ci.yml

name: CI

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

env:
  PYTHONPATH: python
  PYTHON_VERSION: "3.12"
  GLOBAL_COVERAGE_THRESHOLD: "65"
  PATCH_COVERAGE_THRESHOLD: "80"

jobs:
  classify-changes:
    name: Classify Changes
    runs-on: ubuntu-latest
    outputs:
      gate_mode: ${{ steps.classify.outputs.gate_mode }}
      has_python_source_diff: ${{ steps.classify.outputs.has_python_source_diff }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Classify PR diff
        id: classify
        shell: bash
        run: |
          set -euo pipefail

          if [ "${{ github.event_name }}" != "pull_request" ]; then
            echo "gate_mode=full" >> "$GITHUB_OUTPUT"
            echo "has_python_source_diff=true" >> "$GITHUB_OUTPUT"
            echo "changed_files=push-to-main" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          git fetch origin "${{ github.base_ref }}"
          BASE="origin/${{ github.base_ref }}"
          git diff --name-only "${BASE}...HEAD" > /tmp/changed-files.txt

          python - <<'PY'
          from pathlib import Path
          import os

          files = [
              line.strip().replace("\\", "/")
              for line in Path("/tmp/changed-files.txt").read_text().splitlines()
              if line.strip()
          ]

          high_risk_exact = {
              "pytest.ini",
              "pyproject.toml",
              "setup.py",
              "setup.cfg",
              "tox.ini",
              "noxfile.py",
              "conftest.py",
          }

          def is_doc(path: str) -> bool:
              name = path.rsplit("/", 1)[-1].lower()
              return (
                  path.startswith("docs/")
                  or name.startswith("readme")
                  or name.endswith(".md")
              )

          def is_config(path: str) -> bool:
              return (
                  path.startswith("python/zrt/training/configs/")
                  and path.lower().endswith((".yaml", ".yml", ".json"))
              )

          def is_full(path: str) -> bool:
              lower = path.lower()
              name = lower.rsplit("/", 1)[-1]
              return (
                  lower.startswith("python/") and lower.endswith(".py")
                  or lower.startswith("tests/") and lower.endswith(".py")
                  or lower.startswith(".github/workflows/")
                  or name.startswith("requirements") and name.endswith(".txt")
                  or lower in high_risk_exact
              )

          if not files:
              mode = "docs-only"
          elif any(is_full(path) for path in files):
              mode = "full"
          elif all(is_config(path) for path in files):
              mode = "config-smoke"
          elif all(is_doc(path) for path in files):
              mode = "docs-only"
          else:
              # Fail closed: unknown paths still get full pytest/coverage.
              mode = "full"

          has_python_source = any(
              path.startswith("python/zrt/") and path.endswith(".py")
              for path in files
          )

          with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as out:
              out.write(f"gate_mode={mode}\n")
              out.write(f"has_python_source_diff={str(has_python_source).lower()}\n")

          print(f"gate_mode={mode}")
          print(f"has_python_source_diff={has_python_source}")
          print("changed files:")
          for path in files:
              print(f"  {path}")
          PY

  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install ruff
        run: pip install ruff

      - name: Lint PR-changed lines only
        if: github.event_name == 'pull_request'
        shell: bash
        run: |
          set -e
          git fetch origin "${{ github.base_ref }}"
          BASE="origin/${{ github.base_ref }}"

          CHANGED=$(git diff --name-only --diff-filter=AM "${BASE}...HEAD" -- '*.py')
          if [ -z "$CHANGED" ]; then
            echo "No Python file changes; skipping lint."
            exit 0
          fi
          echo "Files in PR diff:"
          echo "$CHANGED"

          echo "$CHANGED" | xargs ruff check --output-format=json > ruff_violations.json || true

          export BASE
          python - <<'PY'
          import json
          import os
          import subprocess
          import sys
          from pathlib import Path

          base = os.environ["BASE"]
          diff = subprocess.check_output(
              ["git", "diff", "--unified=0", "--diff-filter=AM",
               f"{base}...HEAD", "--", "*.py"],
              text=True,
          )
          changed_lines = {}
          cur = None
          for line in diff.splitlines():
              if line.startswith("+++ b/"):
                  cur = line[6:]
                  changed_lines[cur] = set()
              elif line.startswith("@@") and cur is not None:
                  new_part = line.split()[2].lstrip("+")
                  if "," in new_part:
                      start, count = map(int, new_part.split(","))
                  else:
                      start, count = int(new_part), 1
                  for ln in range(start, start + max(count, 1)):
                      changed_lines[cur].add(ln)

          with open("ruff_violations.json") as f:
              violations = json.load(f)

          cwd = Path.cwd()
          bad = []
          for v in violations:
              fp = Path(v["filename"])
              try:
                  rel = str(fp.relative_to(cwd))
              except ValueError:
                  rel = str(fp)
              row = v["location"]["row"]
              if row in changed_lines.get(rel, set()):
                  bad.append(v)

          if bad:
              print(f"::error::{len(bad)} lint error(s) on PR-changed lines:")
              for v in bad:
                  print(f"  {v['filename']}:{v['location']['row']}:"
                        f"{v['location']['column']} {v['code']} {v['message']}")
              sys.exit(1)
          print(f"OK: no lint errors on PR-changed lines "
                f"(filtered from {len(violations)} file-level violations).")
          PY

      - name: Lint full tree on main push
        if: github.event_name == 'push'
        continue-on-error: true
        run: ruff check python/ tests/

  test:
    name: Test & Global Coverage Gate
    runs-on: ubuntu-latest
    needs: classify-changes
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Show gate mode
        run: |
          echo "gate_mode=${{ needs.classify-changes.outputs.gate_mode }}"

      - uses: actions/setup-python@v5
        if: needs.classify-changes.outputs.gate_mode == 'full'
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: pip

      - name: Install dependencies
        if: needs.classify-changes.outputs.gate_mode == 'full'
        run: |
          pip install torch --index-url https://download.pytorch.org/whl/cpu
          pip install -r requirements.txt
          pip install pytest pytest-cov diff-cover

      - name: Run tests with coverage
        if: needs.classify-changes.outputs.gate_mode == 'full'
        shell: bash
        run: |
          set +e
          set -o pipefail
          pytest tests/ \
            -m "not network" \
            --junitxml=pytest-results.xml \
            --cov=python/zrt \
            --cov-report=xml:coverage.xml \
            --cov-report=term-missing \
            -q 2>&1 | tee pytest-output.log
          pytest_status=$?
          set +o pipefail
          set -e
          echo "${pytest_status}" > pytest-status.txt

          python - <<'PY'
          import json
          import os
          import pathlib
          import sys
          import xml.etree.ElementTree as ET

          junit_path = pathlib.Path("pytest-results.xml")
          coverage_path = pathlib.Path("coverage.xml")
          status = int(pathlib.Path("pytest-status.txt").read_text().strip())

          if status not in (0, 1):
              print(f"ERROR: pytest exited with infrastructure status {status}; "
                    "only test failure status 1 is allowed by the temporary baseline gate.",
                    file=sys.stderr)
              sys.exit(status)

          if not junit_path.exists():
              print("ERROR: pytest-results.xml was not generated.", file=sys.stderr)
              sys.exit(1)
          if not coverage_path.exists():
              print("ERROR: coverage.xml was not generated.", file=sys.stderr)
              sys.exit(1)

          def local_name(tag: str) -> str:
              return tag.rsplit("}", 1)[-1]

          root = ET.parse(junit_path).getroot()
          failures = []
          for case in root.iter():
              if local_name(case.tag) != "testcase":
                  continue
              has_failure = any(
                  local_name(child.tag) in {"failure", "error"}
                  for child in list(case)
              )
              if not has_failure:
                  continue
              classname = case.attrib.get("classname", "")
              name = case.attrib.get("name", "")
              failures.append(f"{classname}::{name}" if classname else name)

          failures = sorted(set(failures))
          pathlib.Path("pytest-failures.json").write_text(
              json.dumps({"count": len(failures), "failures": failures}, indent=2),
              encoding="utf-8",
          )
          print(f"PR failing/error tests: {len(failures)}")
          for nodeid in failures[:25]:
              print(f"  {nodeid}")
          if len(failures) > 25:
              print(f"  ... {len(failures) - 25} more")

          cov_root = ET.parse(coverage_path).getroot()
          pct = float(cov_root.attrib["line-rate"]) * 100.0
          threshold = float(os.environ["GLOBAL_COVERAGE_THRESHOLD"])
          print(f"PR coverage: {pct:.2f}%")
          if pct < threshold:
              print(f"Coverage below threshold: {pct:.2f}% < {threshold:.2f}%",
                    file=sys.stderr)
              sys.exit(1)
          print(f"Coverage meets threshold: {pct:.2f}% >= {threshold:.2f}%")
          PY

      - name: Upload coverage artifact
        if: always() && needs.classify-changes.outputs.gate_mode == 'full'
        uses: actions/upload-artifact@v4
        with:
          name: coverage-report
          path: coverage.xml
          retention-days: 7

      - name: Upload pytest failure artifact
        if: always() && needs.classify-changes.outputs.gate_mode == 'full'
        uses: actions/upload-artifact@v4
        with:
          name: pytest-failures
          path: |
            pytest-failures.json
            pytest-results.xml
            pytest-status.txt
            pytest-output.log
          retention-days: 7

      - uses: actions/setup-python@v5
        if: needs.classify-changes.outputs.gate_mode == 'config-smoke'
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install config smoke dependencies
        if: needs.classify-changes.outputs.gate_mode == 'config-smoke'
        run: pip install pyyaml

      - name: Config smoke check
        if: needs.classify-changes.outputs.gate_mode == 'config-smoke'
        shell: bash
        run: |
          set -euo pipefail
          git fetch origin "${{ github.base_ref }}"
          BASE="origin/${{ github.base_ref }}"
          git diff --name-only "${BASE}...HEAD" > /tmp/changed-files.txt
          python - <<'PY'
          import json
          from pathlib import Path

          import yaml

          from zrt.training.io.config_loader import load_specs, _resolve_model

          files = [
              Path(line.strip())
              for line in Path("/tmp/changed-files.txt").read_text().splitlines()
              if line.strip()
          ]
          config_files = [
              path for path in files
              if str(path).replace("\\", "/").startswith("python/zrt/training/configs/")
              and path.suffix.lower() in {".yaml", ".yml", ".json"}
          ]
          if not config_files:
              raise SystemExit("config-smoke mode had no config files")

          for path in config_files:
              text = path.read_text(encoding="utf-8")
              if path.suffix.lower() == ".json":
                  json.loads(text)
                  print(f"JSON OK: {path}")
                  continue
              yaml.safe_load(text)
              normalized = str(path).replace("\\", "/")
              if normalized.startswith("python/zrt/training/configs/models/"):
                  _resolve_model(path.stem)
                  print(f"Model config OK: {path}")
              else:
                  load_specs(path)
                  print(f"Training config OK: {path}")
          PY

      - name: Upload skip marker
        if: needs.classify-changes.outputs.gate_mode != 'full'
        run: |
          echo "Skipped full pytest for gate_mode=${{ needs.classify-changes.outputs.gate_mode }}" > coverage-skip.txt

      - name: Upload skip artifact
        if: needs.classify-changes.outputs.gate_mode != 'full'
        uses: actions/upload-artifact@v4
        with:
          name: coverage-skip
          path: coverage-skip.txt
          retention-days: 7

  patch-coverage:
    name: Patch Coverage Gate
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    needs:
      - classify-changes
      - test
    steps:
      - name: Skip patch coverage
        if: needs.classify-changes.outputs.gate_mode != 'full' || needs.classify-changes.outputs.has_python_source_diff != 'true'
        run: |
          echo "Skipping patch coverage."
          echo "gate_mode=${{ needs.classify-changes.outputs.gate_mode }}"
          echo "has_python_source_diff=${{ needs.classify-changes.outputs.has_python_source_diff }}"

      - uses: actions/checkout@v4
        if: needs.classify-changes.outputs.gate_mode == 'full' && needs.classify-changes.outputs.has_python_source_diff == 'true'
        with:
          fetch-depth: 0

      - uses: actions/setup-python@v5
        if: needs.classify-changes.outputs.gate_mode == 'full' && needs.classify-changes.outputs.has_python_source_diff == 'true'
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install diff-cover
        if: needs.classify-changes.outputs.gate_mode == 'full' && needs.classify-changes.outputs.has_python_source_diff == 'true'
        run: pip install diff-cover

      - name: Download coverage artifact
        if: needs.classify-changes.outputs.gate_mode == 'full' && needs.classify-changes.outputs.has_python_source_diff == 'true'
        uses: actions/download-artifact@v4
        with:
          name: coverage-report

      - name: Ensure base branch is available
        if: needs.classify-changes.outputs.gate_mode == 'full' && needs.classify-changes.outputs.has_python_source_diff == 'true'
        run: git fetch origin ${{ github.base_ref }}:refs/remotes/origin/${{ github.base_ref }}

      - name: Enforce patch coverage threshold
        if: needs.classify-changes.outputs.gate_mode == 'full' && needs.classify-changes.outputs.has_python_source_diff == 'true'
        run: |
          diff-cover coverage.xml \
            --compare-branch=origin/${{ github.base_ref }} \
            --include "python/zrt/**/*.py" \
            --fail-under=${{ env.PATCH_COVERAGE_THRESHOLD }} \
            --html-report=patch-coverage.html \
            --markdown-report=patch-coverage.md

      - name: Upload patch coverage report
        if: always() && needs.classify-changes.outputs.gate_mode == 'full' && needs.classify-changes.outputs.has_python_source_diff == 'true'
        uses: actions/upload-artifact@v4
        with:
          name: patch-coverage-report
          path: |
            patch-coverage.html
            patch-coverage.md
          retention-days: 7

  coverage-regression:
    name: Coverage No-Regression Check
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    needs:
      - classify-changes
      - test
    steps:
      - name: Skip coverage no-regression
        if: needs.classify-changes.outputs.gate_mode != 'full'
        run: |
          echo "Skipping coverage no-regression for gate_mode=${{ needs.classify-changes.outputs.gate_mode }}."

      - uses: actions/checkout@v4
        if: needs.classify-changes.outputs.gate_mode == 'full'
        with:
          fetch-depth: 0

      - uses: actions/setup-python@v5
        if: needs.classify-changes.outputs.gate_mode == 'full'
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: pip

      - name: Install dependencies
        if: needs.classify-changes.outputs.gate_mode == 'full'
        run: |
          pip install torch --index-url https://download.pytorch.org/whl/cpu
          pip install -r requirements.txt
          pip install pytest pytest-cov

      - name: Download PR coverage artifact
        if: needs.classify-changes.outputs.gate_mode == 'full'
        uses: actions/download-artifact@v4
        with:
          name: coverage-report
          path: pr-coverage

      - name: Download PR pytest failure artifact
        if: needs.classify-changes.outputs.gate_mode == 'full'
        uses: actions/download-artifact@v4
        with:
          name: pytest-failures
          path: pr-pytest

      - name: Parse PR coverage and failures
        if: needs.classify-changes.outputs.gate_mode == 'full'
        run: |
          python - <<'PY'
          import json
          import pathlib
          import xml.etree.ElementTree as ET

          coverage_path = pathlib.Path("pr-coverage/coverage.xml")
          failures_path = pathlib.Path("pr-pytest/pytest-failures.json")
          root = ET.parse(coverage_path).getroot()
          pct = int(round(float(root.attrib["line-rate"]) * 100))
          pathlib.Path("/tmp/pr_pct.txt").write_text(str(pct))
          print(f"PR coverage: {pct}%")

          failures = json.loads(failures_path.read_text(encoding="utf-8"))
          pathlib.Path("/tmp/pr_failures.json").write_text(
              json.dumps(failures, indent=2),
              encoding="utf-8",
          )
          print(f"PR failing/error tests: {failures['count']}")
          PY

      - name: Measure base branch coverage and failures
        if: needs.classify-changes.outputs.gate_mode == 'full'
        shell: bash
        run: |
          git fetch origin ${{ github.base_ref }}:refs/remotes/origin/${{ github.base_ref }}
          git clean -fdx
          git checkout --detach refs/remotes/origin/${{ github.base_ref }}
          set +e
          set -o pipefail
          pytest tests/ -m "not network" \
            --junitxml=/tmp/base-pytest-results.xml \
            --cov=python/zrt \
            --cov-report=term \
            --cov-report=xml:/tmp/base-coverage.xml \
            -q 2>&1 | tee /tmp/base.txt
          pytest_status=$?
          set +o pipefail
          set -e
          echo "${pytest_status}" > /tmp/base-pytest-status.txt

          python - <<'PY'
          import json
          import pathlib
          import sys
          import xml.etree.ElementTree as ET

          junit_path = pathlib.Path("/tmp/base-pytest-results.xml")
          coverage_path = pathlib.Path("/tmp/base-coverage.xml")
          status = int(pathlib.Path("/tmp/base-pytest-status.txt").read_text().strip())

          if status not in (0, 1):
              print(f"ERROR: base pytest exited with infrastructure status {status}; "
                    "only test failure status 1 is allowed by the temporary baseline gate.",
                    file=sys.stderr)
              sys.exit(status)

          if not junit_path.exists():
              print("ERROR: base pytest-results.xml was not generated.", file=sys.stderr)
              sys.exit(1)
          if not coverage_path.exists():
              print("ERROR: base coverage.xml was not generated.", file=sys.stderr)
              sys.exit(1)

          def local_name(tag: str) -> str:
              return tag.rsplit("}", 1)[-1]

          root = ET.parse(junit_path).getroot()
          failures = []
          for case in root.iter():
              if local_name(case.tag) != "testcase":
                  continue
              has_failure = any(
                  local_name(child.tag) in {"failure", "error"}
                  for child in list(case)
              )
              if not has_failure:
                  continue
              classname = case.attrib.get("classname", "")
              name = case.attrib.get("name", "")
              failures.append(f"{classname}::{name}" if classname else name)

          failures = sorted(set(failures))
          pathlib.Path("/tmp/base_failures.json").write_text(
              json.dumps({"count": len(failures), "failures": failures}, indent=2),
              encoding="utf-8",
          )
          print(f"Base failing/error tests: {len(failures)}")

          cov_root = ET.parse(coverage_path).getroot()
          pct = int(round(float(cov_root.attrib["line-rate"]) * 100))
          pathlib.Path("/tmp/base_pct.txt").write_text(str(pct))
          print(f"Base coverage: {pct}%")
          PY

      - name: Enforce coverage and failure-count no regression
        if: needs.classify-changes.outputs.gate_mode == 'full'
        run: |
          python - <<'PY'
          import json
          import pathlib
          import sys

          base_pct = int(pathlib.Path("/tmp/base_pct.txt").read_text().strip())
          pr_pct = int(pathlib.Path("/tmp/pr_pct.txt").read_text().strip())
          base = json.loads(pathlib.Path("/tmp/base_failures.json").read_text(encoding="utf-8"))
          pr = json.loads(pathlib.Path("/tmp/pr_failures.json").read_text(encoding="utf-8"))

          print(f"Base branch coverage: {base_pct}% | This PR coverage: {pr_pct}%")
          if pr_pct < base_pct:
              print(f"Coverage regression: {pr_pct}% < {base_pct}% (base branch)")
              sys.exit(1)
          print(f"Coverage did not regress: {pr_pct}% >= {base_pct}%")

          base_count = int(base["count"])
          pr_count = int(pr["count"])
          print(f"Base failing/error tests: {base_count} | This PR: {pr_count}")

          base_failures = set(base["failures"])
          pr_failures = set(pr["failures"])
          introduced = sorted(pr_failures - base_failures)
          resolved = sorted(base_failures - pr_failures)
          if introduced:
              print("Failing/error tests present only in this PR (informational unless count increases):")
              for nodeid in introduced[:25]:
                  print(f"  + {nodeid}")
              if len(introduced) > 25:
                  print(f"  ... {len(introduced) - 25} more")
          if resolved:
              print("Failing/error tests fixed by this PR:")
              for nodeid in resolved[:25]:
                  print(f"  - {nodeid}")
              if len(resolved) > 25:
                  print(f"  ... {len(resolved) - 25} more")

          if pr_count > base_count:
              print(
                  f"Failure-count regression: {pr_count} failing/error tests > "
                  f"{base_count} on base branch"
              )
              sys.exit(1)
          print(
              f"Failure count did not regress: {pr_count} <= {base_count} "
              "(temporary dynamic baseline)"
          )
          PY