ci-python-uv.yml

# Reusable CI workflow for Python projects using uv.
#
# Provides up to four parallel jobs: lint, typecheck, test, extra.
# Each is optional — omit the command input (or leave empty) to skip it.
#
# For non-secret env vars, use test-env JSON input.
# For secrets as env vars, use secrets: inherit + test-secret-env input.
# The test-secret-env input is a JSON object mapping env var names to
# secret names. The workflow reads those secrets (available via inherit)
# and exports them as env vars for the test step.
#
# Usage (standalone repo):
#
#   jobs:
#     ci:
#       uses: codeflash-ai/github-workflows/.github/workflows/ci-python-uv.yml@main
#       with:
#         lint-command: "uv run ruff check && uv run ruff format --check"
#         typecheck-command: "uv run mypy src/"
#         test-command: "uv run pytest tests/ -v"
#         test-env: '{"CI": "true"}'
#       secrets: inherit
#
# Usage (with secrets as env vars):
#
#   jobs:
#     ci:
#       uses: codeflash-ai/github-workflows/.github/workflows/ci-python-uv.yml@main
#       with:
#         working-directory: "django/aiservice"
#         test-command: "uv run pytest"
#         test-secret-env: '{"DATABASE_URL": "DATABASE_URL", "API_KEY": "AZURE_OPENAI_API_KEY"}'
#       secrets: inherit
#
# Usage (multi-version test matrix):
#
#   jobs:
#     ci:
#       uses: codeflash-ai/github-workflows/.github/workflows/ci-python-uv.yml@main
#       with:
#         test-command: "uv run pytest tests/ -v"
#         test-python-versions: '["3.9", "3.10", "3.11", "3.12"]'

name: CI (Python + uv)

on:
  workflow_call:
    inputs:
      python-version:
        description: "Python version"
        type: string
        default: "3.12"
      working-directory:
        description: "Working directory for all commands (for monorepo subdirs)"
        type: string
        default: "."
      sync-command:
        description: "Dependency install command"
        type: string
        default: "uv sync --all-packages"
      lint-command:
        description: "Lint command (empty to skip)"
        type: string
        default: ""
      typecheck-command:
        description: "Type-check command (empty to skip)"
        type: string
        default: ""
      test-command:
        description: "Test command (empty to skip)"
        type: string
        default: ""
      test-env:
        description: "JSON object of extra env vars for the test job (non-secret values only)"
        type: string
        default: "{}"
      test-secret-env:
        description: "JSON object mapping env var names to secret names, e.g. {\"DB_URL\": \"DATABASE_URL\"}. Requires secrets: inherit."
        type: string
        default: "{}"
      extra-command:
        description: "Additional check command (empty to skip)"
        type: string
        default: ""
      extra-command-name:
        description: "Display name for the extra check"
        type: string
        default: "extra"
      test-python-versions:
        description: "JSON array of Python versions for the test matrix (overrides python-version for test job)"
        type: string
        default: ""
      test-os:
        description: "JSON array of runner OSes for the test matrix"
        type: string
        default: '["ubuntu-latest"]'
      test-fail-fast:
        description: "Stop remaining test matrix jobs on first failure"
        type: boolean
        default: true

jobs:
  lint:
    if: inputs.lint-command != ''
    runs-on: ubuntu-latest
    permissions:
      contents: read
    defaults:
      run:
        working-directory: ${{ inputs.working-directory }}
    steps:
      - uses: actions/checkout@v6
      - uses: astral-sh/setup-uv@v8.1.0
        with:
          python-version: ${{ inputs.python-version }}
          enable-cache: true
      - run: ${{ inputs.sync-command }}
      - name: Lint
        run: ${{ inputs.lint-command }}

  typecheck:
    if: inputs.typecheck-command != ''
    runs-on: ubuntu-latest
    permissions:
      contents: read
    defaults:
      run:
        working-directory: ${{ inputs.working-directory }}
    steps:
      - uses: actions/checkout@v6
      - uses: astral-sh/setup-uv@v8.1.0
        with:
          python-version: ${{ inputs.python-version }}
          enable-cache: true
      - run: ${{ inputs.sync-command }}
      - name: Type check
        run: ${{ inputs.typecheck-command }}

  test:
    if: inputs.test-command != ''
    strategy:
      fail-fast: ${{ inputs.test-fail-fast }}
      matrix:
        python-version: ${{ fromJSON(inputs.test-python-versions || format('["{0}"]', inputs.python-version)) }}
        os: ${{ fromJSON(inputs.test-os) }}
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
    defaults:
      run:
        working-directory: ${{ inputs.working-directory }}
    steps:
      - uses: actions/checkout@v6
      - uses: astral-sh/setup-uv@v8.1.0
        with:
          python-version: ${{ matrix.python-version }}
          enable-cache: true
      - run: ${{ inputs.sync-command }}
      - name: Export secret env vars
        if: inputs.test-secret-env != '{}'
        shell: bash
        env:
          SECRET_ENV_MAP: ${{ inputs.test-secret-env }}
          ALL_SECRETS: ${{ toJSON(secrets) }}
        run: |
          echo "$SECRET_ENV_MAP" | jq -r 'to_entries[] | "\(.key)=\(.value)"' | while IFS='=' read -r env_name secret_name; do
            value=$(echo "$ALL_SECRETS" | jq -r --arg k "$secret_name" '.[$k] // empty')
            if [ -n "$value" ]; then
              echo "::add-mask::$value"
              echo "$env_name=$value" >> "$GITHUB_ENV"
            fi
          done
      - name: Test
        run: ${{ inputs.test-command }}
        env: ${{ fromJSON(inputs.test-env) }}

  extra:
    if: inputs.extra-command != ''
    name: ${{ inputs.extra-command-name }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
    defaults:
      run:
        working-directory: ${{ inputs.working-directory }}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - uses: astral-sh/setup-uv@v8.1.0
        with:
          python-version: ${{ inputs.python-version }}
          enable-cache: true
      - run: ${{ inputs.sync-command }}
      - name: ${{ inputs.extra-command-name }}
        run: ${{ inputs.extra-command }}