python-package.yml

# This workflow will install Python dependencies, run tests and lint with a variety of Python versions
# For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions

name: Package

on:
  push:
    branches: [ "main" ]
  pull_request: {}
  workflow_dispatch:
    inputs:
      test_target:
        description: "Live target to run"
        required: false
        default: "smoke"
        type: choice
        options:
          - smoke
          - comment
          - upload
          - fbsearch
          - realtime
          - signup
          - all

env:
  PYTHON_VERSION: "3.13.5"

jobs:
  dependency-audit:
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@v7
      - uses: actions/setup-python@v6
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - name: Install dependencies
        uses: ./.github/actions/install-dependencies
        with:
          test: "true"

      - name: Run pip-audit
        run: pip-audit --strict --progress-spinner off .

  bandit:
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@v7
      - uses: actions/setup-python@v6
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - name: Install dependencies
        uses: ./.github/actions/install-dependencies
        with:
          test: "true"

      - name: Run bandit
        run: bandit -c pyproject.toml -r aiograpi

  lint:
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@v7
      - uses: actions/setup-python@v6
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - name: Install dependencies
        uses: ./.github/actions/install-dependencies
        with:
          test: "true"

      - name: Run Ruff
        run: |
          ruff check --output-format=github .
          ruff format --check .

  minimum-runtime-dependencies:
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@v7
      - uses: actions/setup-python@v6
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - name: Install package with minimum runtime dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install \
            "httpx==0.28.1" \
            "orjson==3.11.8" \
            "PySocks==1.7.1" \
            "pydantic==2.12.5" \
            "Pillow==12.2.0" \
            "pycryptodomex==3.23.0" \
            "zstandard==0.25.0"
          python -m pip install .
          python -m pip check
          python - <<'PY'
          from aiograpi import Client

          Client()
          PY

  mypy:
    # Mypy regression gate. Counts errors against .mypy-baseline and fails
    # if the count goes up. Strict-pass is years away (legacy upstream port
    # has 1000+ untyped functions); this just stops the bleeding.
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@v7
      - uses: actions/setup-python@v6
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - name: Install dependencies
        uses: ./.github/actions/install-dependencies
        with:
          test: "true"
      - name: Run mypy regression gate
        run: ./scripts/check-mypy-baseline.sh

  unit-test:
    # Network-free regression tests. Runs on every push/PR. No
    # secrets needed — purely tests parsing, mocking, and plumbing.
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: [ "3.10", "3.11", "3.12" ]
    steps:
      - name: Check out code
        uses: actions/checkout@v7
      - uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python-version }}
      - name: Install dependencies
        uses: ./.github/actions/install-dependencies
        with:
          test: "true"
      - name: Run regression tests
        # ~107 tests across all RegressionTestCase classes + a few
        # related ones. ~10 are individually @unittest.skip-ped with
        # documented reasons (urllib3-only, requires live network).
        run: |
          pytest -sv \
            tests/legacy.py::ExtractorsRegressionTestCase \
            tests/legacy.py::ImageUtilSafeRemoteFetchTestCase \
            tests/legacy.py::DirectExtractorRegressionTestCase \
            tests/legacy.py::PublicRegressionTestCase \
            tests/legacy.py::PolarisProfileNormalizationTestCase \
            tests/legacy.py::CaptchaHandlerMixinRegressionTestCase \
            tests/legacy.py::NoteMixinRegressionTestCase \
            tests/legacy.py::LocationMixinRegressionTestCase \
            tests/legacy.py::ChallengeRegressionTestCase \
            tests/legacy.py::AuthAndStoryRegressionTestCase \
            tests/legacy.py::ClientTestCase \
            tests/legacy.py::DownloadRegressionTestCase \
            tests/legacy.py::DirectMixinRegressionTestCase \
            tests/legacy.py::UserMixinRegressionTestCase \
            tests/legacy.py::TimelineRegressionTestCase \
            tests/legacy.py::StoryConfigureRegressionTestCase \
            tests/legacy.py::UploadRegressionTestCase \
            tests/legacy.py::SignUpTestCase \
            tests/legacy.py::NotificationMixinRegressionTestCase \
            tests/legacy.py::ChapiPortedRegressionTestCase \
            tests/regression

  live-test:
    # Live IG tests via pooled accounts. Only on canonical-repo pushes
    # — PRs from forks don't have access to the TEST_ACCOUNTS_URL secret.
    runs-on: ubuntu-latest
    if: (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.repository == 'subzeroid/aiograpi'
    strategy:
      matrix:
        python-version: [ "3.10" ]
    env:
      TEST_ACCOUNTS_URL: ${{ secrets.TEST_ACCOUNTS_URL }}
      IG_REALTIME_PROXY: ${{ secrets.IG_REALTIME_PROXY }}
      IG_SIGNUP_EMAIL: ${{ secrets.IG_SIGNUP_EMAIL }}
      IG_SIGNUP_EMAIL_COMMAND: ${{ secrets.IG_SIGNUP_EMAIL_COMMAND }}
      IG_SIGNUP_EMAIL_CODE: ${{ secrets.IG_SIGNUP_EMAIL_CODE }}
      IG_SIGNUP_EMAIL_CODE_COMMAND: ${{ secrets.IG_SIGNUP_EMAIL_CODE_COMMAND }}
      IG_SIGNUP_PHONE_NUMBER: ${{ secrets.IG_SIGNUP_PHONE_NUMBER }}
      IG_SIGNUP_SMS_CODE: ${{ secrets.IG_SIGNUP_SMS_CODE }}
      IG_SIGNUP_SMS_CODE_COMMAND: ${{ secrets.IG_SIGNUP_SMS_CODE_COMMAND }}
    steps:
      - name: Check out code
        uses: actions/checkout@v7
      - uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python-version }}
      - name: Install dependencies
        uses: ./.github/actions/install-dependencies
        with:
          test: "true"
      - name: Run end-to-end smoke
        if: github.event_name != 'workflow_dispatch' || github.event.inputs.test_target == 'smoke' || github.event.inputs.test_target == 'all'
        # Required: login(TOTP) + private_v1 + private_v2_gql +
        # user_short_gql + hashtag_info_v1 + user_medias_v1 +
        # user_medias_gql + user_followers + highlight_info.
        # Optional (reports but never fails): anonymous public web
        # lookup + all chapi-ported endpoints.
        # PYTHONPATH=. so `from aiograpi import Client` resolves without
        # `pip install -e .` (install-dependencies action installs deps
        # only, not the package itself).
        #
        # Note: pytest classes ClientMediaTestCase / ClientUserTestCase /
        # ClientHighlightTestCase are intentionally not run here — they
        # require ACCOUNT_USERNAME/PASSWORD env vars (not provided by the
        # accounts endpoint). Pure helpers (media_pk, media_pk_from_code,
        # media_code_from_pk, media_id, highlight_pk_from_url) are covered
        # by the unit-test job; user_followers and highlight_info are
        # covered by the smoke above.
        run: PYTHONPATH=. python tests/live/smoke.py
      - name: Run comment write test
        if: github.event_name == 'workflow_dispatch' && (github.event.inputs.test_target == 'comment' || github.event.inputs.test_target == 'all')
        run: |
          if [ -z "${TEST_ACCOUNTS_URL}" ]; then
            echo "SKIP: TEST_ACCOUNTS_URL secret is not configured"
            exit 0
          fi
          PYTHONPATH=. pytest -sv tests/legacy.py::ClientCommentExtendTestCase::test_media_comment
      - name: Run upload live tests
        if: github.event_name == 'workflow_dispatch' && (github.event.inputs.test_target == 'upload' || github.event.inputs.test_target == 'all')
        run: |
          if [ -z "${TEST_ACCOUNTS_URL}" ]; then
            echo "SKIP: TEST_ACCOUNTS_URL secret is not configured"
            exit 0
          fi
          PYTHONPATH=. pytest -sv tests/live/test_upload.py::ClientUploadCoauthorLiveTestCase::test_clip_upload_show_preview_in_feed_false_live
      - name: Run fbsearch live test
        if: github.event_name == 'workflow_dispatch' && (github.event.inputs.test_target == 'fbsearch' || github.event.inputs.test_target == 'all')
        run: |
          if [ -z "${TEST_ACCOUNTS_URL}" ]; then
            echo "SKIP: TEST_ACCOUNTS_URL secret is not configured"
            exit 0
          fi
          PYTHONPATH=. pytest -sv tests/live/test_fbsearch.py::ClientFbSearchLiveTestCase
      - name: Run realtime MQTT live tests
        if: github.event_name == 'workflow_dispatch' && (github.event.inputs.test_target == 'realtime' || github.event.inputs.test_target == 'all')
        run: PYTHONPATH=. pytest -sv tests/live/test_realtime.py::ClientRealtimeLiveTestCase tests/live/test_fbns.py::ClientFbnsLiveTestCase
      - name: Run signup live tests
        if: github.event_name == 'workflow_dispatch' && (github.event.inputs.test_target == 'signup' || github.event.inputs.test_target == 'all')
        run: PYTHONPATH=. pytest -sv tests/live/test_signup_live.py::SignUpTestCase

  build-docs:
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - name: Check out code
        uses: actions/checkout@v7

      - uses: actions/setup-python@v6
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install dependencies
        uses: ./.github/actions/install-dependencies
        with:
          test: "true"

      - name: Build Docs
        run: mkdocs build --strict

      # upload artifact for dev build
      - name: Upload coverage results artifact
        if: github.ref != 'refs/heads/main'
        uses: actions/upload-artifact@v7
        with:
          name: docs-site
          path: site/

  update-dev-docs:
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    permissions:
      contents: write
    steps:
      - name: Check out code
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - uses: actions/setup-python@v6
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install dependencies
        uses: ./.github/actions/install-dependencies
        with:
          test: "true"

      - name: Push documentaiton changes
        uses: ./.github/actions/publish-docs-with-mike
        with:
          version_name: dev