main.yml

name: ci

on:
  pull_request:
  push:
    branches-ignore:    
      - 'dependabot/**'
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+'

permissions:
  contents: read
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: mhils/workflows/checkout@v11
      - uses: mhils/workflows/setup-python@v11
      - uses: mhils/workflows/setup-uv@v11
      - run: uv run tox -e lint

  old-dependencies:
    runs-on: ubuntu-latest
    steps:
      - uses: mhils/workflows/checkout@v11
      - uses: mhils/workflows/setup-python@v11
      - uses: mhils/workflows/setup-uv@v11
      - run: uv run tox -e old-dependencies

  test:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: windows-latest
            py: 3.13.0
            args: --cov-fail-under=100
          - os: macos-latest
            py: 3.13.0
            args: --cov-fail-under=100
          - os: ubuntu-latest
            py: 3.13.0
            args: --cov-fail-under=100
          - os: ubuntu-latest
            py: 3.12.4
          - os: ubuntu-latest
            py: 3.11.5
          - os: ubuntu-latest
            py: 3.10.13
          - os: ubuntu-latest
            py: 3.9.18
    runs-on: ${{ matrix.os }}
    steps:
      - uses: mhils/workflows/checkout@v11
      - uses: mhils/workflows/setup-python@v11
        with:
          python-version: ${{ matrix.py }}
      - uses: mhils/workflows/setup-uv@main
      - run: uv run tox -e py -- -vvv ${{ matrix.args }}

  build:
    uses: mhils/workflows/.github/workflows/python-build.yml@v11
    permissions:
      contents: read
      id-token: write
      attestations: write

  attest:
    needs: build
    if: github.event_name != 'pull_request'
    permissions:
      contents: read
      id-token: write
      attestations: write
    runs-on: ubuntu-latest
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: wheels
          path: dist/
      - uses: actions/attest-build-provenance@v1
        with:
          subject-path: 'dist/*'

  check:
    if: always()
    needs:
    - lint
    - test
    - build
    - attest
    uses: mhils/workflows/.github/workflows/alls-green.yml@v11
    with:
      jobs: ${{ toJSON(needs) }}
      allowed-skips: '["attest"]'

  deploy:
    uses: mhils/workflows/.github/workflows/python-deploy.yml@v11
    with:
      artifact-name: wheels
    needs: check
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
    secrets:
      password: ${{ secrets.TWINE_PASSWORD }}