name: Python Checks
concurrency:
  group: Python-Checks-${{ github.workflow }}-${{ github.head_ref || github.event.workflow_run.head_branch || github.run_id }}
  cancel-in-progress: true

on:
  merge_group:
  pull_request:
    branches:
      - main
      - "release/**"
  push:
    tags:
      - "v*.*.*"

permissions:
  contents: read

jobs:
  changes:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      python: ${{ steps.filter.outputs.python || 'true' }}
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
        if: github.event_name == 'pull_request' || github.event_name == 'merge_group'
        with:
          persist-credentials: false
      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # ratchet:dorny/paths-filter@v3
        id: filter
        if: github.event_name == 'pull_request' || github.event_name == 'merge_group'
        with:
          filters: |
            python:
              - 'backend/**'
              - 'pyproject.toml'
              - '.github/workflows/pr-python-checks.yml'
              - '.github/actions/setup-python-and-install-dependencies/**'

  mypy-check:
    needs: changes
    if: needs.changes.outputs.python == 'true'
    # See https://runs-on.com/runners/linux/
    # NOTE: This job is named mypy-check for branch protection compatibility,
    # but it actually runs ty (astral-sh's Rust type checker).
    runs-on:
      [
        runs-on,
        runner=2cpu-linux-arm64,
        "run-id=${{ github.run_id }}-mypy-check",
        "extras=s3-cache",
      ]
    timeout-minutes: 15

    steps:
      - uses: runs-on/action@d141ef83eb66d096ce8afc767e09115a65c63b60
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
        with:
          persist-credentials: false

      - name: Setup Python and Install Dependencies
        uses: ./.github/actions/setup-python-and-install-dependencies
        with:
          requirements: |
            backend/requirements/default.txt
            backend/requirements/dev.txt
            backend/requirements/model_server.txt
            backend/requirements/ee.txt

      - name: Run ty
        env:
          TERM: xterm-256color
        run: ty check --output-format github