pydantic--pydantic-ai/.github/workflows/after-ci.yml

name: After CI

on:
  # zizmor: ignore[dangerous-triggers] -- workflow_run is needed to access secrets after CI completes on fork PRs
  workflow_run:
    workflows: [CI]
    types: [completed]

permissions: {}

jobs:
  ci-duration-collect:
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
        with:
          python-version: "3.12"

      - name: Collect CI duration telemetry
        continue-on-error: true
        run: uv run --no-project --with certifi --with logfire python .github/scripts/ci_duration.py collect --output ci-duration-record.json
        env:
          GITHUB_TOKEN: ${{ github.token }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          CI_RUN_ID: ${{ github.event.workflow_run.id }}
          CI_RUN_ATTEMPT: ${{ github.event.workflow_run.run_attempt }}
          LOGFIRE_WRITE_TOKEN: ${{ secrets.LOGFIRE_WRITE_TOKEN }}
          LOGFIRE_TOKEN: ${{ secrets.LOGFIRE_TOKEN }}
          LOGFIRE_URL: ${{ vars.LOGFIRE_URL || 'https://logfire-api.pydantic.dev' }}
          OTEL_EXPORTER_OTLP_ENDPOINT: ${{ vars.LOGFIRE_URL || 'https://logfire-api.pydantic.dev' }}
          OTEL_EXPORTER_OTLP_HEADERS: Authorization=${{ secrets.LOGFIRE_TOKEN }}

      - name: Store CI duration record
        if: hashFiles('ci-duration-record.json') != ''
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ci-duration-${{ github.event.workflow_run.id }}-${{ github.event.workflow_run.run_attempt }}
          path: ci-duration-record.json
          retention-days: 7

  smokeshow:
    runs-on: ubuntu-latest
    permissions:
      statuses: write

    steps:
      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
        with:
          python-version: "3.12"

      - uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151 # v21
        with:
          workflow: ci.yml
          name: "(diff-)?coverage-html.*"
          name_is_regexp: true
          commit: ${{ github.event.workflow_run.head_sha }}
          allow_forks: true
          workflow_conclusion: completed
          if_no_artifact_found: warn

      - run: uvx smokeshow upload coverage-html
        if: hashFiles('coverage-html/*.html') != ''
        env:
          SMOKESHOW_GITHUB_STATUS_DESCRIPTION: Coverage {coverage-percentage}
          SMOKESHOW_GITHUB_COVERAGE_THRESHOLD: 95
          SMOKESHOW_GITHUB_CONTEXT: coverage
          SMOKESHOW_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SMOKESHOW_GITHUB_PR_HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
          SMOKESHOW_AUTH_KEY: ${{ secrets.SMOKESHOW_AUTH_KEY }}

  deploy-docs-preview:
    runs-on: ubuntu-latest
    if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.pull_requests[0] != null
    permissions:
      pull-requests: write
    environment:
      name: deploy-docs-preview

    steps:
      - run: echo "$GITHUB_EVENT_JSON"
        env:
          GITHUB_EVENT_JSON: ${{ toJSON(github.event) }}

      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
      - run: npm install
        working-directory: docs-site

      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
        with:
          python-version: "3.12"
          enable-cache: true
          cache-suffix: deploy-docs-preview

      - id: download-artifact
        uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151 # v21
        with:
          workflow: ci.yml
          name: site
          path: site
          commit: ${{ github.event.workflow_run.head_sha }}
          allow_forks: true
          workflow_conclusion: completed
          if_no_artifact_found: warn

      - uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0
        id: deploy
        if: steps.download-artifact.outputs.found_artifact == 'true'
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          environment: previews
          workingDirectory: docs-site
          command: >
            deploy
            --var GIT_COMMIT_SHA:${{ github.event.workflow_run.head_sha }}
            --var GIT_BRANCH:${{ github.event.workflow_run.head_branch }}

      - name: Set preview URL
        run: uv run --no-project --with httpx .github/set_docs_pr_preview_url.py
        if: steps.deploy.outcome == 'success'
        env:
          DEPLOY_OUTPUT: ${{ steps.deploy.outputs.command-output }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REPOSITORY: ${{ github.repository }}
          PULL_REQUEST_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }}
          REF: ${{ github.event.workflow_run.head_sha }}