ci.yml

name: CI

on:
  push:
    branches: [ trunk ]
    tags: [ "**" ]
  pull_request:
  workflow_dispatch:

defaults:
  run:
    shell: bash

jobs:
  build:
    name: ${{ matrix.task.name}} - ${{ matrix.os.name }} ${{ matrix.python.name }}
    runs-on: ${{ matrix.os.runs-on }}
    strategy:
      fail-fast: false
      matrix:
        os:
          - name: Linux
            runs-on: ubuntu-latest
        python:
          - name: CPython 3.9
            action: 3.9
        task:
          - name: Build
            nox: build

    steps:
    - uses: actions/checkout@v3

    - uses: hynek/build-and-inspect-python-package@54d50a852d960c25f25f7f1874d3d969ecbe4eb0

    - name: Set up ${{ matrix.python.name }}
      uses: actions/setup-python@v4
      with:
        python-version: ${{ matrix.python.action }}

    - name: Install dependencies
      run: python -m pip install --upgrade pip nox

    - uses: twisted/python-info-action@v1

    - run: nox -e ${{ matrix.task.nox }}

    - name: Publish
      uses: actions/upload-artifact@v3
      with:
        name: dist
        path: dist/

  test-linux:
    name: ${{ matrix.task.name}} - Linux ${{ matrix.python.name }}
    runs-on: ubuntu-latest
    needs:
      - build
    strategy:
      fail-fast: false
      matrix:
        # Keep list in-sync with noxfile/tests & pyproject.toml.
        python:
          - name: CPython 3.8
            action: 3.8
          - name: CPython 3.9
            action: 3.9
          - name: CPython 3.10
            action: '3.10'
          - name: CPython 3.11
            action: '3.11'
          - name: CPython 3.12
            action: '3.12'
          - name: PyPy 3.8
            action: pypy3.8
        task:
          - name: Test
            nox: tests

    steps:
    - uses: actions/checkout@v3

    - name: Download package files
      uses: actions/download-artifact@v3
      with:
        name: dist
        path: dist/

    - name: Set up ${{ matrix.python.name }}
      uses: actions/setup-python@v4
      with:
        python-version: ${{ matrix.python.action }}
        allow-prereleases: true
        cache: pip

    - name: Install dependencies
      run: python -m pip install --upgrade pip nox

    - uses: twisted/python-info-action@v1

    - run: nox --python ${{ matrix.python.action }} -e ${{ matrix.task.nox }} -- --use-wheel dist/*.whl

    - name: Upload coverage data
      uses: actions/upload-artifact@v3
      with:
        name: coverage-data
        path: .coverage.*
        if-no-files-found: ignore


  test-windows:
    name: ${{ matrix.task.name}} - Windows ${{ matrix.python.name }}
    runs-on: windows-latest
    needs:
      - build
    strategy:
      fail-fast: false
      matrix:
        python:
          - name: CPython 3.9
            action: '3.9'
        task:
          - name: Test
            nox: tests

    steps:
    - uses: actions/checkout@v3

    - name: Download package files
      uses: actions/download-artifact@v3
      with:
        name: dist
        path: dist/

    - name: Set up ${{ matrix.python.name }}
      uses: actions/setup-python@v4
      with:
        python-version: ${{ matrix.python.action }}

    - name: Install dependencies
      run: python -m pip install --upgrade pip nox

    - uses: twisted/python-info-action@v1

    - run: nox --python ${{ matrix.python.action }} -e ${{ matrix.task.nox }} -- --use-wheel dist/*.whl


  check:
    name: ${{ matrix.task.name}} - ${{ matrix.python.name }}
    runs-on: ubuntu-latest
    needs:
      - build
    strategy:
      fail-fast: false
      matrix:
        python:
          # Use a recent version to avoid having common disconnects between
          # local development setups and CI.
          - name: CPython 3.11
            python-version: '3.11'
        task:
          - name: Check Newsfragment
            run: |
              nox -e check_newsfragment
              nox -e draft_newsfragment >> $GITHUB_STEP_SUMMARY
            run-if: ${{ github.head_ref != 'pre-commit-ci-update-config' }}
          - name: Check mypy
            run: nox -e typecheck
            run-if: true

    steps:
    - uses: actions/checkout@v3
      with:
        fetch-depth: 0

    - name: Download package files
      uses: actions/download-artifact@v3
      with:
        name: dist
        path: dist/

    - name: Set up ${{ matrix.python.name }}
      uses: actions/setup-python@v4
      with:
        python-version: ${{ matrix.python.python-version }}

    - name: Install dependencies
      run: python -m pip install --upgrade pip nox

    - uses: twisted/python-info-action@v1

    - name: Check
      run: |
        ${{ matrix.task.run }}
      if: ${{ matrix.task.run-if }}


  pypi-publish:
    name: Check tag and publish
    # Only trigger this for tag changes.
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
    permissions:
      # IMPORTANT: this permission is mandatory for trusted publishing
      id-token: write

    needs:
      - build
      - test-linux
      - test-windows
    steps:
    - uses: actions/checkout@v3

    - name: Download package files
      uses: actions/download-artifact@v3
      with:
        name: dist
        path: dist/

    - name: Set up Python
      uses: actions/setup-python@v4
      with:
        python-version: 3.11

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip setuptools wheel
        python -m pip install pep517

    - name: Display structure of files to be pushed
      run: ls --recursive dist/

    - name: Check matched tag version and branch version - on tag
      run: python admin/check_tag_version_match.py "${{ github.ref }}"

    - name: Publish to PyPI - on tag
      uses: pypa/gh-action-pypi-publish@a56da0b891b3dc519c7ee3284aff1fad93cc8598


  coverage:
    name: Combine & check coverage.
    needs: test-linux
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v3
    - uses: actions/setup-python@v4
      with:
        # Use latest Python, so it understands all syntax.
        python-version: 3.11

    - run: python -Im pip install --upgrade coverage[toml]

    - uses: actions/download-artifact@v3
      with:
        name: coverage-data

    - name: Combine coverage & fail if it's <100%.
      run: |
        python -Im coverage combine
        python -Im coverage html --skip-covered --skip-empty

        # Report and write to summary.
        python -Im coverage report --format=markdown >> $GITHUB_STEP_SUMMARY

        # Report again and fail if under 100%.
        python -Im coverage report --fail-under=100

    - name: Upload HTML report if check failed.
      uses: actions/upload-artifact@v3
      with:
        name: html-report
        path: htmlcov
      if: ${{ failure() }}

  # This is a meta-job to simplify PR CI enforcement configuration in GitHub.
  # Inside the GitHub config UI you only configure this job as required.
  # All the extra requirements are defined "as code" as part of the `needs`
  # list for this job.
  all:
    name: All success
    runs-on: ubuntu-latest
    # The always() part is very important.
    # If not set, the job will be skipped on failing dependencies.
    if: always()
    needs:
      # This is the list of CI job that we are interested to be green before
      # a merge.
      # pypi-publish is skipped since this is only executed for a tag.
      - build
      - test-linux
      - test-windows
      - coverage
      - check
    steps:
      - name: Require all successes
        uses: re-actors/alls-green@3a2de129f0713010a71314c74e33c0e3ef90e696
        with:
          jobs: ${{ toJSON(needs) }}