name: Python Checks
concurrency:
  group: Python-Checks-${{ github.workflow }}-${{ github.head_ref || github.event.workflow_run.head_branch || github.run_id }}
  cancel-in-progress: true

on:
  merge_group:
  pull_request:
    branches:
      - main
      - "release/**"
  push:
    tags:
      - "v*.*.*"

permissions:
  contents: read

jobs:
  mypy-check:
    # See https://runs-on.com/runners/linux/
    # NOTE: This job is named mypy-check for branch protection compatibility,
    # but it actually runs ty (astral-sh's Rust type checker).
    runs-on:
      [
        runs-on,
        runner=2cpu-linux-arm64,
        "run-id=${{ github.run_id }}-mypy-check",
        "extras=s3-cache",
      ]
    timeout-minutes: 15

    steps:
      - uses: runs-on/action@742bf56072eb4845a0f94b3394673e4903c90ff0
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
        with:
          persist-credentials: false

      - name: Setup Python and Install Dependencies
        uses: ./.github/actions/setup-python-and-install-dependencies
        with:
          requirements: |
            backend/requirements/default.txt
            backend/requirements/dev.txt
            backend/requirements/model_server.txt
            backend/requirements/ee.txt

      - name: Run ty
        env:
          TERM: xterm-256color
        run: ty check --output-format github