pytest.yml

name: Run Pytest and Codecov with Hatch

# This workflow runs tests inside the Hatch Docker image and uploads coverage.
# Important: uploading coverage to Codecov for protected branches requires a token.
# Recommended options:
# 1) Add CODECOV_TOKEN in the repository or organization secrets (recommended for protected branches).
# 2) If you don't want to set a token, Codecov uploads may still work for unprotected branches
#    (uploader auto-detection), but protected branches typically require a token.
# 3) Alternatively, keep uploads disabled and rely on the uploaded artifact (see the artifact step).
#
# The Codecov upload step below is conditional on the presence of the secret to avoid failing CI
# when the repository or branch is protected and no token is available.

on:
  push:
  pull_request:

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build Docker image
        run: docker build --target hatch -t myapp:hatch .

      - name: Run pytest and generate coverage report
        run: docker run --rm -e HATCH_ENV=test -v "${{ github.workspace }}:/app" myapp:hatch cov

      # Always upload the coverage XML as an artifact so it can be inspected even if Codecov is skipped.
      - name: Upload coverage artifact
        uses: actions/upload-artifact@v4
        with:
          name: coverage-xml
          path: ${{ github.workspace }}/coverage.xml

      # Only run the Codecov action when the repository secret CODECOV_TOKEN is present.
      # This avoids failing on protected branches where the Codecov uploader requires a token.
      - name: Upload coverage report to Codecov
        if: ${{ secrets.CODECOV_TOKEN != '' }}
        uses: codecov/codecov-action@v4
        with:
          fail_ci_if_error: true
          files: ${{ github.workspace }}/coverage.xml
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

      # Helpful informational step if the token is not set.
      - name: Skip Codecov upload (no token)
        if: ${{ secrets.CODECOV_TOKEN == '' }}
        run: |
          echo "CODECOV_TOKEN not found. Skipping Codecov upload."
          echo ""
          echo "If you want coverage uploaded to Codecov for protected branches, set a"
          echo "repository or organization secret named CODECOV_TOKEN with your Codecov token."
          echo ""
          echo "Alternatively, you can rely on the uploaded coverage artifact to inspect coverage locally."