python-validate.yml

name: Python Validate & Build

permissions:
  contents: read
  pull-requests: write

on:
  push:
    paths:
      - 'requirements.txt'
      - 'pyproject.toml'
      - '.github/workflows/python-validate.yml'
  pull_request:
    paths:
      - 'requirements.txt'
      - 'pyproject.toml'

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: 3.12

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            pkg-config \
            libcairo2-dev \
            libpango1.0-dev \
            libpangocairo-1.0-0 \
            libgdk-pixbuf2.0-dev \
            libffi-dev \
            shared-mime-info \
            libao-dev \
            python3-dev \
            build-essential

      - name: Install pip-tools
        run: pip install --upgrade pip pip-tools

      - name: Validate requirements
        id: validate
        run: |
          # Try pip-compile first, but fall back to pip install validation
          if pip-compile --dry-run --resolver=backtracking -o requirements.out requirements.txt 2>/dev/null; then
            echo "::debug::Python validate no broken dependencies (pip-compile)"
            echo "valid=true" >> "$GITHUB_OUTPUT"
          elif pip install --dry-run -q -r requirements.txt 2>/dev/null; then
            echo "::debug::Python validate no broken dependencies (pip install)"
            echo "valid=true" >> "$GITHUB_OUTPUT"
          else
            echo "valid=false" >> "$GITHUB_OUTPUT"
            echo "### :warning: Python validation failed in repository root" >> $GITHUB_STEP_SUMMARY
            echo "We were unable to validate the Python dependencies. Please check requirements.txt." >> $GITHUB_STEP_SUMMARY
            exit 1
          fi

      - name: Auto-approve Dependabot PRs
        if: github.actor == 'dependabot[bot]' && steps.validate.outputs.valid == 'true'
        uses: hmarr/auto-approve-action@v4
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          review-message: "Auto-approved Dependabot PR ✅"