name: Python Checks
concurrency:
  group: Python-Checks-${{ github.workflow }}-${{ github.head_ref || github.event.workflow_run.head_branch || github.run_id }}
  cancel-in-progress: true

on:
  merge_group:
  pull_request:
    branches:
      - main
      - 'release/**'
  push:
    tags:
      - "v*.*.*"

permissions:
  contents: read

jobs:
  validate-requirements:
    runs-on: ubuntu-slim
    timeout-minutes: 45
    steps:
      - name: Checkout code
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # ratchet:actions/checkout@v6
        with:
          persist-credentials: false

      - name: Setup uv
        uses: astral-sh/setup-uv@1e862dfacbd1d6d858c55d9b792c756523627244 # ratchet:astral-sh/setup-uv@v7.1.4
        # TODO: Enable caching once there is a uv.lock file checked in.
        # with:
        #   enable-cache: true

      - name: Validate requirements lock files
        run: ./backend/scripts/compile_requirements.py --check

  mypy-check:
    # See https://runs-on.com/runners/linux/
    # Note: Mypy seems quite optimized for x64 compared to arm64.
    # Similarly, mypy is single-threaded and incremental, so 2cpu is sufficient.
    runs-on: [runs-on, runner=2cpu-linux-x64, "run-id=${{ github.run_id }}-mypy-check", "extras=s3-cache"]
    timeout-minutes: 45

    steps:
      - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
      - name: Checkout code
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # ratchet:actions/checkout@v6
        with:
          persist-credentials: false

      - name: Setup Python and Install Dependencies
        uses: ./.github/actions/setup-python-and-install-dependencies
        with:
          requirements: |
            backend/requirements/default.txt
            backend/requirements/dev.txt
            backend/requirements/model_server.txt
            backend/requirements/ee.txt

      - name: Generate OpenAPI schema
        shell: bash
        working-directory: backend
        env:
          PYTHONPATH: "."
        run: |
          python scripts/onyx_openapi_schema.py --filename generated/openapi.json

      # needed for pulling openapitools/openapi-generator-cli
      # otherwise, we hit the "Unauthenticated users" limit
      # https://docs.docker.com/docker-hub/usage/
      - name: Login to Docker Hub
        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # ratchet:docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_TOKEN }}

      - name: Generate OpenAPI Python client
        shell: bash
        run: |
          docker run --rm \
            -v "${{ github.workspace }}/backend/generated:/local" \
            openapitools/openapi-generator-cli generate \
            -i /local/openapi.json \
            -g python \
            -o /local/onyx_openapi_client \
            --package-name onyx_openapi_client \
            --skip-validate-spec \
            --openapi-normalizer "SIMPLIFY_ONEOF_ANYOF=true,SET_OAS3_NULLABLE=true"

      - name: Cache mypy cache
        if: ${{ vars.DISABLE_MYPY_CACHE != 'true' }}
        uses: runs-on/cache@50350ad4242587b6c8c2baa2e740b1bc11285ff4 # ratchet:runs-on/cache@v4
        with:
          path: backend/.mypy_cache
          key: mypy-${{ runner.os }}-${{ hashFiles('**/*.py', '**/*.pyi', 'backend/pyproject.toml') }}
          restore-keys: |
            mypy-${{ runner.os }}-

      - name: Run MyPy
        working-directory: ./backend
        env:
          MYPY_FORCE_COLOR: 1
          TERM: xterm-256color
        run: mypy .