lib-deps-check.yaml

name: Lib Dependencies Check

on:
  pull_request_target:
    types: [opened, synchronize, reopened]
    paths:
      - "Lib/**"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref_name }}-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  check_deps:
    permissions:
      pull-requests: write
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout base branch
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          # Use base branch for scripts (security: don't run PR code with elevated permissions)
          ref: ${{ github.event.pull_request.base.ref }}
          fetch-depth: 0
          persist-credentials: false

      - name: Fetch PR head
        run: |
          git fetch origin ${{ github.event.pull_request.head.sha }}

      - name: Checkout PR Lib files
        run: |
          # Checkout only Lib/ directory from PR head for accurate comparison
          git checkout ${{ github.event.pull_request.head.sha }} -- Lib/

      - name: Get target CPython version
        id: cpython-version
        run: |
          version=$(cat .python-version)
          echo "version=${version}" >> "$GITHUB_OUTPUT"

      - name: Checkout CPython
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: python/cpython
          path: cpython
          ref: "v${{ steps.cpython-version.outputs.version }}"
          fetch-depth: 1
          persist-credentials: false

      - name: Get changed Lib files
        id: all-changed-files
        run: |
          # Get the list of changed files under Lib/
          {
            echo 'changed<<EOF'

            git diff --name-only ${{ github.event.pull_request.base.sha }} ${{ github.event.pull_request.head.sha }} -- 'Lib/*.py' 'Lib/**/*.py'

            echo 'EOF' 
          } >> "$GITHUB_OUTPUT"

      - name: Parse changed files
        id: changed-files
        run: |
          from os import environ

          files = environ["FILES"]
          modules = set()
          for file in files.splitlines():
            file = file.strip()

            if file.startswith("Lib/test/"):
              # Test files:
              # Lib/test/test_pydoc.py -> test_pydoc
              # Lib/test/test_pydoc/foo.py -> test_pydoc
              module = file.removeprefix("Lib/test/").split("/")[0]
              if not module.startswith("test_"):
                continue
            else:
              # Lib files:
              # Lib/foo.py -> foo
              # Lib/foo/__init__.py -> foo
              module = file.removeprefix("Lib/").split("/")[0]
            
            module = module.split(".")[0]
            modules.add(module)

          print(f"{modules=}")
          output = " ".join(sorted(modules))
          output_file = environ["GITHUB_OUTPUT"]
          with open(output_file, mode="a", encoding="utf-8") as fd:
            fd.write(f"modules={output}\n")
        env:
          FILES: ${{ steps.all-changed-files.outputs.changed }}
        shell: python

      - name: Setup Python
        if: steps.changed-files.outputs.modules != ''
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0

      - name: Run deps check
        if: steps.changed-files.outputs.modules != ''
        id: deps-check
        run: |
          # Run deps for all modules at once
          echo "deps_output<<EOF" >> "$GITHUB_OUTPUT"
          output=$(python scripts/update_lib deps "${MODULES}"  --depth 2 2>&1 || true)
          echo "$output" >> "$GITHUB_OUTPUT"
          echo "EOF" >> "$GITHUB_OUTPUT"
        env:
          MODULES: ${{ steps.changed-files.outputs.modules }}

      - name: Post comment
        if: steps.deps-check.outputs.deps_output != ''
        uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
        with:
          header: lib-deps-check
          number: ${{ github.event.pull_request.number }}
          message: |
            ## 📦 Library Dependencies

            The following Lib/ modules were modified. Here are their dependencies:

            ${{ steps.deps-check.outputs.deps_output }}

            **Legend:**
            - `[+]` path exists in CPython
            - `[x]` up-to-date, `[ ]` outdated

      - name: Remove comment if no Lib changes
        if: steps.changed-files.outputs.modules == ''
        uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
        with:
          header: lib-deps-check
          number: ${{ github.event.pull_request.number }}
          delete: true