ci.yaml

name: "CI/CD"

on:
  workflow_dispatch:
    inputs:
      debug_enabled:
        description: "Run the workflow with tmate.io debugging enabled"
        required: true
        type: boolean
        default: false
      run_build_images:
        description: "Run build-images job"
        required: false
        type: boolean
        default: false
      run_docs_preview:
        description: "Run docs-preview job"
        required: false
        type: boolean
        default: false
      force_run:
        description: "Force execution even if already successful for this commit"
        required: false
        type: boolean
        default: false
  pull_request:
    types: [opened, reopened, synchronize]
    paths-ignore:
      - "**/*.md"
      - "*"
      - "!flake.nix"
      - "!flake.lock"
      - "!pyproject.toml"
      - "!justfile"
      - "!packages/*/uv.lock"
      - "!packages/*/pyproject.toml"
      - "!packages/*/crates/**"
  push:
    branches:
      - "main"
      - "beta"
    paths-ignore:
      - "**/*.md"
      - "*"
      - "!flake.nix"
      - "!flake.lock"
      - "!pyproject.toml"
      - "!justfile"
      - "!packages/*/uv.lock"
      - "!packages/*/pyproject.toml"
      - "!packages/*/crates/**"

concurrency:
  group: ci-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

defaults:
  run:
    shell: bash

permissions:
  contents: read

jobs:
  # ---------------------------------------------------------------------------
  # job 1: secrets-scan
  # scans repository for secrets — security-critical, no caching
  # ---------------------------------------------------------------------------
  secrets-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0 # full history for comprehensive secret scanning

      - name: Setup Nix
        uses: ./.github/actions/setup-nix
        with:
          installer: quick # fast install without space reclamation overhead
          system: x86_64-linux

      - name: Scan for secrets with gitleaks
        run: nix run nixpkgs#gitleaks -- detect --verbose --redact

  # ---------------------------------------------------------------------------
  # job 2: set-variables
  # computes CI variables, discovers packages, determines routing
  # ---------------------------------------------------------------------------
  set-variables:
    needs: secrets-scan
    runs-on: ubuntu-latest
    outputs:
      debug: ${{ steps.set-variables.outputs.debug }}
      skip_ci: ${{ steps.set-variables.outputs.skip_ci }}
      skip_tests: ${{ steps.set-variables.outputs.skip_tests }}
      dry_run_release: ${{ steps.set-variables.outputs.dry_run_release }}
      checkout_ref: ${{ steps.set-variables.outputs.checkout_ref }}
      checkout_rev: ${{ steps.set-variables.outputs.checkout_rev }}
      has_docs: ${{ steps.check-docs.outputs.has_docs }}
      sanitized_branch: ${{ steps.set-variables.outputs.sanitized_branch }}
      packages: ${{ steps.discover-packages.outputs.packages }}
      force_ci: ${{ steps.set-variables.outputs.force_ci }}

    steps:
      - name: Checkout for discovery
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          sparse-checkout: |
            docs
            packages
            justfile
          sparse-checkout-cone-mode: false

      - name: Check if docs exist
        id: check-docs
        run: |
          if [ -d "docs" ] && [ "$(ls -A docs 2>/dev/null)" ]; then
            echo "has_docs=true" >> "$GITHUB_OUTPUT"
          else
            echo "has_docs=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Set action variables
        id: set-variables
        env:
          PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
        run: |
          DEBUG="false"
          SKIP_CI="false"
          SKIP_TESTS="false"
          DRY_RUN_RELEASE="false"
          FORCE_CI="false"

          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            DEBUG="${{ inputs.debug_enabled }}"
            if [[ "${{ inputs.force_run }}" == "true" ]]; then
              FORCE_CI="true"
            fi
          fi

          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
            if ${{ contains(github.event.pull_request.labels.*.name, 'skip-ci') }}; then
              SKIP_CI="true"
            fi
            if ${{ contains(github.event.pull_request.labels.*.name, 'skip-tests') }}; then
              SKIP_TESTS="true"
            fi
            if ${{ contains(github.event.pull_request.labels.*.name, 'actions-debug') }}; then
              DEBUG="true"
            fi
            if ${{ contains(github.event.pull_request.labels.*.name, 'release-dry-run') }}; then
              DRY_RUN_RELEASE="true"
            fi
            if ${{ contains(github.event.pull_request.labels.*.name, 'force-ci') }}; then
              FORCE_CI="true"
            fi
            CHECKOUT_REF="$PR_HEAD_REF"
            CHECKOUT_REV="${{ github.event.pull_request.head.sha }}"
          else
            CHECKOUT_REF="${{ github.ref_name }}"
            CHECKOUT_REV="${{ github.sha }}"
          fi

          # Sanitize branch name for Cloudflare preview alias (must be valid subdomain component)
          # - Replace / and other non-alphanumeric chars with -
          # - Collapse consecutive hyphens, remove leading/trailing hyphens
          # - Truncate to 40 chars (safe for subdomain label limit of 63)
          SANITIZED_BRANCH=$(echo "$CHECKOUT_REF" | tr '/' '-' | tr -c 'a-zA-Z0-9-' '-' | sed 's/--*/-/g; s/^-//; s/-$//' | cut -c1-40)

          {
            echo "debug=$DEBUG"
            echo "skip_ci=$SKIP_CI"
            echo "skip_tests=$SKIP_TESTS"
            echo "dry_run_release=$DRY_RUN_RELEASE"
            echo "checkout_ref=$CHECKOUT_REF"
            echo "checkout_rev=$CHECKOUT_REV"
            echo "sanitized_branch=$SANITIZED_BRANCH"
            echo "force_ci=$FORCE_CI"
          } >> "$GITHUB_OUTPUT"

      - name: Discover packages
        id: discover-packages
        run: |
          PACKAGES=$(find packages -maxdepth 2 -name pyproject.toml -path '*/*/pyproject.toml' | sort | while read -r f; do
            d=$(dirname "$f")
            n=$(basename "$d")

            # Detect maturin/pyo3 package by Cargo.toml presence
            is_maturin="false"
            if [ -f "$d/Cargo.toml" ]; then is_maturin="true"; fi

            # Read per-package CI metadata from .ci.json if present
            ci_json="$d/.ci.json"
            if [ -f "$ci_json" ]; then
              build_images=$(jq -r '.["build-images"] // false' "$ci_json")
              images=$(jq -c '.images // []' "$ci_json")
            else
              build_images="false"
              images="[]"
            fi

            jq -nc \
              --arg name "$n" \
              --arg path "$d" \
              --argjson is_maturin "$is_maturin" \
              --arg build_images "$build_images" \
              --argjson images "$images" \
              '{name: $name, path: $path, "is_maturin": $is_maturin, "build-images": $build_images, images: ($images | tojson)}'
          done | jq -sc '.')
          echo "packages=$PACKAGES" >> "$GITHUB_OUTPUT"
          echo "Discovered packages: $PACKAGES"

  # ---------------------------------------------------------------------------
  # job 3: flake-validation
  # validates flake structure, justfile recipes, nix flake check
  # ---------------------------------------------------------------------------
  flake-validation:
    needs: [secrets-scan, set-variables]
    runs-on: ubuntu-latest
    if: ${{ needs.set-variables.outputs.skip_ci != 'true' }}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Check execution cache
        id: cache
        uses: ./.github/actions/cached-ci-job
        with:
          hash-sources: '**/*.nix flake.lock justfile'
          force-run: ${{ needs.set-variables.outputs.force_ci }}

      - name: Setup Nix
        if: steps.cache.outputs.should-run == 'true'
        uses: ./.github/actions/setup-nix
        with:
          system: x86_64-linux
          enable-cachix: true
          cachix-name: ${{ vars.CACHIX_CACHE_NAME }}
          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}

      - name: Verify justfile recipes
        if: steps.cache.outputs.should-run == 'true'
        run: |
          JUST_RECIPES=$(nix develop --accept-flake-config -c just --summary)
          echo "Available recipes (summary):"
          echo "$JUST_RECIPES" | tr ' ' '\n' | head -20
          echo "... (and more)"

          echo ""
          echo "Verifying core recipes..."
          for recipe in check lint; do
            if echo "$JUST_RECIPES" | grep -qw "$recipe"; then
              echo "  $recipe recipe found"
            else
              echo "  $recipe recipe not found"
              exit 1
            fi
          done

      - name: Validate flake
        if: steps.cache.outputs.should-run == 'true'
        run: nix develop --accept-flake-config -c just flake-check

      - name: Create job result marker
        if: success() && steps.cache.outputs.should-run == 'true' && steps.cache.outputs.cache-source == 'none'
        run: |
          mkdir -p "${{ steps.cache.outputs.cache-path }}"
          echo '{"success":true}' > "${{ steps.cache.outputs.cache-path }}/marker"

      - name: Save execution cache
        if: success() && steps.cache.outputs.should-run == 'true' && steps.cache.outputs.cache-source == 'none'
        uses: actions/cache/save@565629816435f6c0b50676926c9b05c254113c0c # ratchet:actions/cache/save@v4
        with:
          path: ${{ steps.cache.outputs.cache-path }}
          key: ${{ steps.cache.outputs.cache-key }}

  # ---------------------------------------------------------------------------
  # job 4: bootstrap-verification
  # validates bootstrap.sh and Makefile workflow on clean ubuntu
  # ---------------------------------------------------------------------------
  bootstrap-verification:
    needs: [secrets-scan, set-variables]
    runs-on: ubuntu-latest
    if: ${{ needs.set-variables.outputs.skip_ci != 'true' }}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Check execution cache
        id: cache
        uses: ./.github/actions/cached-ci-job
        with:
          hash-sources: 'Makefile .envrc .github/actions/setup-nix/action.yml'
          force-run: ${{ needs.set-variables.outputs.force_ci }}

      - name: Run make bootstrap
        if: steps.cache.outputs.should-run == 'true'
        run: make bootstrap

      - name: Verify nix installed
        if: steps.cache.outputs.should-run == 'true'
        run: |
          if ! command -v nix &> /dev/null; then
            echo "nix not found in PATH"
            exit 1
          fi
          echo "nix found at: $(command -v nix)"
          nix --version

      - name: Verify direnv configured
        if: steps.cache.outputs.should-run == 'true'
        run: |
          if ! command -v direnv &> /dev/null; then
            echo "direnv not found in PATH"
            exit 1
          fi
          echo "direnv found at: $(command -v direnv)"

      - name: Run make verify
        if: steps.cache.outputs.should-run == 'true'
        run: make verify

      - name: Run make setup-user
        if: steps.cache.outputs.should-run == 'true'
        run: make setup-user

      - name: Verify age key exists
        if: steps.cache.outputs.should-run == 'true'
        run: |
          if [ ! -f ~/.config/sops/age/keys.txt ]; then
            echo "age key not generated"
            exit 1
          fi
          echo "age key generated successfully"

      - name: Create job result marker
        if: success() && steps.cache.outputs.should-run == 'true' && steps.cache.outputs.cache-source == 'none'
        run: |
          mkdir -p "${{ steps.cache.outputs.cache-path }}"
          echo '{"success":true}' > "${{ steps.cache.outputs.cache-path }}/marker"

      - name: Save execution cache
        if: success() && steps.cache.outputs.should-run == 'true' && steps.cache.outputs.cache-source == 'none'
        uses: actions/cache/save@565629816435f6c0b50676926c9b05c254113c0c # ratchet:actions/cache/save@v4
        with:
          path: ${{ steps.cache.outputs.cache-path }}
          key: ${{ steps.cache.outputs.cache-key }}

  # ---------------------------------------------------------------------------
  # job 5: nix
  # category-based matrix build for flake outputs (packages, checks, devshells)
  # ---------------------------------------------------------------------------
  nix:
    needs: [secrets-scan, set-variables]
    runs-on: ${{ matrix.runner }}
    if: ${{ needs.set-variables.outputs.skip_ci != 'true' }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - system: x86_64-linux
            runner: ubuntu-latest
            category: packages
          - system: x86_64-linux
            runner: ubuntu-latest
            category: checks
          - system: x86_64-linux
            runner: ubuntu-latest
            category: devshells
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Check execution cache
        id: cache
        uses: ./.github/actions/cached-ci-job
        with:
          check-name: nix-${{ matrix.category }}
          hash-sources: '**/*.nix flake.lock justfile packages/*/pyproject.toml packages/*/uv.lock packages/*/Cargo.lock'
          force-run: ${{ needs.set-variables.outputs.force_ci }}

      - name: Setup Nix
        if: steps.cache.outputs.should-run == 'true'
        uses: ./.github/actions/setup-nix
        with:
          system: ${{ matrix.system }}
          extra-conf: "system-features = nixos-test benchmark big-parallel kvm"
          enable-cachix: true
          cachix-name: ${{ vars.CACHIX_CACHE_NAME }}
          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}

      - name: Build ${{ matrix.category }}
        if: steps.cache.outputs.should-run == 'true'
        run: |
          echo "Building ${{ matrix.category }} for ${{ matrix.system }}"
          nix develop --accept-flake-config -c just ci-build-category "${{ matrix.system }}" "${{ matrix.category }}"

      - name: Report disk usage
        if: always()
        run: df -h

      - name: Create job result marker
        if: success() && steps.cache.outputs.should-run == 'true' && steps.cache.outputs.cache-source == 'none'
        run: |
          mkdir -p "${{ steps.cache.outputs.cache-path }}"
          echo '{"success":true}' > "${{ steps.cache.outputs.cache-path }}/marker"

      - name: Save execution cache
        if: success() && steps.cache.outputs.should-run == 'true' && steps.cache.outputs.cache-source == 'none'
        uses: actions/cache/save@565629816435f6c0b50676926c9b05c254113c0c # ratchet:actions/cache/save@v4
        with:
          path: ${{ steps.cache.outputs.cache-path }}
          key: ${{ steps.cache.outputs.cache-key }}

  # ---------------------------------------------------------------------------
  # job 6: test-python
  # per-package python test matrix
  # ---------------------------------------------------------------------------
  test-python:
    needs: [set-variables]
    if: ${{ needs.set-variables.outputs.skip_ci != 'true' && needs.set-variables.outputs.skip_tests != 'true' }}
    concurrency:
      group: test-python-${{ matrix.package.name }}-${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.ref_name }}
      cancel-in-progress: true
    strategy:
      fail-fast: false
      matrix:
        package: ${{ fromJson(needs.set-variables.outputs.packages) }}
    uses: ./.github/workflows/python-test.yaml
    with:
      package-name: ${{ matrix.package.name }}
      debug_enabled: ${{ needs.set-variables.outputs.debug }}
      checkout_ref: ${{ needs.set-variables.outputs.checkout_ref }}
      force_run: ${{ inputs.force_run && 'true' || 'false' }}
    secrets: inherit

  # ---------------------------------------------------------------------------
  # job 7: preview-release-version
  # preview semantic-release version for each package (PR only)
  # ---------------------------------------------------------------------------
  preview-release-version:
    needs: [set-variables]
    if: |
      !cancelled() &&
      github.event_name == 'pull_request'
    strategy:
      fail-fast: false
      matrix:
        package: ${{ fromJson(needs.set-variables.outputs.packages) }}
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ github.head_ref }}
          fetch-depth: 0
          fetch-tags: true

      - name: Check execution cache
        id: cache
        uses: ./.github/actions/cached-ci-job
        with:
          check-name: preview-release-version-${{ matrix.package.name }}
          hash-sources: 'packages/${{ matrix.package.name }}/**/* .github/actions/setup-nix/action.yml justfile scripts/preview-version.sh'
          force-run: 'true'

      - name: Fetch target branch
        if: steps.cache.outputs.should-run == 'true'
        run: |
          git fetch origin
          git branch -f main origin/main

      - name: Configure git identity
        if: steps.cache.outputs.should-run == 'true'
        run: |
          git config --global user.name "github-actions[bot]"
          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"

      - name: Setup Nix
        if: steps.cache.outputs.should-run == 'true'
        uses: ./.github/actions/setup-nix
        with:
          system: x86_64-linux
          enable-cachix: true
          cachix-name: ${{ vars.CACHIX_CACHE_NAME }}
          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}

      - name: Preview version for ${{ matrix.package.name }}
        id: preview
        if: steps.cache.outputs.should-run == 'true'
        run: |
          echo "::group::Preview semantic-release version"
          OUTPUT=$(nix develop --accept-flake-config -c just preview-version main "${{ matrix.package.path }}" 2>&1 | tee /dev/stderr)
          echo "::endgroup::"

          # Strip ANSI escape codes before parsing (script outputs colored text)
          OUTPUT=$(echo "$OUTPUT" | sed 's/\x1b\[[0-9;]*m//g')
          VERSION=$(echo "$OUTPUT" | grep "next version:" | awk '{print $3}') || true
          if [ -n "$VERSION" ]; then
            echo "::notice title=Next Version (${{ matrix.package.name }})::$VERSION"
            echo "next-version=$VERSION" >> "$GITHUB_OUTPUT"
            echo "release-pending=true" >> "$GITHUB_OUTPUT"
          else
            echo "::notice title=Next Version (${{ matrix.package.name }})::No release pending"
            echo "next-version=" >> "$GITHUB_OUTPUT"
            echo "release-pending=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Check version consistency for ${{ matrix.package.name }}
        if: steps.cache.outputs.should-run == 'true' && steps.preview.outputs.release-pending == 'true'
        run: |
          NEXT_VERSION="${{ steps.preview.outputs.next-version }}"
          PACKAGE_PATH="${{ matrix.package.path }}"
          PACKAGE_NAME="${{ matrix.package.name }}"

          # Extract version from pyproject.toml
          PYPROJECT_VERSION=$(grep -m1 '^version = ' "$PACKAGE_PATH/pyproject.toml" | sed 's/version = "\(.*\)"/\1/')

          echo "Previewed next version: $NEXT_VERSION"
          echo "pyproject.toml version: $PYPROJECT_VERSION"

          MISMATCH=false

          if [ "$PYPROJECT_VERSION" != "$NEXT_VERSION" ]; then
            echo "::error title=Version Mismatch ($PACKAGE_NAME)::pyproject.toml has $PYPROJECT_VERSION but next release would be $NEXT_VERSION. Run: just update-version $PACKAGE_NAME $NEXT_VERSION"
            MISMATCH=true
          fi

          # For maturin packages, also check Cargo.toml
          if [ -f "$PACKAGE_PATH/Cargo.toml" ]; then
            CARGO_VERSION=$(grep -A5 '^\[workspace\.package\]' "$PACKAGE_PATH/Cargo.toml" | grep '^version = ' | sed 's/version = "\(.*\)"/\1/' || true)
            if [ -z "$CARGO_VERSION" ]; then
              CARGO_VERSION=$(grep -m1 '^version = ' "$PACKAGE_PATH/Cargo.toml" | sed 's/version = "\(.*\)"/\1/')
            fi
            echo "Cargo.toml version:     $CARGO_VERSION"
            if [ "$CARGO_VERSION" != "$NEXT_VERSION" ]; then
              echo "::error title=Cargo Version Mismatch ($PACKAGE_NAME)::Cargo.toml has $CARGO_VERSION but next release would be $NEXT_VERSION. Run: just update-version $PACKAGE_NAME $NEXT_VERSION"
              MISMATCH=true
            fi
          fi

          if [ "$MISMATCH" = "true" ]; then
            exit 1
          fi

          echo "Version consistency check passed for $PACKAGE_NAME"

      - name: Create job result marker
        if: success() && steps.cache.outputs.should-run == 'true' && steps.cache.outputs.cache-source == 'none'
        run: |
          mkdir -p "${{ steps.cache.outputs.cache-path }}"
          echo '{"success":true}' > "${{ steps.cache.outputs.cache-path }}/marker"

      - name: Save execution cache
        if: success() && steps.cache.outputs.should-run == 'true' && steps.cache.outputs.cache-source == 'none'
        uses: actions/cache/save@565629816435f6c0b50676926c9b05c254113c0c # ratchet:actions/cache/save@v4
        with:
          path: ${{ steps.cache.outputs.cache-path }}
          key: ${{ steps.cache.outputs.cache-key }}

  # ---------------------------------------------------------------------------
  # job 8: preview-docs-deploy
  # deploy docs to preview environment (PR only)
  # ---------------------------------------------------------------------------
  preview-docs-deploy:
    needs: set-variables
    if: ${{ needs.set-variables.outputs.has_docs == 'true' && needs.set-variables.outputs.skip_ci != 'true' && ( contains(github.event.pull_request.labels.*.name, 'docs-preview') || (github.event_name == 'workflow_dispatch' && inputs.run_docs_preview) ) }}
    uses: ./.github/workflows/deploy-docs.yaml
    permissions:
      contents: read
      deployments: write
    concurrency:
      group: docs-preview-${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.ref_name }}-${{ github.sha }}
      cancel-in-progress: true
    with:
      debug_enabled: ${{ needs.set-variables.outputs.debug }}
      branch: ${{ needs.set-variables.outputs.checkout_ref }}
      sanitized_branch: ${{ needs.set-variables.outputs.sanitized_branch }}
      environment: preview
      force_run: ${{ needs.set-variables.outputs.force_ci }}
    secrets: inherit

  # ---------------------------------------------------------------------------
  # job 9: test-release-packages
  # dry-run release for each package (PR only)
  # ---------------------------------------------------------------------------
  test-release-packages:
    needs: [set-variables, test-python]
    if: ${{ github.event_name == 'pull_request' }}
    concurrency:
      group: test-release-${{ matrix.package.name }}-${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.ref_name }}
      cancel-in-progress: true
    permissions:
      contents: write
      id-token: write
      packages: write
    strategy:
      fail-fast: false
      matrix:
        package: ${{ fromJson(needs.set-variables.outputs.packages) }}
    uses: ./.github/workflows/package-release.yaml
    with:
      package-path: ${{ matrix.package.path }}
      package-name: ${{ matrix.package.name }}
      version: "0.0.0-test"
      release-dry-run: "true"
      checkout-ref: ${{ needs.set-variables.outputs.checkout_ref }}
    secrets: inherit

  # ---------------------------------------------------------------------------
  # job 10: release-packages
  # production release on push to main/beta
  # ---------------------------------------------------------------------------
  release-packages:
    needs: [set-variables, test-python, nix]
    if: ${{ github.repository_owner == 'sciexp' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/beta') }}
    concurrency:
      group: release-${{ matrix.package.name }}-${{ github.workflow }}-${{ github.ref_name }}
      cancel-in-progress: true
    permissions:
      contents: write
      id-token: write
      packages: write
    strategy:
      fail-fast: false
      matrix:
        package: ${{ fromJson(needs.set-variables.outputs.packages) }}
    uses: ./.github/workflows/package-release.yaml
    with:
      package-path: ${{ matrix.package.path }}
      package-name: ${{ matrix.package.name }}
      version: "0.0.0"
      release-dry-run: "false"
      checkout-ref: ${{ needs.set-variables.outputs.checkout_ref }}
      build-images: ${{ matrix.package.build-images }}
      images-to-build: ${{ matrix.package.images }}
    secrets: inherit

  # ---------------------------------------------------------------------------
  # job 11: production-docs-deploy
  # production docs deployment on push to main/beta
  # ---------------------------------------------------------------------------
  production-docs-deploy:
    needs: [set-variables, test-python, nix]
    if: ${{ needs.set-variables.outputs.has_docs == 'true' && github.repository_owner == 'sciexp' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/beta') }}
    uses: ./.github/workflows/deploy-docs.yaml
    permissions:
      contents: read
      deployments: write
    concurrency:
      group: production-docs-deploy-${{ github.workflow }}-${{ github.ref_name }}
      cancel-in-progress: true
    with:
      debug_enabled: ${{ needs.set-variables.outputs.debug }}
      branch: ${{ needs.set-variables.outputs.checkout_ref }}
      sanitized_branch: ${{ needs.set-variables.outputs.sanitized_branch }}
      environment: production
      force_run: ${{ needs.set-variables.outputs.force_ci }}
    secrets: inherit

  # ---------------------------------------------------------------------------
  # job 12: build-pr-images
  # build container images for PR validation
  # ---------------------------------------------------------------------------
  build-pr-images:
    needs: [set-variables]
    if: ${{ needs.set-variables.outputs.skip_ci != 'true' && ( contains(github.event.pull_request.labels.*.name, 'build-images') || (github.event_name == 'workflow_dispatch' && inputs.run_build_images) ) }}
    permissions:
      contents: read
      packages: write
    uses: ./.github/workflows/build-nix-images.yaml
    concurrency:
      group: bni-${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.ref }}
      cancel-in-progress: true
    with:
      debug_enabled: ${{ needs.set-variables.outputs.debug == 'true' }}
      version: ${{ needs.set-variables.outputs.checkout_rev }}
      push: false
      tags: ""
    secrets: inherit