Nagoya Bus MCP

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  release:
    types: [published]

jobs:
  build:
    name: Build and test
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version:
          - "3.11"
          - "3.12"
          - "3.13"
          - "3.14"
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          # Fetch full history for setuptools-scm
          fetch-depth: 0
      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: ${{ matrix.python-version }}
      - name: Install uv
        uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0
      - name: Check uv.lock is up-to-date
        run: uv lock --check
      - name: Package library
        run: uv build
      - name: Run pre-commit
        run: uv run pre-commit run --all-files
      - name: Run pytest
        run: uv run pytest
      - name: Run mypy
        run: uv run mypy
      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        if: ${{ matrix.python-version == '3.14' }}
        with:
          name: dist
          path: dist

  pypi-publish:
    name: Upload release to PyPI
    if: github.event_name == 'release'
    needs:
      - build
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/p/nagoya-bus-mcp
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          name: dist
          path: dist
      - name: Publish package distributions to PyPI
        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0

  github-release:
    name: Upload releases to GitHub
    if: github.event_name == 'release'
    needs:
      - build
    runs-on: ubuntu-latest
    environment: release
    permissions:
      attestations: write # Required for attestation
      contents: write # Required for uploading artifacts to GitHub release
      id-token: write # Required for attestation
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          name: dist
          path: dist
      - name: Attest
        uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0
        with:
          subject-path: |
            dist/*.tar.gz
            dist/*.whl
      - name: Upload artifacts to GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release upload "${{ github.event.release.tag_name }}" ./dist/*

  docker:
    name: Build and push Docker image
    needs:
      - build
    runs-on: ubuntu-latest
    permissions:
      attestations: write # Required for attestation
      contents: read
      id-token: write # Required for attestation
      packages: write # Required for pushing to GitHub Container Registry
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          # Fetch full history for setuptools-scm
          fetch-depth: 0
      - name: Login to GitHub Container Registry
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Docker metadata
        id: metadata
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
        with:
          images: ghcr.io/ymyzk/nagoya-bus-mcp
      - name: Set up QEMU
        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
      - name: Build and push
        id: push
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: ${{ github.event_name == 'release' }}
          tags: ${{ steps.metadata.outputs.tags }}
          labels: ${{ steps.metadata.outputs.labels }}
      - name: Attest
        if: github.event_name == 'release'
        uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0
        with:
          subject-name: ghcr.io/ymyzk/nagoya-bus-mcp
          subject-digest: ${{ steps.push.outputs.digest }}
          push-to-registry: true

  dependabot:
    runs-on: ubuntu-latest
    needs:
      - build
    permissions:
      contents: write
      pull-requests: write
    if: github.event_name == 'pull_request' && github.actor == 'dependabot[bot]'
    name: Automatically merge Dependabot PRs
    steps:
      - name: Fetch Dependabot metadata
        id: metadata
        uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0
        with:
          github-token: "${{ secrets.GITHUB_TOKEN }}"
      - name: Merge Dependabot PRs
        if: steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.update-type == 'version-update:semver-patch'
        run: gh pr merge --merge "$PR_URL"
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}