ejs/.github/workflows/ci.yml

name: CI
on:
  push:
    branches:
      - '**'
    paths-ignore:
      - 'README.md'
      - 'LICENSE'
  pull_request:
    paths-ignore:
      - 'README.md'
      - 'LICENSE'

permissions: {}

concurrency:
  group: ci-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  ACTIONLINT_VERSION: "1.7.11"
  ACTIONLINT_SHA256SUM: 900919a84f2229bac68ca9cd4103ea297abc35e9689ebb842c6e34a3d1b01b0a
  ACTIONLINT_REPO: https://github.com/rhysd/actionlint

jobs:
  actionlint:
    name: Lint workflows
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          python-version: "3.14"
      - name: Install requirements
        env:
          ACTIONLINT_TARBALL: ${{ format('actionlint_{0}_linux_amd64.tar.gz', env.ACTIONLINT_VERSION) }}
        shell: bash
        run: |
          sudo apt -y install shellcheck
          python -m pip install -U pyflakes
          curl -LO "${ACTIONLINT_REPO}/releases/download/v${ACTIONLINT_VERSION}/${ACTIONLINT_TARBALL}"
          printf '%s  %s' "${ACTIONLINT_SHA256SUM}" "${ACTIONLINT_TARBALL}" | sha256sum -c -
          tar xvzf "${ACTIONLINT_TARBALL}" actionlint
          chmod +x actionlint
      - name: Run actionlint
        run: |
          ./actionlint -color

  zizmor:
    name: Audit workflows
    permissions:
      contents: read
      actions: read  # Needed by zizmorcore/zizmor-action if repository is private
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - name: Run zizmor
        uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8  # v0.5.2
        with:
          advanced-security: false
          persona: pedantic
          version: v1.23.1

  ruff_format:
    name: Ruff format check
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - uses: astral-sh/ruff-action@4919ec5cf1f49eff0871dbcea0da843445b837e6  # v3.6.1
        with:
          args: "check --output-format github"

  ruff_lint:
    name: Ruff linting check
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - uses: astral-sh/ruff-action@4919ec5cf1f49eff0871dbcea0da843445b837e6  # v3.6.1
        with:
          args: "format --check --diff"

  prettier:
    name: Prettier check
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - name: Install Deno v2.x (latest)
        uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb  # v2.0.3
        with:
          deno-version: v2.x
      - name: Install Deno requirements
        run: |
          deno install --frozen
      - name: Run Prettier check
        run: |
          deno task fmt:check

  eslint:
    name: ESLint check
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - name: Install Deno v2.x (latest)
        uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb  # v2.0.3
        with:
          deno-version: v2.x
      - name: Install Deno requirements
        run: |
          deno install --frozen
      - name: Run ESLint check
        run: |
          deno task lint

  python_tests:
    name: Python tests
    permissions:
      contents: read
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        runner: [ubuntu-latest, windows-latest]
        python-version: ['3.10', '3.11', '3.12', '3.13', '3.14', pypy-3.11]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          # required for hatch-vcs versioning
          fetch-depth: 0
          persist-credentials: false
      - name: Install Deno v2.x (latest)
        uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb  # v2.0.3
        with:
          deno-version: v2.x
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          python-version: ${{ matrix.python-version }}
      - name: Build project
        shell: bash
        run: |
          # `pip install -e` omits the force-included JS, so use `build` instead
          python -m pip install -U build
          python -m build
      - name: Unpack wheel (Linux)
        if: matrix.runner == 'ubuntu-latest'
        shell: bash
        run: |
          unzip -u dist/yt_dlp_ejs-*.whl "yt_dlp_ejs/*"
      - name: Unpack wheel (Windows)
        if: matrix.runner == 'windows-latest'
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"
          $PSNativeCommandUseErrorActionPreference = $true
          Expand-Archive -Path dist/yt_dlp_ejs-*.whl -DestinationPath ./ -Force
      - name: Run Python tests
        timeout-minutes: 5
        shell: bash
        run: |
          python -Werror -m unittest

  prepare:
    name: Prepare JS runtime tests
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - name: Install Deno v2.x (latest)
        uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb  # v2.0.3
        with:
          deno-version: v2.x
      - name: Install Deno requirements
        run: |
          deno install --frozen
      - name: Build control bundle
        run: |
          deno task bundle
      - name: Generate bundle hashes
        shell: bash
        run: |
          pushd dist
          sha256sum -- yt.solver.*.js | tee SHA2-256SUMS
          popd
      - name: Upload bundle hashes
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
        with:
          name: bundle-hashes
          path: |
            dist/SHA2-256SUMS
          compression-level: 0
      - name: Cache player JS files
        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306  # v5.0.3
        env:
          SEGMENT_DOWNLOAD_TIMEOUT_MINS: 1
        with:
          path: |
            src/yt/solver/test/players
          key: test-player-js-${{ hashFiles('src/yt/solver/test/tests.ts') }}
      - name: Download player JS files
        timeout-minutes: 15
        run: |
          deno run \
            --no-prompt \
            --allow-read=src/yt/solver/test/players/ \
            --allow-write=src/yt/solver/test/players/ \
            --allow-net=www.youtube.com \
            --allow-sys=uid \
            src/yt/solver/test/download.ts
      - name: Upload player JS artifact
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
        with:
          name: player-js
          path: |
            src/yt/solver/test/players/*
          compression-level: 0

  pnpm_build:
    name: Test pnpm build
    needs: [prepare]
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          # required for hatch-vcs versioning
          fetch-depth: 0
          persist-credentials: false
      - name: Install pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320  # v5.0.0
        with:
          version: 10
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          # minimum supported version
          python-version: "3.10"
      - name: Install Python requirements
        run: |
          python -m pip install -U build
      - name: Test pnpm build
        run: |
          python -m build
      - name: Verify artifact contents
        shell: bash
        run: |
          tar -tvzf dist/yt_dlp_ejs-*.tar.gz
          unzip -l dist/yt_dlp_ejs-*.whl | tee .wheel_contents
          grep -q 'yt_dlp_ejs/yt/solver/core\.min\.js' .wheel_contents
          grep -q 'yt_dlp_ejs/yt/solver/lib\.min\.js' .wheel_contents
      - name: Install pnpm requirements
        run: |
          pnpm install --frozen-lockfile
      - name: Bundle with pnpm
        run: |
          pnpm run bundle
      - name: Download bundle hashes
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          path: dist
          name: bundle-hashes
      - name: Verify bundle hashes
        run: |
          cd dist
          sha256sum -c SHA2-256SUMS

  deno_lock_check:
    name: Test Deno lockfile
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          # minimum supported version
          python-version: "3.10"
      - name: Verify lockfile
        run: |
          python ./check.py

  deno_build:
    name: Test Deno build
    needs: [prepare]
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          # required for hatch-vcs versioning
          fetch-depth: 0
          persist-credentials: false
      - name: Install Deno
        uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb  # v2.0.3
        with:
          # minimum supported version
          deno-version: "2.0.0"
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          # minimum supported version
          python-version: "3.10"
      - name: Install Python requirements
        run: |
          python -m pip install -U build
      - name: Test Deno build
        run: |
          python -m build
      - name: Verify artifact contents
        shell: bash
        run: |
          tar -tvzf dist/yt_dlp_ejs-*.tar.gz
          unzip -l dist/yt_dlp_ejs-*.whl | tee .wheel_contents
          grep -q 'yt_dlp_ejs/yt/solver/core\.min\.js' .wheel_contents
          grep -q 'yt_dlp_ejs/yt/solver/lib\.min\.js' .wheel_contents
      - name: Install Deno requirements
        run: |
          deno install --frozen
      - name: Bundle with Deno
        run: |
          deno task bundle
      - name: Download bundle hashes
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          path: dist
          name: bundle-hashes
      - name: Verify bundle hashes
        run: |
          cd dist
          sha256sum -c SHA2-256SUMS

  deno_tests:
    name: Run Deno tests
    needs: [prepare]
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - name: Install Deno
        uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb  # v2.0.3
        with:
          # minimum supported version
          deno-version: "2.0.0"
      - name: Install Deno requirements
        run: |
          deno install --frozen
      - name: Download player JS artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          path: src/yt/solver/test/players
          name: player-js
      - name: Run Deno tests
        run: |
          xargs -n 1 -P 10 deno test \
            --no-prompt \
            --no-check \
            --allow-read=src/yt/solver/test/players/ \
            --filter <<<"$(printf -- '-%s-\n' main tcc tce es5 es6 tv tv_es6 phone es6_tcc es6_tce)"

  bun_build:
    name: Test Bun build
    needs: [prepare]
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          # required for hatch-vcs versioning
          fetch-depth: 0
          persist-credentials: false
      - name: Install Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2.2.0
        with:
          # minimum supported version
          bun-version: "1.0.31"
          no-cache: true
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          # minimum supported version
          python-version: "3.10"
      - name: Install Python requirements
        run: |
          python -m pip install -U build
      - name: Test Bun build
        run: |
          python -m build
      - name: Verify artifact contents
        shell: bash
        run: |
          tar -tvzf dist/yt_dlp_ejs-*.tar.gz
          unzip -l dist/yt_dlp_ejs-*.whl | tee .wheel_contents
          grep -q 'yt_dlp_ejs/yt/solver/core\.min\.js' .wheel_contents
          grep -q 'yt_dlp_ejs/yt/solver/lib\.min\.js' .wheel_contents
      - name: Install Bun requirements
        run: |
          bun install --frozen-lockfile
      - name: Bundle with Bun
        run: |
          bun --bun run bundle
      - name: Download bundle hashes
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          path: dist
          name: bundle-hashes
      - name: Verify bundle hashes
        run: |
          cd dist
          sha256sum -c SHA2-256SUMS

  bun_tests:
    name: Run Bun tests
    needs: [prepare]
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - name: Install Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2.2.0
        with:
          # XXX: We support 1.0.31, but test suite requires 1.2.11+
          bun-version: "1.2.11"
          no-cache: true
      - name: Install Bun requirements
        run: |
          bun install --frozen-lockfile
      - name: Download player JS artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          path: src/yt/solver/test/players
          name: player-js
      - name: Run Bun tests
        run: |
          bun test

  node_build:
    name: Test Node build
    needs: [prepare]
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          # required for hatch-vcs versioning
          fetch-depth: 0
          persist-credentials: false
      - name: Install Node
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f  # v6.3.0
        with:
          # minimum supported version
          node-version: "20.0"
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          # minimum supported version
          python-version: "3.10"
      - name: Install Python requirements
        run: |
          python -m pip install -U build
      - name: Test Node build
        run: |
          python -m build
      - name: Verify artifact contents
        shell: bash
        run: |
          tar -tvzf dist/yt_dlp_ejs-*.tar.gz
          unzip -l dist/yt_dlp_ejs-*.whl | tee .wheel_contents
          grep -q 'yt_dlp_ejs/yt/solver/core\.min\.js' .wheel_contents
          grep -q 'yt_dlp_ejs/yt/solver/lib\.min\.js' .wheel_contents
      - name: Install Node requirements
        run: |
          npm ci
      - name: Bundle with Node
        run: |
          npm run bundle
      - name: Download bundle hashes
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          path: dist
          name: bundle-hashes
      - name: Verify bundle hashes
        run: |
          cd dist
          sha256sum -c SHA2-256SUMS

  node_tests:
    name: Run Node tests
    needs: [prepare]
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - name: Install Node
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f  # v6.3.0
        with:
          # XXX: We support 20.0, but test suite requires 22.18+
          node-version: "22.18"
      - name: Install Node requirements
        run: |
          npm ci
      - name: Download player JS artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          path: src/yt/solver/test/players
          name: player-js
      - name: Run Node tests
        run: |
          node --test

  all_passed:
    name: all_passed
    needs:
      - actionlint
      - zizmor
      - ruff_format
      - ruff_lint
      - prettier
      - eslint
      - python_tests
      - pnpm_build
      - deno_lock_check
      - deno_build
      - deno_tests
      - bun_build
      - bun_tests
      - node_build
      - node_tests
    runs-on: ubuntu-latest
    steps:
      - name: All checks passed
        run: |
          echo "All checks passed!"