tests.yml

name: 'Tests'
concurrency:
  group: ${{ github.workflow }}-${{ github.event.number }}-${{ github.event.ref }}
  cancel-in-progress: true
on:  # yamllint disable-line rule:truthy
  push:
    branches: ["main", "maint/*"]
  pull_request:
    branches: ["main", "maint/*"]
  # adapted from spyder-ide/spyder
  workflow_dispatch:
    inputs:
      ssh:
        description: 'Enable ssh debugging'
        required: false
        default: false
        type: boolean

permissions:
  contents: read

jobs:
  bandit:
    name: Bandit
    runs-on: ubuntu-latest
    steps:
      - uses: davidslusser/actions_python_bandit@v1.0.1
        with:
          src: "mne"
          options: "-c pyproject.toml -ll -r"
          pip_install_command: "pip install bandit[toml]"

  pytest:
    name: '${{ matrix.os }} / ${{ matrix.kind }} / ${{ matrix.python }}'
    # macOS spawns children and runs slowtests, so it needs a bit more headroom
    timeout-minutes: ${{ startsWith(matrix.os, 'macos') && 40 || 30 }}
    runs-on: ${{ matrix.os }}
    defaults:
      run:
        shell: bash -el {0}
    env:
      PYTHON_VERSION: '${{ matrix.python }}'  # used by github_actions_env_vars.sh
      PYTHONUNBUFFERED: '1'
      MNE_CI_KIND: '${{ matrix.kind }}'
      CI_OS_NAME: '${{ matrix.os }}'
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            python: '3.13'
            kind: pip
          - os: ubuntu-latest
            python: '3.14'
            kind: pip-pre
          - os: ubuntu-latest
            python: '3.13'
            kind: conda
          - os: macos-latest  # arm64
            python: '3.14'
            kind: pip
          - os: macos-15-intel  # Intel
            python: '3.13'
            kind: pip
          - os: ubuntu-latest
            python: '3.12'
            kind: minimal
          - os: ubuntu-22.04
            python: '3.11'
            kind: old
          - os: ubuntu-latest
            python: '3.14t'  # free-threaded
            kind: pip-ft
    steps:
      - uses: actions/checkout@v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Get commit message
        run: echo "COMMIT_MESSAGE=$(git show -s --format=%s ${{ github.event.pull_request.head.sha || github.sha }})" | tee -a ${GITHUB_ENV}
      - name: Triage SSH
        run: |
          if [[ "${{ inputs.ssh }}" == "true" ]] || [[ "$COMMIT_MESSAGE" == *"[actions ssh]"* ]]; then
            echo "ENABLE_SSH=true" | tee -a $GITHUB_ENV
          else
            echo "ENABLE_SSH=false" | tee -a $GITHUB_ENV
          fi
      - name: Setup Remote SSH Connection
        if: env.ENABLE_SSH == 'true'
        uses: Warpbuilds/action-debugger@v1.3
        timeout-minutes: 80
        with:
          detached: true
      - run: ./tools/github_actions_env_vars.sh
      # Xvfb/OpenGL
      - uses: pyvista/setup-headless-display-action@v5
        with:
          qt: true
          pyvista: false
          wm: false
      # Python (if pip)
      - uses: actions/setup-python@v7.0.0
        with:
          python-version: ${{ matrix.python }}
        if: startswith(matrix.kind, 'pip') || matrix.kind == 'minimal'
        id: setup-python
      # Workaround macOS path behavior with login shells (which puts system Python first).
      # \$PATH must stay escaped so that it is expanded when each login shell sources
      # ~/.bash_profile: writing the expanded value would freeze PATH as of this step and
      # silently discard anything a later step adds to $GITHUB_PATH.
      - run: echo "export PATH=\"$(dirname ${{ steps.setup-python.outputs.python-path }}):\$PATH\"" | tee -a ~/.bash_profile  # zizmor: ignore[template-injection]
        if: startswith(matrix.kind, 'pip') && startswith(matrix.os, 'macos')
      # Python (if conda)
      - uses: mamba-org/setup-micromamba@v3
        with:
          environment-file: ${{ env.CONDA_ENV }}
          environment-name: mne
          log-level: 'info'
          create-args: >-
            python=${{ matrix.python }}
            -v
        if: matrix.kind == 'conda'
        timeout-minutes: 20
      # Python (if old)
      - uses: astral-sh/setup-uv@v10.0.1
        with:
          version: ">=0.9"
          activate-environment: true
          cache-dependency-glob: |
            **/pylock.ci-old.toml
          python-version: ${{ matrix.python }}
        if: matrix.kind == 'old'
      - run: bash ./tools/github_actions_verify_python.sh "${{ matrix.python }}"
      - run: bash ./tools/github_actions_dependencies.sh
        timeout-minutes: 10
      - name: Check 'old' CI environment
        uses: mne-tools/mne-tools/actions/check-environment@main
        with:
          project-root: ${{ github.workspace }}
          groups: lockfile_extras
        if: matrix.kind == 'old'
      # MNE-C minimal commands. The action caches the download and no-ops on
      # platforms that have no binaries (macOS arm64, Windows, Linux arm64), so it
      # only needs to be gated on the kinds that deliberately do without them.
      - name: Setup minimal commands
        uses: mne-tools/mne-tools/actions/setup-minimal-commands@main
        if: matrix.kind != 'minimal' && matrix.kind != 'old' && matrix.kind != 'pip-ft'
      - run: bash ./tools/github_actions_infos.sh
      - name: Check Qt import
        uses: mne-tools/mne-tools/actions/check-qt-import@main
        with:
          qt-backend: ${{ env.MNE_QT_BACKEND }}
        if: env.MNE_QT_BACKEND != ''
      - name: Run tests with no testing data
        run: MNE_SKIP_TESTING_DATASET_TESTS=true pytest -m "not (ultraslowtest or pgtest)" -n "$PYTEST_XDIST_N" --dist loadscope --timeout=120 --timeout-method=thread -o faulthandler_timeout=110 $COV_ARGS --tb=short -vv -rfE mne/
        if: matrix.kind == 'minimal'
      - run: ./tools/get_testing_version.sh
      - uses: actions/cache@v6.1.0
        with:
          key: mne_data-testing-${{ env.TESTING_VERSION }}-misc-${{ env.MISC_VERSION }}
          path: ~/mne_data
      - run: bash ./tools/github_actions_download.sh
      - run: bash ./tools/github_actions_test.sh  # for some reason on macOS we need to run "bash X" in order for a failed test run to show up
      - uses: codecov/codecov-action@v7.0.0
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
        # COV_ARGS is empty on jobs where we don't measure coverage (Python < 3.14)
        if: (success() || failure()) && env.COV_ARGS != ''