code_changes.yaml

# Workflow that runs on code changes to the main branch.

name: Code changes
on:
  push:
    branches:
      - main

    # The same paths as the pull request workflow: a dependency, lockfile
    # or Makefile change alters what the tests run against.
    paths:
      - policyengine_uk/**
      - tests/**
      - .github/**
      - pyproject.toml
      - uv.lock
      - hatch_build.py
      - Makefile
      - conftest.py
      - .gitignore
      - README.md
  workflow_dispatch:

# No concurrency group: every commit that lands on main finishes its run. The
# runs used to be cancelled when a newer commit landed, so 83001d51 and
# cfa0c556 never finished a Test on 11 October 2026, and a conflict between
# #2251 and #2270, each green alone, showed only at 7343f948.
#
# With a merge queue, main moves only to a commit the queue already tested
# with this suite (pr_code_changes.yaml on merge_group), so the Tested job
# skips the tests for such a commit rather than run them twice. Main's own
# runs must have the dataset (require-data).

jobs:
  Tested:
    # The release workflow tests each version commit itself, on the wheel it
    # publishes. Version commits only trigger this workflow when the GitHub
    # App pushes them (see versioning.yaml); skip them.
    if: github.event.head_commit.message != 'Update package version'
    runs-on: ${{ vars.CI_RUNNER_ARM != '' && (vars.CI_RUNNER_EVENTS == '' || contains(format(',{0},', vars.CI_RUNNER_EVENTS), format(',{0},', github.event_name))) && vars.CI_RUNNER_ARM || 'ubuntu-24.04-arm' }}
    timeout-minutes: 5
    permissions:
      actions: read
    outputs:
      tested: ${{ steps.check.outputs.tested }}
    steps:
      - name: Did the merge queue already test this commit?
        id: check
        env:
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
          SHA: ${{ github.sha }}
        run: |
          # A manual dispatch always tests: it is how to re-check main.
          if [ "$GITHUB_EVENT_NAME" != push ]; then
            echo "tested=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          # Only a successful merge_group run of the pull request workflow
          # counts: a merge group always runs the whole suite, with the
          # dataset (pr_code_changes.yaml). A check named "Test / Result" on
          # this commit could also come from a pull request run on the same
          # head commit, which may have skipped tests. If the lookup fails,
          # run the tests.
          runs=$(gh api "repos/$REPO/actions/workflows/pr_code_changes.yaml/runs?head_sha=$SHA&event=merge_group&status=success&per_page=1" \
            --jq '.total_count') || runs=0
          [[ "$runs" =~ ^[0-9]+$ ]] || runs=0
          if [ "$runs" -gt 0 ]; then
            echo "The merge queue already tested $SHA; not running the suite again."
            echo "tested=true" >> "$GITHUB_OUTPUT"
          else
            echo "tested=false" >> "$GITHUB_OUTPUT"
          fi
  Lint:
    needs: Tested
    if: needs.Tested.outputs.tested != 'true'
    runs-on: ${{ vars.CI_RUNNER_X64 != '' && (vars.CI_RUNNER_EVENTS == '' || contains(format(',{0},', vars.CI_RUNNER_EVENTS), format(',{0},', github.event_name))) && vars.CI_RUNNER_X64 || 'ubuntu-latest' }}
    permissions:
      contents: read
    timeout-minutes: 10
    steps:
        - uses: actions/checkout@v6
        - name: Install uv
          uses: astral-sh/setup-uv@v8.1.0
        - name: Check formatting
          # With the ruff that uv.lock pins, so a new ruff release cannot change
          # what Lint accepts until the lock is updated.
          run: |
            set -euo pipefail
            ruff=$(uv export --frozen --extra dev --no-hashes --no-header | { grep -E '^ruff==' || true; } | cut -d' ' -f1)
            if [ "$(printf '%s' "$ruff" | grep -c '^ruff==')" != 1 ]; then
              echo "::error::uv.lock should pin exactly one ruff; found: ${ruff:-none}"
              exit 1
            fi
            echo "RUFF=$ruff" >> "$GITHUB_ENV"
            uvx --from "$ruff" ruff format --check .
        - name: Lint
          # The ruff rules pyproject.toml selects, then two pyflakes rules it
          # ignores, checked in the package: F811, a definition that a later
          # one of the same name silently replaces (two PRs that each add a
          # Simulation.set_input merge cleanly, and the second wins; uk hub
          # notice 16), and F821, an undefined name. Neither has a finding
          # in the package today.
          run: |
            uvx --from "$RUFF" ruff check .
            uvx --from "$RUFF" ruff check --select F811,F821 policyengine_uk
  # The same suite as pull requests (test-suite.yaml), on the merged commit.
  Test:
    needs: Tested
    if: needs.Tested.outputs.tested != 'true'
    uses: ./.github/workflows/test-suite.yaml
    permissions:
      contents: read
      id-token: write
    with:
      require-data: true
    secrets:
      HUGGING_FACE_TOKEN: ${{ secrets.HUGGING_FACE_TOKEN }}