checks.yml

# MANAGED FILE - Updates pulled from template. See MANAGED_FILES.md
name: Checks

on:
  workflow_call:
  workflow_dispatch:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

# Each check job's `continue-on-error` is keyed off `tools/enforcement.config`
# so enforcement is configurable per check. See README.md "Checks and
# enforcement" for the full toggle list and defaults.

jobs:
  config:
    runs-on: ubuntu-latest
    outputs:
      enforce_ruff: ${{ steps.load.outputs.enforce_ruff }}
      enforce_mypy: ${{ steps.load.outputs.enforce_mypy }}
      enforce_posix_check: ${{ steps.load.outputs.enforce_posix_check }}
      enforce_unlisted_evals: ${{ steps.load.outputs.enforce_unlisted_evals }}
      enforce_package: ${{ steps.load.outputs.enforce_package }}
      enforce_autolint: ${{ steps.load.outputs.enforce_autolint }}
      enforce_generated_docs: ${{ steps.load.outputs.enforce_generated_docs }}
      enforce_large_files: ${{ steps.load.outputs.enforce_large_files }}
    steps:
      - uses: actions/checkout@v5
      - id: load
        run: |
          while IFS='=' read -r key value; do
            case "$key" in ''|\#*) continue;; esac
            key="${key// /}"
            value="${value// /}"
            lc=$(echo "$key" | tr '[:upper:]' '[:lower:]')
            echo "$lc=$value" >> "$GITHUB_OUTPUT"
          done < tools/enforcement.config

  ruff:
    needs: config
    runs-on: ubuntu-latest
    continue-on-error: ${{ needs.config.outputs.enforce_ruff == 'false' }}
    strategy:
      matrix:
        python-version: ["3.11", "3.12", "3.13"]
    steps:
      - uses: actions/checkout@v5
      - uses: astral-sh/setup-uv@v7
      - name: Display Ruff version
        uses: astral-sh/ruff-action@v3
        with:
          version: "0.15.11"
          args: --version
      - name: Lint with Ruff
        run: uv run ruff check
      - name: Format with Ruff
        run: uv run ruff format --check

  mypy:
    runs-on: ubuntu-latest
    needs: config
    continue-on-error: ${{ needs.config.outputs.enforce_mypy == 'false' }}
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.11", "3.12", "3.13"]
    env:
      UV_PYTHON: ${{ matrix.python-version }}
    steps:
      - uses: actions/checkout@v5
      - uses: astral-sh/setup-uv@v7
      - uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python-version }}
      - name: Install dependencies
        # --all-extras: mypy walks every eval's tests, so per-eval extras
        # must be present for import resolution.
        run: uv sync --frozen --all-extras
      - name: Run mypy
        run: uv run mypy --version && uv run mypy src tests

  posix-code-check:
    runs-on: ubuntu-latest
    needs: config
    continue-on-error: ${{ needs.config.outputs.enforce_posix_check == 'false' }}
    steps:
      - uses: actions/checkout@v5
      - uses: astral-sh/setup-uv@v7
      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"
      - name: Install dependencies
        run: uv sync --frozen
      - name: Check for POSIX-specific code
        run: uv run python tools/check_posix_code.py $(git ls-files '*.py')

  unlisted-evals:
    runs-on: ubuntu-latest
    needs: config
    continue-on-error: ${{ needs.config.outputs.enforce_unlisted_evals == 'false' }}
    steps:
      - uses: actions/checkout@v5
      - uses: astral-sh/setup-uv@v7
      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"
      - name: Check for unlisted evals
        run: uv run python tools/check_unlisted_evals.py

  package:
    name: Build & inspect the package
    runs-on: ubuntu-latest
    needs: config
    continue-on-error: ${{ needs.config.outputs.enforce_package == 'false' }}
    steps:
      - uses: actions/checkout@v5
      - uses: hynek/build-and-inspect-python-package@v2

  autolint:
    name: Autolint (inspect_evals standards)
    runs-on: ubuntu-latest
    needs: config
    # Default: advisory. Set ENFORCE_AUTOLINT=true in tools/enforcement.config
    # to make it blocking.
    continue-on-error: ${{ needs.config.outputs.enforce_autolint != 'true' }}
    steps:
      - uses: actions/checkout@v5
      - uses: astral-sh/setup-uv@v7
      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"
      - name: Install dependencies
        run: uv sync --frozen
      - name: Run autolint
        run: uv run python tools/run_autolint.py --all-evals

  generated-docs:
    name: Generated READMEs up to date
    runs-on: ubuntu-latest
    needs: config
    continue-on-error: ${{ needs.config.outputs.enforce_generated_docs != 'true' }}
    steps:
      - uses: actions/checkout@v5
      - uses: astral-sh/setup-uv@v7
      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"
      - name: Install dependencies
        # --all-extras: generate_readmes.py importlib-imports each eval
        # package to introspect @task signatures; missing extras = ImportError.
        run: uv sync --frozen --all-extras
      - name: Regenerate READMEs
        run: uv run python tools/generate_readmes.py
      - name: Fail if docs changed
        run: |
          if [[ -n $(git status --porcelain) ]]; then
            echo "::warning::Generated README sections are out of date. Run: uv run python tools/generate_readmes.py"
            git --no-pager diff
            exit 1
          fi
          echo "Generated docs up to date."

  large-files:
    runs-on: ubuntu-latest
    needs: config
    continue-on-error: ${{ needs.config.outputs.enforce_large_files != 'true' }}
    steps:
      - uses: actions/checkout@v5
      - name: Report and gate large files
        run: |
          echo "## Files > 10MB"
          large=$(bash tools/list_large_files.sh 10)
          if [[ -n "$large" ]]; then
            echo "$large"
            echo "::warning::Files larger than 10MB found in the repo"
            exit 1
          fi
          echo "None"
          echo ""
          echo "## Files > 1MB (informational)"
          medium=$(bash tools/list_large_files.sh 1)
          if [[ -n "$medium" ]]; then
            echo "$medium"
          else
            echo "None"
          fi