name: CI

on:
  push:
    branches: ["**"]
    tags:
      - "v*"
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    name: Tests (unit + e2e)
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Upgrade pip
        run: python -m pip install -U pip

      - name: Install project (editable)
        run: python -m pip install -e .

      - name: Run tests
        run: make test

  tag-stable:
    name: Tag stable on version tag
    runs-on: ubuntu-latest
    needs: [test]
    if: startsWith(github.ref, 'refs/tags/v')

    permissions:
      contents: write

    steps:
      - name: Checkout (full history for tags)
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Configure git user
        run: |
          git config user.name  "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - name: Force-update stable tag to this commit
        env:
          SHA: ${{ github.sha }}
        run: |
          git tag -f stable "${SHA}"
          git push -f origin stable