name: CI
on:
  push:
    branches: ['main']
  # This workflow contains required checks and needs to run for EVERY pull_request
  pull_request:
    branches: ['**']

permissions: {}

concurrency:
  group: ci-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  ACTIONLINT_VERSION: "1.7.12"
  ACTIONLINT_SHA256SUM: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8
  ACTIONLINT_REPO: rhysd/actionlint
  GH_TELEMETRY: "false"

jobs:
  actionlint:
    name: Lint workflows
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
        with:
          persist-credentials: false

      - name: Install requirements
        env:
          GH_TOKEN: ${{ github.token }}
          ACTIONLINT_TARBALL: ${{ format('actionlint_{0}_linux_amd64.tar.gz', env.ACTIONLINT_VERSION) }}
        shell: bash
        run: |
          sudo apt -y install shellcheck
          gh release download \
            --repo "${ACTIONLINT_REPO}" \
            --pattern "${ACTIONLINT_TARBALL}" \
            "v${ACTIONLINT_VERSION}"
          gh attestation verify \
            --repo "${ACTIONLINT_REPO}" \
            "${ACTIONLINT_TARBALL}"
          printf '%s  %s' "${ACTIONLINT_SHA256SUM}" "${ACTIONLINT_TARBALL}" | sha256sum -c -
          tar xvzf "${ACTIONLINT_TARBALL}" actionlint
          sudo install -D --mode=755 actionlint /usr/bin/

      - name: Run actionlint
        run: |
          actionlint -color

  zizmor:
    name: Audit workflows
    permissions:
      contents: read
      actions: read  # Needed by zizmorcore/zizmor-action if repository is private
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
        with:
          persist-credentials: false

      - name: Run zizmor
        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d  # v0.5.6
        with:
          advanced-security: false
          persona: pedantic

  py_format:
    name: Python format check
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
        with:
          persist-credentials: false

      - uses: astral-sh/ruff-action@0ce1b0bf8b818ef400413f810f8a11cdbda0034b  # v4.0.0
        with:
          args: "check --output-format github"

  py_lint:
    name: Python lint check
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
        with:
          persist-credentials: false

      - uses: astral-sh/ruff-action@0ce1b0bf8b818ef400413f810f8a11cdbda0034b  # v4.0.0
        with:
          args: "format --check --diff"

  js_format:
    name: JavaScript format check
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
        with:
          persist-credentials: false

      - name: Install Deno v2.x (latest)
        uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282  # v2.0.4
        with:
          deno-version: v2.x

      - name: Install Deno requirements
        run: |
          deno install --frozen

      - name: Run format check
        run: |
          deno task fmt:check

  js_lint:
    name: JavaScript lint check
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
        with:
          persist-credentials: false

      - name: Install Deno v2.x (latest)
        uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282  # v2.0.4
        with:
          deno-version: v2.x

      - name: Install Deno requirements
        run: |
          deno install --frozen

      - name: Run lint check
        run: |
          deno task lint

  python_tests:
    name: Python tests
    permissions:
      contents: read
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        runner: [ubuntu-latest, windows-latest]
        python-version: ['3.10', '3.11', '3.12', '3.13', '3.14', '3.15', pypy-3.11]
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
        with:
          # required for hatch-vcs versioning
          fetch-depth: 0
          persist-credentials: false

      - name: Install Deno v2.x (latest)
        uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282  # v2.0.4
        with:
          deno-version: v2.x

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          python-version: ${{ matrix.python-version }}
          allow-prereleases: true

      - name: Build project
        shell: bash
        run: |
          # `pip install -e` omits the force-included JS, so use `build` instead
          python -m pip install -U build
          python -m build

      - name: Unpack wheel (Linux)
        if: matrix.runner == 'ubuntu-latest'
        shell: bash
        run: |
          unzip -u dist/yt_dlp_ejs-*.whl "yt_dlp_ejs/*"

      - name: Unpack wheel (Windows)
        if: matrix.runner == 'windows-latest'
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"
          $PSNativeCommandUseErrorActionPreference = $true
          Expand-Archive -Path dist/yt_dlp_ejs-*.whl -DestinationPath ./ -Force

      - name: Run Python tests
        timeout-minutes: 5
        shell: bash
        run: |
          python -Werror -m unittest

  prepare:
    name: Prepare JS runtime tests
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
        with:
          persist-credentials: false

      - name: Install Deno v2.x (latest)
        uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282  # v2.0.4
        with:
          deno-version: v2.x

      - name: Install Deno requirements
        run: |
          deno install --frozen

      - name: Build control bundle
        run: |
          deno task bundle

      - name: Generate bundle hashes
        shell: bash
        run: |
          pushd dist
          sha256sum -- yt.solver.*.js | tee SHA2-256SUMS
          popd

      - name: Upload bundle hashes
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: bundle-hashes
          path: |
            dist/SHA2-256SUMS
          compression-level: 0

      - name: Cache player JS files
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
        env:
          SEGMENT_DOWNLOAD_TIMEOUT_MINS: 1
        with:
          path: |
            src/yt/solver/test/players
          key: test-player-js-${{ hashFiles('src/yt/solver/test/tests.ts') }}

      - name: Download player JS files
        timeout-minutes: 15
        run: |
          deno run \
            --no-prompt \
            --allow-read=src/yt/solver/test/players/ \
            --allow-write=src/yt/solver/test/players/ \
            --allow-net=www.youtube.com \
            --allow-sys=uid \
            src/yt/solver/test/download.ts

      - name: Upload player JS artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: player-js
          path: |
            src/yt/solver/test/players/*
          compression-level: 0

  pnpm_build:
    name: Test pnpm build
    needs: [prepare]
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
        with:
          # required for hatch-vcs versioning
          fetch-depth: 0
          persist-credentials: false

      - name: Install pnpm
        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093  # v6.0.8
        with:
          # minimum supported version
          version: "10.16.0"

      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          # minimum supported version
          python-version: "3.10"

      - name: Install Python requirements
        run: |
          python -m pip install -U build

      - name: Test pnpm build
        run: |
          python -m build

      - name: Verify artifact contents
        shell: bash
        run: |
          tar -tvzf dist/yt_dlp_ejs-*.tar.gz
          unzip -l dist/yt_dlp_ejs-*.whl | tee .wheel_contents
          grep -q 'yt_dlp_ejs/yt/solver/core\.min\.js' .wheel_contents
          grep -q 'yt_dlp_ejs/yt/solver/lib\.min\.js' .wheel_contents

      - name: Install pnpm requirements
        run: |
          pnpm install --frozen-lockfile

      - name: Bundle with pnpm
        run: |
          pnpm run bundle

      - name: Download bundle hashes
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          path: dist
          name: bundle-hashes

      - name: Verify bundle hashes
        run: |
          cd dist
          sha256sum -c SHA2-256SUMS

  deno_lock_check:
    name: Test Deno lockfile
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
        with:
          persist-credentials: false

      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          # minimum supported version
          python-version: "3.10"

      - name: Verify lockfile
        run: |
          python ./check.py

  deno_build:
    name: Test Deno build
    needs: [prepare]
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
        with:
          # required for hatch-vcs versioning
          fetch-depth: 0
          persist-credentials: false

      - name: Install Deno
        uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282  # v2.0.4
        with:
          # minimum supported version
          deno-version: "2.3.0"

      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          # minimum supported version
          python-version: "3.10"

      - name: Install Python requirements
        run: |
          python -m pip install -U build

      - name: Test Deno build
        run: |
          python -m build

      - name: Verify artifact contents
        shell: bash
        run: |
          tar -tvzf dist/yt_dlp_ejs-*.tar.gz
          unzip -l dist/yt_dlp_ejs-*.whl | tee .wheel_contents
          grep -q 'yt_dlp_ejs/yt/solver/core\.min\.js' .wheel_contents
          grep -q 'yt_dlp_ejs/yt/solver/lib\.min\.js' .wheel_contents

      - name: Install Deno requirements
        run: |
          deno install --frozen

      - name: Bundle with Deno
        run: |
          deno task bundle

      - name: Download bundle hashes
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          path: dist
          name: bundle-hashes

      - name: Verify bundle hashes
        run: |
          cd dist
          sha256sum -c SHA2-256SUMS

  deno_tests:
    name: Run Deno tests
    needs: [prepare]
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
        with:
          persist-credentials: false

      - name: Install Deno
        uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282  # v2.0.4
        with:
          # minimum supported version
          deno-version: "2.3.0"

      - name: Install Deno requirements
        run: |
          deno install --frozen

      - name: Download player JS artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          path: src/yt/solver/test/players
          name: player-js

      - name: Run Deno tests
        run: |
          xargs -n 1 -P 10 deno test \
            --no-prompt \
            --no-check \
            --allow-read=src/yt/solver/test/players/ \
            --filter <<<"$(printf -- '-%s-\n' main tcc tce es5 es6 tv tv_es6 phone es6_tcc es6_tce)"

  bun_build:
    name: Test Bun build
    needs: [prepare]
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
        with:
          # required for hatch-vcs versioning
          fetch-depth: 0
          persist-credentials: false

      - name: Install Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2.2.0
        with:
          # minimum supported version
          bun-version: "1.2.11"
          no-cache: true

      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          # minimum supported version
          python-version: "3.10"

      - name: Install Python requirements
        run: |
          python -m pip install -U build

      - name: Test Bun build
        run: |
          python -m build

      - name: Verify artifact contents
        shell: bash
        run: |
          tar -tvzf dist/yt_dlp_ejs-*.tar.gz
          unzip -l dist/yt_dlp_ejs-*.whl | tee .wheel_contents
          grep -q 'yt_dlp_ejs/yt/solver/core\.min\.js' .wheel_contents
          grep -q 'yt_dlp_ejs/yt/solver/lib\.min\.js' .wheel_contents

      - name: Install Bun requirements
        run: |
          bun install --frozen-lockfile

      - name: Bundle with Bun
        run: |
          bun --bun run bundle

      - name: Download bundle hashes
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          path: dist
          name: bundle-hashes

      - name: Verify bundle hashes
        run: |
          cd dist
          sha256sum -c SHA2-256SUMS

  bun_tests:
    name: Run Bun tests
    needs: [prepare]
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
        with:
          persist-credentials: false

      - name: Install Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2.2.0
        with:
          # minimum supported version
          bun-version: "1.2.11"
          no-cache: true

      - name: Install Bun requirements
        run: |
          bun install --frozen-lockfile

      - name: Download player JS artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          path: src/yt/solver/test/players
          name: player-js

      - name: Run Bun tests
        run: |
          bun test

  node_build:
    name: Test Node build
    needs: [prepare]
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
        with:
          # required for hatch-vcs versioning
          fetch-depth: 0
          persist-credentials: false

      - name: Install Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
        with:
          # minimum supported version
          node-version: "22.0.0"

      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          # minimum supported version
          python-version: "3.10"

      - name: Install Python requirements
        run: |
          python -m pip install -U build

      - name: Test Node build
        run: |
          python -m build

      - name: Verify artifact contents
        shell: bash
        run: |
          tar -tvzf dist/yt_dlp_ejs-*.tar.gz
          unzip -l dist/yt_dlp_ejs-*.whl | tee .wheel_contents
          grep -q 'yt_dlp_ejs/yt/solver/core\.min\.js' .wheel_contents
          grep -q 'yt_dlp_ejs/yt/solver/lib\.min\.js' .wheel_contents

      - name: Install Node requirements
        run: |
          npm ci

      - name: Bundle with Node
        run: |
          npm run bundle

      - name: Download bundle hashes
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          path: dist
          name: bundle-hashes

      - name: Verify bundle hashes
        run: |
          cd dist
          sha256sum -c SHA2-256SUMS

  node_tests:
    name: Run Node tests
    needs: [prepare]
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
        with:
          persist-credentials: false

      - name: Install Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
        with:
          # minimum supported version
          node-version: "22.0.0"

      - name: Install Node requirements
        run: |
          npm ci

      - name: Download player JS artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          path: src/yt/solver/test/players
          name: player-js

      - name: Run Node tests
        run: |
          node --test

  all_passed:
    # Required check; do not change name
    name: all_passed
    needs:
      - actionlint
      - zizmor
      - py_format
      - py_lint
      - js_format
      - js_lint
      - python_tests
      - pnpm_build
      - deno_lock_check
      - deno_build
      - deno_tests
      - bun_build
      - bun_tests
      - node_build
      - node_tests
    runs-on: ubuntu-slim
    steps:
      - run: |
          true