ci.yml

name: CI

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint:
    name: Lint & Type Check
    runs-on: macos-latest
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 1
          persist-credentials: false

      - name: Set up Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: pip

      - name: Install dev dependencies
        run: pip install --upgrade pip && pip install ruff mypy types-PyYAML

  test:
    name: Test / Python ${{ matrix.python-version }} / ${{ matrix.os }}
    needs: lint
    runs-on: ${{ matrix.os }}
    timeout-minutes: 40
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
        os: [macos-14, macos-latest]
        exclude:
          - os: macos-14
            python-version: "3.9"
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 1
          persist-credentials: false

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip

      - name: CI install + smoke test (venv)
        run: |
          bash scripts/build.sh venv
          bash scripts/build.sh test

  build-check:
    name: Build Distribution Check
    needs: test
    runs-on: macos-latest
    timeout-minutes: 25
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 1
          persist-credentials: false

      - name: Set up Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: pip

      - name: Install build tools
        run: pip install --upgrade pip && pip install build twine

      - name: Build wheel + sdist
        run: python -m build

      - name: Check distribution with twine
        run: twine check dist/*

      - name: Verify CLI entry points exist in wheel
        run: |
          pip install dist/*.whl
          mac-cleaner --help
          mdc --help

      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: dist-packages
          path: dist/
          if-no-files-found: error
          retention-days: 7

  version-check:
    name: Version Gate (PyPI vs local)
    needs: build-check
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: macos-latest
    timeout-minutes: 10
    outputs:
      should_publish: ${{ steps.compare.outputs.should_publish }}
      local_version:  ${{ steps.compare.outputs.local_version }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 1
          persist-credentials: false

      - name: Set up Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: pip

      - name: Compare versions
        id: compare
        run: |
          python - <<'EOF'
          import json, sys, urllib.request

          try:
              import tomllib
          except ImportError:
              import tomli as tomllib

          with open("pyproject.toml", "rb") as f:
              data = tomllib.load(f)

          local = data["project"]["version"]
          print(f"Local version : {local}")

          package = "mac-deep-cleaner"
          url = f"https://pypi.org/pypi/{package}/json"
          try:
              with urllib.request.urlopen(url, timeout=15) as r:
                  pypi = json.load(r)["info"]["version"]
          except urllib.error.HTTPError as e:
              if e.code == 404:
                  pypi = "0.0.0"
                  print("Package not found on PyPI — treating as new release.")
              else:
                  raise

          print(f"PyPI version  : {pypi}")

          import os
          out = os.environ["GITHUB_OUTPUT"]
          publish = "true" if local != pypi else "false"
          with open(out, "a") as f:
              f.write(f"should_publish={publish}\n")
              f.write(f"local_version={local}\n")

          if publish == "true":
              print(f"✅  New version detected ({pypi} → {local}). Will publish.")
          else:
              print(f"⏭  Version {local} already on PyPI. Skipping publish.")
          EOF

  publish:
    name: Publish to PyPI (${{ needs.version-check.outputs.local_version }})
    needs: version-check
    if: needs.version-check.outputs.should_publish == 'true'
    runs-on: macos-latest
    timeout-minutes: 20
    environment:
      name: pypi
      url: https://pypi.org/project/mac-deep-cleaner/
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 1
          persist-credentials: false

      - name: Set up Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: pip

      - name: Install build tools
        run: pip install --upgrade pip && pip install build twine

      - name: Build distributions
        run: python -m build

      - name: Verify distributions
        run: twine check dist/*

      - name: Publish to PyPI
        env:
          TWINE_USERNAME: __token__
          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
        run: twine upload dist/*

      - name: Summary
        run: |
          echo "### 🚀 Published mac-deep-cleaner ${{ needs.version-check.outputs.local_version }} to PyPI" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "📦 https://pypi.org/project/mac-deep-cleaner/${{ needs.version-check.outputs.local_version }}/" >> $GITHUB_STEP_SUMMARY

  # ─────────────────────────────────────────────────────────────────────────────
  # Creates a GitHub Release tagged v<version> with the matching CHANGELOG entry.
  # Runs after a successful publish.
  # ─────────────────────────────────────────────────────────────────────────────
  github-release:
    name: Create GitHub Release (v${{ needs.version-check.outputs.local_version }})
    needs: [version-check, publish]
    if: needs.version-check.outputs.should_publish == 'true'
    runs-on: macos-latest
    timeout-minutes: 10
    permissions:
      contents: write   # needed to create tags + releases
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0          # full history so the tag can be pushed
          persist-credentials: true

      - name: Set up Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: pip

      - name: Download dist-packages artifact
        uses: actions/download-artifact@v4
        with:
          name: dist-packages
          path: dist

      - name: Verify release artifacts exist
        run: |
          if ! ls -1 dist/* >/dev/null 2>&1; then
            echo "dist artifacts missing after download" >&2
            exit 1
          fi

      - name: Extract changelog section for this version
        id: changelog
        run: |
          python - <<'EOF'
          import re, os, sys

          version = "${{ needs.version-check.outputs.local_version }}"
          tag     = f"v{version}"

          try:
              with open("CHANGELOG.md", "r") as f:
                  content = f.read()
          except FileNotFoundError:
              print("CHANGELOG.md not found — using empty release notes.")
              body = f"Release {tag}"
              with open(os.environ["GITHUB_OUTPUT"], "a") as out:
                  out.write(f"tag={tag}\n")
              with open("release_notes.md", "w") as rn:
                  rn.write(body)
              sys.exit(0)

          # Match the section that starts with "## v<version>" up to the next "## v" heading
          pattern = rf"(## {re.escape(tag)}.*?)(?=\n## v|\Z)"
          match = re.search(pattern, content, re.DOTALL)

          if match:
              body = match.group(1).strip()
              print(f"✅  Found changelog section for {tag}")
          else:
              body = f"Release {tag}\n\nNo changelog entry found for this version."
              print(f"⚠️  No changelog section found for {tag} — using fallback.")

          with open(os.environ["GITHUB_OUTPUT"], "a") as out:
              out.write(f"tag={tag}\n")

          with open("release_notes.md", "w") as rn:
              rn.write(body)
          EOF

      - name: Create and push tag
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG="${{ steps.changelog.outputs.tag }}"
          git config user.name  "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          # Only create the tag if it doesn't already exist
          if git rev-parse "$TAG" >/dev/null 2>&1; then
            echo "Tag $TAG already exists — skipping tag creation."
          else
            git tag -a "$TAG" -m "Release $TAG"
            git push origin "$TAG"
            echo "✅  Pushed tag $TAG"
          fi

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name:   ${{ steps.changelog.outputs.tag }}
          name:       "mac-deep-cleaner ${{ steps.changelog.outputs.tag }}"
          body_path:  release_notes.md
          files:      dist/*
          draft:      false
          prerelease: false
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # ─────────────────────────────────────────────────────────────────────────────
  # Auto-bumps the patch version on `develop` after a successful main publish
  # so the branch is always ahead of what's on PyPI.
  # Commits directly to develop via the default GITHUB_TOKEN.
  # ─────────────────────────────────────────────────────────────────────────────
  auto-version-bump:
    name: Auto-bump patch version on develop
    needs: [version-check, publish]
    if: needs.version-check.outputs.should_publish == 'true'
    runs-on: macos-latest
    timeout-minutes: 10
    permissions:
      contents: write   # needed to push the commit
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 1
          persist-credentials: true

      - name: Check develop branch exists
        id: develop_check
        run: |
          if git ls-remote --heads origin develop | grep -q develop; then
            echo "exists=true" >> "$GITHUB_OUTPUT"
          else
            echo "exists=false" >> "$GITHUB_OUTPUT"
            echo "Develop branch not found; skipping auto-bump."
          fi

      - name: Checkout develop
        if: steps.develop_check.outputs.exists == 'true'
        run: |
          git fetch --depth=1 origin develop
          git checkout -B develop FETCH_HEAD

      - name: Set up Python 3.11
        if: steps.develop_check.outputs.exists == 'true'
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: pip

      - name: Bump patch version in pyproject.toml
        if: steps.develop_check.outputs.exists == 'true'
        id: bump
        run: |
          python - <<'EOF'
          import re, os

          published = "${{ needs.version-check.outputs.local_version }}"
          major, minor, patch = map(int, published.split("."))
          next_version = f"{major}.{minor}.{patch + 1}"

          with open("pyproject.toml", "r") as f:
              content = f.read()

          # Replace the version field — matches: version = "x.y.z"
          updated = re.sub(
              r'^(version\s*=\s*")[^"]+(")',
              rf'\g<1>{next_version}\g<2>',
              content,
              flags=re.MULTILINE,
          )

          if updated == content:
              print(f"⚠️  version field not found or already bumped — no change written.")
          else:
              with open("pyproject.toml", "w") as f:
                  f.write(updated)
              print(f"✅  Bumped {published} → {next_version} in pyproject.toml")

          with open(os.environ["GITHUB_OUTPUT"], "a") as out:
              out.write(f"next_version={next_version}\n")
          EOF

      - name: Commit and push version bump
        if: steps.develop_check.outputs.exists == 'true'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          NEXT="${{ steps.bump.outputs.next_version }}"
          git config user.name  "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add pyproject.toml
          # Only commit if there's an actual change
          if git diff --cached --quiet; then
            echo "Nothing to commit — develop is already at $NEXT or bump failed."
          else
            git commit -m "chore: bump version to $NEXT [skip ci]"
            git push origin develop
            echo "✅  Pushed version bump to develop: $NEXT"
          fi