ci.yml

# wads CI — calls the reusable workflow hosted in i2mint/wads.
#
# All configuration comes from this repo's pyproject.toml [tool.wads.ci.*].
# To customize the workflow itself (rare), replace this file with the
# full inline template `wads/data/github_ci_uv.yml` from i2mint/wads.
#
# Pinning: `@master` floats with wads. If you need version stability for
# a release-sensitive repo, change `@master` to a wads tag (e.g. `@v0.1.81`).
# CI failure does not block a published release — it blocks the publish
# step itself — so floating master is generally safe.
#
# Permissions: GitHub validates that the caller grants AT LEAST the
# permissions any job in the called workflow requests — at workflow-parse
# time, not at run-time, even if the job would be skipped via `if:`.
# The reusable workflow needs:
#   contents: write   for the publish job's version-bump push-back
#                     and for the github-pages job's gh-pages branch push
#   pages: write      for the github-pages job's REST API Pages config
# Both default to `write` on org-account GITHUB_TOKEN and need to be
# granted explicitly on personal-account callers (where the default is
# read-only). No `id-token: write` needed — the publish-github-pages
# action uses peaceiris/actions-gh-pages (branch-based) + REST API,
# not the OIDC `actions/deploy-pages` flow.
name: Continuous Integration
on: [push, pull_request]
jobs:
  ci:
    uses: i2mint/wads/.github/workflows/uv-ci.yml@master
    permissions:
      contents: write
      pages: write
    # Explicit pass-through (not `secrets: inherit`) because `inherit` does
    # not reliably propagate caller-repo secrets to a reusable workflow owned
    # by a different account (verified empirically: personal-account caller +
    # i2mint-org workflow → `${{ secrets.PYPI_PASSWORD }}` resolved to empty).
    #
    # This list is the per-repo *transport*: it should contain PYPI_PASSWORD
    # (for publishing) plus every secret your tests/CI need. It is generated
    # from [tool.wads.ci.env] in pyproject.toml. To add one, run
    #   wads-secrets add VAR_NAME            # updates pyproject + this block
    # or just append a line below. *Which* of these become job env vars (and
    # which are required) is controlled by [tool.wads.ci.env] — passing a
    # secret here does not by itself put it in the environment.
    #
    # A secret name must also be declared in the reusable workflow's superset
    # (wads/ci_secrets.py). `wads-secrets add` warns if it is not.
    secrets:
      PYPI_PASSWORD: ${{ secrets.PYPI_PASSWORD }}