE_PASSWORD=$DB_PASSWORD/" .env
          # generate secret key
          SECRET_KEY=$(python -c "import secrets; print(secrets.token_urlsafe())")
          sed -i "s/^SECRET_KEY=.*/SECRET_KEY=$SECRET_KEY/" .env
          MYSQL_PWD=$DB_ROOT_PASSWORD mariadb -u root -h db --skip-ssl -e "GRANT ALL PRIVILEGES ON \`test_OpalDB\`.* TO \`$DB_USER\`@\`%\`;"
          MYSQL_PWD=$DB_ROOT_PASSWORD mariadb -u root -h db --skip-ssl -e "GRANT ALL PRIVILEGES ON \`test_QuestionnaireDB\`.* TO \`$DB_USER\`@\`%\`;"
      - name: Run pytest
        run: |
          uv run pytest --version
          # -m "" runs all tests, even the ones marked as slow
          uv run coverage run -m pytest -m "" -v --junitxml=test-report.xml
      # see: https://github.com/dorny/test-reporter/issues/244
      # - name: Publish Test Results
      #   uses: dorny/test-reporter@v1.9.1
      #   if: '!cancelled()'
      #   with:
      #     name: Tests
      #     path: ./test-report.xml
      #     reporter: java-junit
      - name: Check coverage
        run: |
          uv run coverage report


  markdownlint:
    permissions:
      contents: read
    uses: opalmedapps/.github/.github/workflows/markdownlint.yaml@main

  run-reuse-workflow:
    uses: opalmedapps/.github/.github/workflows/reuse.yaml@main

  build-docs:
    runs-on: ubuntu-latest
    needs:
      - lint
    steps:
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false
          # fetch the full git history to be able to determine creation dates for pages
          # see: https://github.com/timvink/mkdocs-git-revision-date-localized-plugin?tab=readme-ov-file#note-when-using-build-environments
          fetch-depth: 0
      - uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b # v7.2.0
        id: setup-uv
        with:
          # renovate: datasource=pypi dependency=uv
          version: "0.9.22"
      - name: Install dependencies
        run: |
          uv sync --locked --no-dev --group docs
      # create minimal env file for mypy
      - name: Prepare environment
        run: |
          cp .env.sample .env
          # generate secret key
          SECRET_KEY=$(python -c "import secrets; print(secrets.token_urlsafe())")
          sed -i "s/^SECRET_KEY=.*/SECRET_KEY=$SECRET_KEY/" .env
      # see: https://squidfunk.github.io/mkdocs-material/publishing-your-site/#with-github-actions
      # weekly cache updates
      - run: echo "cache_id=$(date --utc '+%V')" >> "$GITHUB_ENV"
      - uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
        with:
          # weekly cache
          key: mkdocs-material-${{ env.cache_id }}
          path: .cache
          restore-keys: |
            mkdocs-material-
      - name: Build site
        run: uv run mkdocs build --strict

  build-image:
    needs:
      - lint
    permissions:
      contents: read
      packages: write
    uses: ./.github/workflows/build.yml