ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft, closed]

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  build-and-test:
    if: ${{ github.event_name != 'pull_request' || (!github.event.pull_request.draft && github.event.action != 'closed') }}
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          persist-credentials: false
      - name: Verify exact checkout
        env:
          INKSPAN_EXPECTED_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
        run: |
          actual_head="$(git rev-parse HEAD)"
          test "$actual_head" = "$INKSPAN_EXPECTED_HEAD_SHA"
      # pnpm version comes from the package.json "packageManager" field
      # (pnpm 10+), which is required to read `overrides` from
      # pnpm-workspace.yaml consistently with the committed lockfile.
      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - name: Typecheck
        run: pnpm typecheck
      - name: Test with 100% coverage
        run: pnpm coverage
      - name: Build library
        run: pnpm build
      - name: Verify packed package consumers
        run: pnpm verify:package
      - name: Build demo
        run: pnpm build:demo

  browser-release-evidence:
    if: ${{ github.event_name != 'pull_request' || (!github.event.pull_request.draft && github.event.action != 'closed') }}
    name: Cross-engine Clipboard / Playwright 1.62.0
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    env:
      PLAYWRIGHT_BROWSERS_PATH: /tmp/inkspan-playwright-browsers
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          persist-credentials: false
      - name: Verify exact checkout
        env:
          INKSPAN_EXPECTED_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
        run: |
          actual_head="$(git rev-parse HEAD)"
          test "$actual_head" = "$INKSPAN_EXPECTED_HEAD_SHA"
      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 22
          cache: pnpm
      - name: Install root dependencies from the immutable lock
        run: pnpm install --frozen-lockfile
      - name: Install browser-test dependencies from the isolated immutable lock
        run: pnpm --dir tests/browser install --frozen-lockfile
      - name: Install Playwright browser revisions pinned by 1.62.0
        run: pnpm --dir tests/browser exec playwright install --with-deps chromium firefox webkit
      - name: Verify real-engine rich clipboard release evidence
        env:
          INKSPAN_EXPECTED_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
        run: pnpm --dir tests/browser exec playwright test --config playwright.config.ts

  office:
    if: ${{ github.event_name != 'pull_request' || (!github.event.pull_request.draft && github.event.action != 'closed') }}
    name: Office / Python ${{ matrix.python-version }}
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        python-version: ${{ github.event_name == 'pull_request' && fromJSON('["3.14"]') || fromJSON('["3.11", "3.12", "3.13", "3.14"]') }}
    defaults:
      run:
        working-directory: office
    env:
      PYTHONPATH: src
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          persist-credentials: false
      - name: Verify exact checkout
        env:
          INKSPAN_EXPECTED_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
        run: |
          actual_head="$(git rev-parse HEAD)"
          test "$actual_head" = "$INKSPAN_EXPECTED_HEAD_SHA"
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip
          cache-dependency-path: office/requirements-ci.txt
      - name: Install hash-locked dependencies
        run: "python -m pip install --require-hashes --only-binary=:all: -r requirements-ci.txt"
      - name: Verify dependency consistency
        run: python -m pip check
      - name: Verify 100% docstring coverage
        run: python scripts/check_docstrings.py
      - name: Test with 100% branch coverage
        run: |
          coverage run -m pytest
          coverage report
      - name: Build wheel
        run: python -m pip wheel . --no-deps --no-build-isolation --wheel-dir dist
      - name: Verify packaged schema and license
        run: |
          python - <<'PY'
          from pathlib import Path
          from zipfile import ZipFile

          wheel = next(Path("dist").glob("*.whl"))
          with ZipFile(wheel) as archive:
              names = set(archive.namelist())
          assert "inkspan_office/schema.json" in names
          assert any(name.endswith(".dist-info/licenses/LICENSE") for name in names)
          PY