ci-copier.yml

name: CI Copier
on:
  pull_request:
  merge_group:

# Automatically stop old builds on the same branch/PR
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint:
    name: Lint
    timeout-minutes: 30
    runs-on: ubuntu-latest
    steps:
      - name: Checkout branch
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Set up pixi
        uses: prefix-dev/setup-pixi@a0af7a228712d6121d37aba47adf55c1332c9c2e # v0.9.4
      - name: Run linting
        run: pixi run lint
        env:
          CLICOLOR_FORCE: 1

  pytest:
    timeout-minutes: 30
    runs-on: ubuntu-latest
    steps:
      - name: Checkout branch
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Set up pixi
        uses: prefix-dev/setup-pixi@a0af7a228712d6121d37aba47adf55c1332c9c2e # v0.9.4
      - name: Test
        run: pixi run test --color=yes
        env:
          # needed for test_template_update
          GH_TOKEN: ${{ github.token }}

  test-generated-package-ci:
    name: Test CI of generated package (minimal-python = ${{ matrix.minimal-python-version }})
    timeout-minutes: 30
    runs-on: ubuntu-latest
    strategy:
      matrix:
        minimal-python-version: [py310, py311, py314]
    steps:
      - name: Checkout branch
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ssh-key: ${{ secrets.SSH_PRIVATE_KEY }}
          fetch-depth: 0
      - name: Set up pixi
        uses: prefix-dev/setup-pixi@a0af7a228712d6121d37aba47adf55c1332c9c2e # v0.9.4
        with:
          activate-environment: true
      - name: Generate branch name
        id: branch
        run: |
          echo "name=ci/$GITHUB_SHA-${{ matrix.minimal-python-version }}" >> $GITHUB_OUTPUT
      - name: Test generated package CI
        run: |
          # Name of the generated package.
          # Authentication for pushing to $REPO.
          AUTH='authorization: Bearer ${{ secrets.GITHUB_TOKEN }}'
          eval $(ssh-agent)
          ssh-add - <<< "${{ secrets.SSH_PRIVATE_KEY }}"
          # Set up local Git so that copier can run "git commit".
          git config --global user.email "landocalrissian@example.com"
          git config --global user.name "Lando Calrissian"
          # Generate package with default settings + Windows CI.
          copier copy \
            --data project_slug="package" \
            --data project_short_description="Example Package" \
            --data github_user="LandoCalrissian" \
            --data author_name="Lando Calrissian" \
            --data author_email="lando@calrissian.org" \
            --data minimal_python_version="${{ matrix.minimal-python-version }}" \
            --defaults \
            --trust \
            --vcs-ref HEAD \
            . out
          cd out
          # Replace actions trigger with on: [push]
          yq eval '.on = ["push"]' -i .github/workflows/ci.yml
          yq eval '.on = ["push"]' -i .github/workflows/build.yml
          git init
          # create pixi.lock
          pixi lock --manifest-path pixi.toml --color=always
          git add .
          git commit -m "Initial commit"
          # Push the generated package's HEAD commit to a `ci/*` branch
          cid=$(git rev-parse HEAD)
          git push -f "${GITHUB_SERVER_URL/https:\/\//git@}:$GITHUB_REPOSITORY" $cid:refs/heads/${STEPS_BRANCH_OUTPUTS_NAME}
          # Use the GitHub API to wait for the generated package's CI to complete (success or failure).
          # We look for a GitHub Actions run for the HEAD commit ID.
          WORKFLOW_URL="$GITHUB_API_URL/repos/${GITHUB_REPOSITORY}/actions/runs?branch=${STEPS_BRANCH_OUTPUTS_NAME}&head_sha=${cid}"
          echo "Waiting for inner CI to start"
          while (( $(curl -Ls --header "$AUTH" "$WORKFLOW_URL" | jq -r ".workflow_runs | length") < 1 )); do
            sleep 10
          done
          echo "Waiting for inner CI to complete"
          while curl -Ls --header "$AUTH" "$WORKFLOW_URL" | jq -r ".workflow_runs | .[] | .status" | grep --invert-match completed > /dev/null; do
            sleep 10
          done
          # Fail unless CI was successful.
          if curl -Ls --header "$AUTH" "$WORKFLOW_URL" | jq -r ".workflow_runs | .[] | .conclusion" | grep --invert-match success > /dev/null; then
            echo "CI pipeline failed"
            exit 1
          fi
        env:
          STEPS_BRANCH_OUTPUTS_NAME: ${{ steps.branch.outputs.name }}
      - name: Clean up CI branch
        if: always()
        run: |
          set -x
          AUTH='authorization: Bearer ${{ secrets.GITHUB_TOKEN }}'
          eval $(ssh-agent)
          ssh-add - <<< "${{ secrets.SSH_PRIVATE_KEY }}"

          git push -d "${GITHUB_SERVER_URL/https:\/\//git@}:$GITHUB_REPOSITORY" refs/heads/ci/$GITHUB_SHA-${{ matrix.minimal-python-version }}

          cid=$(git rev-parse HEAD)
          for line in $(curl -Ls --header "$AUTH" "$GITHUB_API_URL/repos/${GITHUB_REPOSITORY}/actions/runs?branch=ci/${GITHUB_SHA}-${{ matrix.minimal-python-version }}&head_sha=${cid}" | jq -r ".workflow_runs | .[] | select(.status != \"completed\") | .id")
          do
            curl -Ls --header "$AUTH" --request POST "$GITHUB_API_URL/repos/${GITHUB_REPOSITORY}/actions/runs/$line/cancel" > /dev/null
          done

  finalize:
    name: Test CI of generated package (all)
    timeout-minutes: 5
    runs-on: ubuntu-latest
    needs: test-generated-package-ci
    if: always() && !cancelled()
    steps:
      - if: needs.test-generated-package-ci.result == 'success'
        name: All tests passed
        run: echo All tests passed

      - if: needs.test-generated-package-ci.result != 'success'
        name: Some tests failed
        run: |
          echo Some tests failed
          exit 1