pr_code_changes.yaml

# Workflow that runs on code changes to a pull request.
#
# Runners. These jobs, the docs build, and Lint and Test on pushes to main
# run on ubuntu-latest unless a repository variable names another runner
# (Settings > Secrets and variables > Actions > Variables):
#   CI_RUNNER_X64       instead of ubuntu-latest for those jobs
#   CERTIFY_RUNNER_X64  instead of ubuntu-latest for the UK certification's
#                       qualify and replay jobs, which hold the GitHub App
#                       key and a write token: a GitHub-hosted larger runner
#                       only
#   CI_RUNNER_EVENTS    optional: event names separated by commas, no
#                       spaces, such as push,workflow_dispatch. Only those
#                       events use the variables. Empty means every event.
# Delete a variable to go back to ubuntu-latest for the next run. Versioning,
# Publish, NotifyConsumers, the docs deploy and the other certification jobs
# always keep GitHub-hosted runners. Each CI_RUNNER_X64 job has a read-only
# GITHUB_TOKEN, since the organisation's default token can write. Test and
# BundleVerification read the dataset with HUGGING_FACE_TOKEN, so point the
# variables only at runners where that data may be processed, such as the
# organisation's GitHub-hosted larger runners.
# tests/test_ci_runner_variables.py holds the workflows to this.

name: Code changes
on:
  pull_request:
    paths:
      - src/**
      - tests/**
      - scripts/**
      - .github/**
      - changelog.d/**
      - pyproject.toml
      - uv.lock
      - src/policyengine/data/bundle/manifest.json
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  check-changelog:
    name: Check changelog fragment
    runs-on: ${{ vars.CI_RUNNER_X64 != '' && (vars.CI_RUNNER_EVENTS == '' || contains(format(',{0},', vars.CI_RUNNER_EVENTS), format(',{0},', github.event_name))) && vars.CI_RUNNER_X64 || 'ubuntu-latest' }}
    permissions:
      contents: read
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Install towncrier
        run: pip install towncrier
      - name: Check for changelog fragment
        run: .github/check-changelog.sh
  Lint:
    runs-on: ${{ vars.CI_RUNNER_X64 != '' && (vars.CI_RUNNER_EVENTS == '' || contains(format(',{0},', vars.CI_RUNNER_EVENTS), format(',{0},', github.event_name))) && vars.CI_RUNNER_X64 || 'ubuntu-latest' }}
    permissions:
      contents: read
    timeout-minutes: 10
    steps:
        - uses: actions/checkout@v6
        - name: Install ruff
          run: pip install ruff

        - name: Run ruff format check
          run: ruff format --check .

        - name: Run ruff check
          run: ruff check .
  Mypy:
    runs-on: ${{ vars.CI_RUNNER_X64 != '' && (vars.CI_RUNNER_EVENTS == '' || contains(format(',{0},', vars.CI_RUNNER_EVENTS), format(',{0},', github.event_name))) && vars.CI_RUNNER_X64 || 'ubuntu-latest' }}
    permissions:
      contents: read
    timeout-minutes: 20
    steps:
        - uses: actions/checkout@v6
        - name: Install uv
          uses: astral-sh/setup-uv@v8.1.0
          with:
              version: "0.13.4"
        - name: Set up Python
          uses: actions/setup-python@v6
          with:
              python-version: '3.13'
        - name: Install package
          run: uv pip install -e .[dev] --system
        - name: Run mypy (informational)
          run: mypy src/policyengine || echo "mypy found errors (non-blocking until codebase is clean)"
  Python-Compat:
    name: Install + smoke-import (py${{ matrix.python-version }})
    runs-on: ${{ vars.CI_RUNNER_X64 != '' && (vars.CI_RUNNER_EVENTS == '' || contains(format(',{0},', vars.CI_RUNNER_EVENTS), format(',{0},', github.event_name))) && vars.CI_RUNNER_X64 || 'ubuntu-latest' }}
    permissions:
      contents: read
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.11", "3.12", "3.13", "3.14"]
    steps:
      - uses: actions/checkout@v6
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python-version }}
          allow-prereleases: true
      - name: Install uv
        uses: astral-sh/setup-uv@v8.1.0
        with:
          version: "0.13.4"
      - name: Install package (no country-model extras)
        run: uv pip install --system .
      - name: Smoke-import core modules
        run: python -c "import policyengine; from policyengine.core import Dataset, Policy, Simulation; from policyengine.outputs import aggregate, poverty, inequality; print('import OK')"
  BundleVerification:
    name: Verify release inputs and bundle packages
    # Private manifest credentials are available only to trusted repository PRs.
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ${{ vars.CI_RUNNER_X64 != '' && (vars.CI_RUNNER_EVENTS == '' || contains(format(',{0},', vars.CI_RUNNER_EVENTS), format(',{0},', github.event_name))) && vars.CI_RUNNER_X64 || 'ubuntu-latest' }}
    permissions:
      contents: read
    timeout-minutes: 30
    env:
      POLICYENGINE_SKIP_COUNTRY_IMPORTS: "1"
    steps:
      - uses: actions/checkout@v6
      - name: Install uv
        uses: astral-sh/setup-uv@v8.1.0
        with:
          version: "0.13.4"
      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: '3.13'
      - name: Install package for TRACE verification
        run: uv pip install -e . h5py --system
      - name: Check reviewed release inputs
        env:
          HUGGING_FACE_TOKEN: ${{ secrets.HUGGING_FACE_TOKEN }}
        run: |
          if [[ -z "${HUGGING_FACE_TOKEN:-}" ]]; then
            echo "::error::Full private release verification requires HUGGING_FACE_TOKEN"
            exit 1
          fi
          python scripts/check_release_credentials.py
          python scripts/bundle.py check --published-spm --include-tros --strict-tros
          python scripts/release_lock.py
      - name: Install bundle package scaffold
        run: |
          uv pip install -e ".[models]" --system
          python - <<'PY'
          import subprocess
          import sys

          from policyengine import bundle

          requirements = [
              requirement
              for requirement in bundle.bundle_install_requirements(
                  countries=["us", "uk"]
              )
              if not requirement.startswith("policyengine==")
          ]
          subprocess.check_call(
              [sys.executable, "-m", "pip", "install", *requirements]
          )
          PY
      - name: Check installed package consistency
        run: python -m pip check
      - name: Verify bundle packages
        run: policyengine bundle verify --country us --country uk --packages-only --json
  Test:
    runs-on: ${{ vars.CI_RUNNER_X64 != '' && (vars.CI_RUNNER_EVENTS == '' || contains(format(',{0},', vars.CI_RUNNER_EVENTS), format(',{0},', github.event_name))) && vars.CI_RUNNER_X64 || 'ubuntu-latest' }}
    permissions:
      contents: read
    # Observed 2026-10-14..15: 28 to 54 minutes per Python version, with runs on
    # 3.12 and 3.13 cancelled at the old 60-minute limit. By early Nov, 65 to 90
    # minutes on 3.11-3.13, where coverage.py 7.13.5 uses its C trace function
    # (sys.monitoring only on 3.14, which takes 47-60), and one of them was often
    # cancelled at 90: 3.12 on #730, 3.11 on #735 (#736). Fail a hung job instead
    # of holding a shared org runner for the 6-hour default.
    timeout-minutes: 105
    strategy:
      fail-fast: false
      matrix:
        python-version: ['3.11', '3.12', '3.13', '3.14']
    steps:
        - name: Checkout repo
          uses: actions/checkout@v6
        - name: Install uv
          uses: astral-sh/setup-uv@v8.1.0
          with:
              version: "0.13.4"

        - name: Set up Python
          uses: actions/setup-python@v6
          with:
              python-version: ${{ matrix.python-version }}
              allow-prereleases: true

        - name: Install package
          run: uv pip install -e .[dev] --system
        - name: Install policyengine
          run: uv pip install policyengine --system
        - name: Run tests with coverage
          run: make test
          env:
            HUGGING_FACE_TOKEN: ${{ secrets.HUGGING_FACE_TOKEN }}