ci.yml

name: CI

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: true

on: [push, pull_request]

env:
  FORCE_COLOR: 1

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-python@v4
        with:
          python-version: "3.x"

      - run: pipx run nox -s lint

  tests:
    name: Tests (${{ matrix.os }}, ${{ matrix.python-version }})
    runs-on: ${{ matrix.os }}-latest

    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.7", "3.8", "3.9", "3.10", "3.11", "3.12"]
        os: [Ubuntu, macOS, Windows]
        exclude:
          - os: "macOS"
            python-version: "3.7"  # Not available on latest MacOS images

    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-python@v4
        with:
          python-version: ${{ matrix.python-version }}-dev
          cache: pip
          cache-dependency-path: "dev-requirements.txt"

      - run: pipx run nox -s test-${{ matrix.python-version }}

  publish:
    name: Publish release
    runs-on: ubuntu-latest
    needs: tests
    environment: release
    permissions:
      id-token: write  # Needed for trusted publishing

    if: ${{ startsWith(github.ref, 'refs/tags/') }}

    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-python@v4
        with:
          python-version: "3.12"

      - run: |
          pip install build
          python -m build

      - name: Publish package distributions to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1