ci.yml

name: CI

on:
  push:
    branches: [master]
    # v + semver only (glob, so the release job re-checks it exactly)
    tags: ['v[0-9]*.[0-9]*.[0-9]*']
  pull_request:
  workflow_dispatch:

# Default for every job; release and pypi declare the extra grants they need
permissions:
  contents: read

jobs:
  backend:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v7
        with:
          python-version: '3.12'
          cache: pip
          # The requirements files are pointers into pyproject.toml, where
          # the dependency list actually lives
          cache-dependency-path: |
            pyproject.toml
            requirements.txt
            requirements-test.txt
      # System libs opencv-python needs at import
      - run: sudo apt-get update && sudo apt-get install -y libgl1 libglib2.0-0
      # CPU wheels: an order of magnitude smaller than CUDA, and the suite
      # is mocked - the two tests that run a real generation skip themselves
      # when no accelerator is present
      - name: Install torch (CPU)
        run: pip install torch torchvision torchaudio --index-url https://download.pytorch.org/whl/cpu
      - name: Install dependencies
        # requirements.txt resolves pyproject.toml's dependencies + server
        # extra; requirements-test.txt the dev extra. diffusers from git
        # goes on afterwards so the resolver doesn't replace it with a
        # release
        run: |
          pip install -r requirements.txt -r requirements-test.txt
          pip install git+https://github.com/huggingface/diffusers
      - name: Format check
        run: black --check dw dw_mcp tests
      - name: Tests
        run: pytest -q

  ui:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ui
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version-file: ui/.nvmrc
          cache: npm
          cache-dependency-path: ui/package-lock.json
      - run: npm ci
      - name: Format check
        run: npx prettier --check src e2e *.ts *.js
      - name: Lint
        run: npm run lint
      - name: Type check
        run: npm run check
      - name: Unit tests
        run: npm test
      - name: Build
        run: npm run build

  wheel:
    # The packaged artifact: SPA built into the wheel. Tags and manual runs
    # only - the jobs above already prove the build on every push.
    if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch'
    needs: [backend, ui]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version-file: ui/.nvmrc
          cache: npm
          cache-dependency-path: ui/package-lock.json
      - uses: actions/setup-python@v7
        with:
          python-version: '3.12'
      - run: cd ui && npm ci
      - run: pip install build
      - run: bash scripts/build_dist.sh
      - uses: actions/upload-artifact@v7
        with:
          name: diffusers-workflow-dist
          path: dist/*

  release:
    # A v<semver> tag that passed the full test and build chain becomes a
    # GitHub release carrying the wheel and sdist
    if: startsWith(github.ref, 'refs/tags/v')
    needs: wheel
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v7
      - name: Check the tag against the declared versions
        run: |
          tag="${GITHUB_REF_NAME#v}"
          if ! echo "$tag" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$'; then
            echo "Tag $GITHUB_REF_NAME is not v<semver>"; exit 1
          fi
          pyproject=$(python3 -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
          if [ "$tag" != "$pyproject" ]; then
            echo "Tag $tag != pyproject version $pyproject"
            exit 1
          fi
      - uses: actions/download-artifact@v8
        with:
          name: diffusers-workflow-dist
          path: dist
      - name: Create GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        # A pre-release marker in the tag (v1.2.3-rc1) marks the release too
        run: |
          prerelease=""
          case "$GITHUB_REF_NAME" in *-*) prerelease="--prerelease";; esac
          gh release create "$GITHUB_REF_NAME" dist/* \
            --repo "$GITHUB_REPOSITORY" \
            --title "$GITHUB_REF_NAME" \
            --generate-notes --verify-tag $prerelease

  pypi:
    # Trusted publishing (OIDC) - register on pypi.org first: project
    # diffusers-workflow, owner dkackman, repo diffusers-workflow,
    # workflow ci.yml, environment pypi. No token or secret is stored.
    needs: release
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/p/diffusers-workflow
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@v8
        with:
          name: diffusers-workflow-dist
          path: dist
      - uses: pypa/gh-action-pypi-publish@v1.14.2