name: Publish lint base counts

# Every commit on main can become a future merge-base.
# Publishing its per-rule counts for each lint gate (strict ruff, type discipline,
# test quality, basedpyright) as an artifact lets the gates download them through
# scripts/lint_base_counts.py in seconds instead of scanning the merge-base tree in
# a throwaway worktree on every fresh checkout or moved merge-base.
# No concurrency group on purpose: runs must never cancel each other, because
# every sha's artifact matters (any of them can become a merge-base).

on:
  push:
    branches:
      - main
  workflow_dispatch:
    inputs:
      ref:
        description: "Ref to compute and publish base counts for (defaults to the workflow run's commit)"
        required: false

permissions:
  contents: read

jobs:
  publish:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        include:
          - checker: ruff-strict
            script: scripts/ruff_strict_gate.py
          - checker: type-discipline
            script: scripts/type_discipline_gate.py
          - checker: test-quality
            script: scripts/test_quality_gate.py
          - checker: openapi-docs
            script: scripts/openapi_docs_gate.py
          - checker: basedpyright
            script: scripts/type_check_gate.py

    steps:
      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
        with:
          ref: ${{ inputs.ref || github.sha }}
          clean: true
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: "3.12"

      - name: Set up uv
        uses: ./.github/actions/setup-uv-with-retries
        with:
          version: "0.10.9"

      - name: Cache the Rust build
        if: matrix.checker == 'basedpyright'
        uses: ./.github/actions/cache-cargo-build

      - name: Cache Prisma binaries
        if: matrix.checker == 'basedpyright' || matrix.checker == 'openapi-docs'
        uses: ./.github/actions/cache-prisma-binaries

      # The source scanners only need the pinned dev tools (ruff and the
      # stdlib checkers), the same versions test-linting.yml's python job runs.
      - name: Install the dev tools
        if: matrix.checker != 'basedpyright' && matrix.checker != 'openapi-docs'
        run: |
          uv sync --frozen --only-group dev --no-install-project

      # The OpenAPI gate imports the proxy app, so it needs the same install the
      # test-linting.yml python job uses, Prisma client included.
      - name: Install the proxy
        if: matrix.checker == 'openapi-docs'
        run: |
          uv sync --frozen --group proxy-dev --group e2e-dev --extra proxy
          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma

      - name: Emit ${{ matrix.checker }} counts for HEAD
        if: matrix.checker != 'basedpyright'
        run: |
          uv run --no-sync python ${{ matrix.script }} --emit-counts-dir "$RUNNER_TEMP/lint-counts"

      # The basedpyright gate provisions its own measurement env (.venv-typecheck:
      # a frozen uv sync of its canonical dependency groups plus a generated Prisma
      # client), so no install step here can drift from what local runs measure.
      - name: Emit basedpyright counts for HEAD
        if: matrix.checker == 'basedpyright'
        run: |
          python scripts/type_check_gate.py --emit-counts-dir "$RUNNER_TEMP/lint-counts"

      - name: Name the counts artifact
        run: |
          counts_file=$(ls "$RUNNER_TEMP"/lint-counts/${{ matrix.checker }}-counts-*.json)
          echo "COUNTS_ARTIFACT_NAME=$(basename "$counts_file" .json)" >> "$GITHUB_ENV"

      - name: Upload counts artifact
        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: ${{ env.COUNTS_ARTIFACT_NAME }}
          path: ${{ runner.temp }}/lint-counts/
          if-no-files-found: error