ci.yml

name: CI

# Cheap, hosted-runner checks. Deliberately does NOT build or push images: the expensive
# GROMACS/CUDA builds run only in build-images.yml (on the Astera infra branch, on
# push/dispatch — never on pull_request), so fork PRs can't trigger heavy compute.
#
# `push` is scoped to the long-lived branches and `pull_request` covers the rest. This avoids
# the double-run that happens when a single push to a branch with an open PR matches BOTH a
# wildcard `push` and `pull_request`: feature-branch pushes now run once (via pull_request),
# and main/astera get a post-merge run (via push).
on:
  push:
    branches: [main, astera]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint:
    name: Lint Python code
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Install linters
        run: |
          python -m pip install --upgrade pip
          pip install '.[dev]'

      - name: Run ruff lint check
        run: ruff check md_workflows

      - name: Run ruff format check
        run: ruff format --check md_workflows

  build-check:
    name: Dockerfile build checks (no push)
    runs-on: ubuntu-latest
    needs: lint
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Validate Dockerfiles with buildx --check
        # `--check` lints/validates each Dockerfile (syntax, build args, reserved words) without
        # executing any build step or pulling real bases. Placeholder build-args satisfy the
        # chained `FROM ${BASE_IMAGE}`/`${GROMACS_IMAGE}` so the graph resolves. Runs against
        # whichever stages are present on the branch (base+gromacs on main; +actl on astera).
        run: |
          set -e
          for f in Dockerfile.base Dockerfile.gromacs Dockerfile.actl; do
            if [ ! -f "$f" ]; then
              echo "skip $f (not present on this branch)"
              continue
            fi
            echo "::group::buildx --check $f"
            docker buildx build --check \
              --build-arg BASE_IMAGE=scratch \
              --build-arg GROMACS_IMAGE=scratch \
              -f "$f" .
            echo "::endgroup::"
          done