ci-cd.yml

---
name: CI

on:  # yamllint disable-line rule:truthy
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]
  release:
    types: [created]
    branches:
    - 'main'
  workflow_dispatch:

env:
  FORCE_COLOR: "1"  # Make tools pretty.
  PIP_DISABLE_PIP_VERSION_CHECK: "1"
  PIP_NO_PYTHON_VERSION_WARNING: "1"
  PYTHON_LATEST: "3.11"

  # For re-actors/checkout-python-sdist
  sdist-artifact: python-package-distributions

jobs:

  build-sdist:
    name: 📦 Build the source distribution
    runs-on: ubuntu-latest
    # if: github.event_name == 'release' && github.event.action == 'created'
    steps:
    - name: Checkout project
      uses: actions/checkout@v3
      with:
        fetch-depth: 0
    - name: Set up Python
      uses: actions/setup-python@v4
      with:
        python-version: ${{ env.PYTHON_LATEST }}
        cache: pip
    - run: python -m pip install build
      name: Install core libraries for build and install
    - name: Build artifacts
      run: python -m build
    - name: Upload built artifacts for testing
      uses: actions/upload-artifact@v3
      with:
        name: ${{ env.sdist-artifact }}
        # NOTE: Exact expected file names are specified here
        # NOTE: as a safety measure — if anything weird ends
        # NOTE: up being in this dir or not all dists will be
        # NOTE: produced, this will fail the workflow.
        path: dist/${{ env.sdist-name }}
        retention-days: 15

  lint:
    uses: ./.github/workflows/lint.yml

  test-pytest:
    name: Tests on ${{ matrix.python-version }}
    needs: build-sdist
    runs-on: ubuntu-latest
    continue-on-error: ${{ matrix.experimental }}
    strategy:
      fail-fast: true
      matrix:
        python-version:
        - "3.8"
        - "3.9"
        - "3.10"
        - "3.11"
        experimental: [false]
        include:
        - python-version: "~3.12.0-0"
          experimental: true
    steps:
    - name: Checkout the source code
      uses: actions/checkout@v3
      with:
        fetch-depth: 0
    - name: Set up Python
      uses: actions/setup-python@v4
      with:
        python-version: ${{ matrix.python-version }}
        cache: pip
        cache-dependency-path: |
          setup.cfg
          requirements-dev.txt
    - name: Install dependencies
      run: |
        pip install -U -r requirements-dev.txt
    - name: Run tests
      run: python -m pytest --cov=aiomonitor -v tests
    - name: Upload coverage data
      uses: codecov/codecov-action@v3

  check:  # This job does nothing and is only used for the branch protection
    name: ✅ Ensure the required checks passing
    if: always()
    needs: [build-sdist, lint, test-pytest]
    runs-on: ubuntu-latest
    steps:
    - name: Decide whether the needed jobs succeeded or failed
      uses: re-actors/alls-green@release/v1
      with:
        jobs: ${{ toJSON(needs) }}

  publish:  # Run only on creating release for new tag
    name: 📦 Publish to PyPI
    runs-on: ubuntu-latest
    needs: check
    if: github.event_name == 'release' && github.event.action == 'created'

    permissions:
      contents: write  # IMPORTANT: mandatory for making GitHub Releases
      id-token: write  # IMPORTANT: mandatory for trusted publishing & sigstore

    environment:
      name: pypi
      url: https://pypi.org/p/aiomonitor

    steps:
    - name: Download the sdist artifact
      uses: actions/download-artifact@v3
      with:
        name: ${{ env.sdist-artifact }}
        path: dist

    - name: >-
        Publish 🐍📦 to PyPI
      uses: pypa/gh-action-pypi-publish@release/v1

    - name: Sign the dists with Sigstore
      uses: sigstore/gh-action-sigstore-python@v1.2.3
      with:
        inputs: >-
          ./dist/*.tar.gz
          ./dist/*.whl

    - name: Upload artifact signatures to GitHub Release
      # Confusingly, this action also supports updating releases, not
      # just creating them. This is what we want here, since we've manually
      # created the release above.
      uses: softprops/action-gh-release@v1
      with:
        # dist/ contains the built packages, which smoketest-artifacts/
        # contains the signatures and certificates.
        files: dist/**