ci.yml

name: CI

on:
  push:
    branches:
      - "master"
    tags:
      - "v*"
  pull_request:
    branches:
      - "master"

permissions:
  contents: read
  security-events: write

jobs:
  ci:
    name: Check style and run tests
    strategy:
      fail-fast: false
      matrix:
        python-version:
          ["3.8", "3.9", "3.10", "3.11", "3.12", "3.13.0-beta.1", "pypy3.9", "pypy3.10"]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: python
      - name: Install Poetry
        run: pipx install poetry
      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: "poetry"
      - name: Setup environment
        run: poetry install
      - name: Style
        run: make style
      - name: Test
        run: make test
      - name: Codecov
        uses: codecov/codecov-action@v4
        with:
          flags: ${{ matrix.python-version }}
          token: ${{ secrets.CODECOV_TOKEN }}
  code_scanning:
    name: Code scanning
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: python
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3
  release:
    name: Release on PyPI
    runs-on: ubuntu-latest
    environment: release
    needs: [ci, code_scanning]
    if: startsWith(github.ref, 'refs/tags/v')
    permissions:
      id-token: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Install Poetry
        run: pipx install poetry
      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"
          cache: "poetry"
      - name: Setup environment
        run: poetry install
      - name: Build
        run: |
          poetry build
      - name: Publish package distributions to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1