name: Upgrade checks

env:
  PY_COLORS: 1

on:
  push:
    branches: ["main"]
    paths:
      - "src/**"
      - "tests/**"
      - "uv.lock"
      - "pyproject.toml"
      - ".github/workflows/**"

  schedule:
    # Run daily at 2 AM UTC
    - cron: "0 2 * * *"

  workflow_dispatch:

permissions:
  contents: read
  issues: write

jobs:
  static_analysis:
    name: Static analysis
    timeout-minutes: 2
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v6

      - name: Setup uv (upgrade)
        uses: ./.github/actions/setup-uv
        with:
          resolution: upgrade

      - name: Run prek
        uses: j178/prek-action@v2
        env:
          SKIP: no-commit-to-branch

  run_tests:
    name: "Tests: Python ${{ matrix.python-version }} on ${{ matrix.os }}"
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest]
        python-version: ["3.10"]
        include:
          - os: ubuntu-latest
            python-version: "3.13"
      fail-fast: false
    timeout-minutes: 10

    steps:
      - uses: actions/checkout@v6

      - name: Setup uv (upgrade)
        uses: ./.github/actions/setup-uv
        with:
          python-version: ${{ matrix.python-version }}
          resolution: upgrade

      - name: Run unit tests
        uses: ./.github/actions/run-pytest

      - name: Run client process tests
        uses: ./.github/actions/run-pytest
        with:
          test-type: client_process

  run_integration_tests:
    name: "Integration tests"
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - uses: actions/checkout@v6

      - name: Setup uv (upgrade)
        uses: ./.github/actions/setup-uv
        with:
          resolution: upgrade

      - name: Run integration tests
        uses: ./.github/actions/run-pytest
        with:
          test-type: integration
        env:
          FASTMCP_GITHUB_TOKEN: ${{ secrets.FASTMCP_GITHUB_TOKEN }}
          FASTMCP_TEST_AUTH_GITHUB_CLIENT_ID: ${{ secrets.FASTMCP_TEST_AUTH_GITHUB_CLIENT_ID }}
          FASTMCP_TEST_AUTH_GITHUB_CLIENT_SECRET: ${{ secrets.FASTMCP_TEST_AUTH_GITHUB_CLIENT_SECRET }}

  notify:
    name: Notify on failure
    needs: [static_analysis, run_tests, run_integration_tests]
    if: failure() && github.event.pull_request == null
    runs-on: ubuntu-latest

    steps:
      - name: Create or update failure issue
        uses: jayqi/failed-build-issue-action@v1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          label: "build failed"
          title-template: "Upgrade checks failing on main branch"
          body-template: |
            ## Upgrade Checks Failure on Main Branch

            The upgrade checks workflow has failed on the main branch.

            **Workflow Run**: [#{{runNumber}}]({{serverUrl}}/{{repo.owner}}/{{repo.repo}}/actions/runs/{{runId}})
            **Commit**: {{sha}}
            **Branch**: {{ref}}
            **Event**: {{eventName}}

            ### Common causes

            - **ty (type checker)**: New ty releases frequently add stricter checks that flag previously-accepted code. Run `uv run ty check` locally with the latest ty to reproduce. Fix the type errors or bump the ty version floor in `pyproject.toml`.
            - **ruff**: New lint rules or stricter defaults in a ruff upgrade.
            - **mcp SDK**: Breaking changes in the `mcp` package (new method signatures, renamed types).

            ### What to do

            1. Check the workflow logs to identify which job failed (static analysis vs tests)
            2. Reproduce locally with `uv sync --upgrade && uv run prek run --all-files && uv run pytest -n auto`
            3. Fix the code or adjust dependency constraints as needed

            ---
            *This issue was automatically created by a GitHub Action.*

  close-on-success:
    name: Close issue on success
    needs: [static_analysis, run_tests, run_integration_tests]
    if: success() && github.event.pull_request == null && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest

    steps:
      - name: Close resolved failure issue
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          issue=$(gh issue list \
            --repo "$GITHUB_REPOSITORY" \
            --label "build failed" \
            --state open \
            --json number \
            --jq '.[0].number // empty')

          if [ -n "$issue" ]; then
            gh issue close "$issue" \
              --repo "$GITHUB_REPOSITORY" \
              --comment "Upgrade checks are passing again as of [\`${GITHUB_SHA::7}\`](${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/commit/${GITHUB_SHA})."
          fi