name: ci

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  lint-type-test:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4

      - name: Install uv
        uses: astral-sh/setup-uv@v3
        with:
          version: "0.8.18"

      - name: Set up Python 3.12
        run: uv python install 3.12

      - name: Sync workspace (base + ml + data for the runtime checks)
        run: uv sync --frozen --extra ml --extra data

      - name: Ruff (package + tests)
        run: uv run ruff check mindxtrain/ tests/

      - name: Mypy (strict-checked paths only)
        run: uv run mypy mindxtrain/config mindxtrain/provenance

      - name: Pytest
        run: uv run pytest -q

  build-container:
    # Build the Containerfile but don't push — proves the recipe still builds
    # on each PR. Push-to-GHCR happens on tag, in a separate job.
    runs-on: ubuntu-24.04
    needs: lint-type-test
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v4
      - name: Build container (no push)
        run: docker build -f Containerfile -t mindxtrain:ci .

  publish-container:
    # On tags vX.Y.Z, push the container to GHCR.
    runs-on: ubuntu-24.04
    needs: lint-type-test
    if: startsWith(github.ref, 'refs/tags/v')
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build + push (tag)
        run: |
          TAG="${GITHUB_REF##*/}"
          IMAGE="ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/mindxtrain"
          docker build -f Containerfile -t "$IMAGE:$TAG" -t "$IMAGE:latest" .
          docker push "$IMAGE:$TAG"
          docker push "$IMAGE:latest"