name: Validate

on:
  pull_request:
    branches:
      - main
  push:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: validate-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  tests:
    name: Python ${{ matrix.python-version }}
    runs-on: ubuntu-latest
    timeout-minutes: 10
    strategy:
      fail-fast: false
      matrix:
        python-version:
          - "3.11"
          - "3.12"
          - "3.13"
          - "3.14"
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v7
        with:
          python-version: ${{ matrix.python-version }}
      - run: python -m pip install --upgrade pip
      - run: python -m pip install -e ".[dev]"
      - run: python -m pytest -q

  dependency-bounds:
    name: Dependencies (${{ matrix.mode }})
    runs-on: ubuntu-latest
    timeout-minutes: 10
    strategy:
      fail-fast: false
      matrix:
        include:
          - mode: floor
            python-version: "3.11"
          - mode: latest
            python-version: "3.14"
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v7
        with:
          python-version: ${{ matrix.python-version }}
      - run: python -m pip install --upgrade pip
      - if: matrix.mode == 'floor'
        run: >-
          python -m pip install
          "cbor2==5.6.0"
          "pyOpenSSL==23.1.0"
          "pytest==8.0.0"
      - if: matrix.mode == 'floor'
        run: python -m pip install --no-deps -e .
      - if: matrix.mode == 'latest'
        run: python -m pip install -e ".[dev]"
      - run: python -m pytest -q

  package:
    name: Package artifacts
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - uses: actions/setup-python@v7
        with:
          python-version: "3.14"
      - run: python -m pip install --upgrade pip
      - run: python -m pip install build hatchling hatch-vcs
      - run: python -m build
      - run: python tools/check_distribution.py dist
      - name: Install and import wheel
        run: |
          python -m venv "$RUNNER_TEMP/wheel-smoke"
          "$RUNNER_TEMP/wheel-smoke/bin/python" -m pip install \
            dist/*.whl
          cd "$RUNNER_TEMP"
          "$RUNNER_TEMP/wheel-smoke/bin/python" -I -c \
            "from smartthings_local.protocol.dtls_session import DtlsCoapSession"
      - name: Install and import sdist
        run: |
          python -m venv "$RUNNER_TEMP/sdist-smoke"
          "$RUNNER_TEMP/sdist-smoke/bin/python" -m pip install \
            dist/*.tar.gz
          cd "$RUNNER_TEMP"
          "$RUNNER_TEMP/sdist-smoke/bin/python" -I -c \
            "from smartthings_local.ocf.state_cache import StateCache"

  share-safety:
    name: Share safety
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - uses: actions/setup-python@v7
        with:
          python-version: "3.14"
      - name: Select comparison base
        id: comparison
        env:
          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          PUSH_BEFORE_SHA: ${{ github.event.before }}
        run: |
          if [ -n "$PR_BASE_SHA" ]; then
            echo "sha=$PR_BASE_SHA" >> "$GITHUB_OUTPUT"
          elif [ -n "$PUSH_BEFORE_SHA" ] && \
               [ "$PUSH_BEFORE_SHA" != "0000000000000000000000000000000000000000" ]; then
            echo "sha=$PUSH_BEFORE_SHA" >> "$GITHUB_OUTPUT"
          else
            echo "sha=$(git rev-parse HEAD^)" >> "$GITHUB_OUTPUT"
          fi
      - run: >-
          python tools/check_share_safety.py
          --changed-since "${{ steps.comparison.outputs.sha }}"