ci.yaml

name: CI

on:
  merge_group:
  pull_request:
  push:
    # We need to explicitly include tags because otherwise when adding
    # `branches-ignore` it will only trigger on branches.
    tags:
      - '*'
    branches-ignore:
      # Ignore pushes to merge queues.
      # We only want to test the merge commit (`merge_group` event), the hashes
      # in the push were already tested by the PR checks
      - 'gh-readonly-queue/**'
      - 'dependabot/**'
  workflow_dispatch:

env:
  # Please make sure this version is included in the `matrix`, as the
  # `matrix` section can't use `env`, so it must be entered manually
  DEFAULT_PYTHON_VERSION: '3.11'
  # It would be nice to be able to also define a DEFAULT_UBUNTU_VERSION
  # but sadly `env` can't be used either in `runs-on`.

jobs:
  protolint:
    name: Check proto files with protolint
    runs-on: ubuntu-20.04

    steps:
      - name: Fetch sources
        uses: actions/checkout@v3
        with:
          submodules: true

      - name: Run protolint
        # Only use hashes here, as we are passing the github token, we want to
        # make sure updates are done consciously to avoid security issues if the
        # action repo gets hacked
        uses: yoheimuta/action-protolint@e94cc01b1ad085ed9427098442f66f2519c723eb # v1.0.0
        with:
          fail_on_error: true
          filter_mode: nofilter
          github_token: ${{ secrets.github_token }}
          protolint_flags: proto/
          protolint_version: "0.45.0"
          reporter: github-check

  nox:
    name: Test with nox
    strategy:
      fail-fast: false
      matrix:
        os:
          - ubuntu-20.04
        python:
          - "3.11"
        nox-session:
          # To speed things up a bit we use the special ci_checks_max session
          # that uses the same venv to run multiple linting sessions
          - "ci_checks_max"
          - "pytest_min"
    runs-on: ${{ matrix.os }}

    steps:
      - name: Print environment (debug)
        run: env

      - name: Fetch sources
        uses: actions/checkout@v4
        with:
          submodules: true

      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: ${{ matrix.python }}
          cache: 'pip'

      - name: Install required Python packages
        run: |
          python -m pip install --upgrade pip
          python -m pip install -e .[dev-noxfile]
          pip freeze

      - name: Create nox venv
        env:
          NOX_SESSION: ${{ matrix.nox-session }}
        run: nox --install-only -e "$NOX_SESSION"

      - name: Print pip freeze for nox venv (debug)
        env:
          NOX_SESSION: ${{ matrix.nox-session }}
        run: |
          . ".nox/$NOX_SESSION/bin/activate"
          pip freeze
          deactivate

      - name: Run nox
        env:
          NOX_SESSION: ${{ matrix.nox-session }}
        run: nox -R -e "$NOX_SESSION"
        timeout-minutes: 10

  # This job runs if all the `nox` matrix jobs ran and succeeded.
  # It is only used to have a single job that we can require in branch
  # protection rules, so we don't have to update the protection rules each time
  # we add or remove a job from the matrix.
  nox-all:
    # The job name should match the name of the `nox` job.
    name: Test with nox
    needs: ["nox"]
    runs-on: ubuntu-20.04
    steps:
      - name: Return true
        run: "true"

  build:
    name: Build distribution packages
    runs-on: ubuntu-20.04
    steps:
      - name: Fetch sources
        uses: actions/checkout@v4
        with:
          submodules: true

      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
          cache: 'pip'

      - name: Install required Python packages
        run: |
          python -m pip install -U pip
          python -m pip install -U build
          pip freeze

      - name: Build the source and binary distribution
        run: python -m build

      - name: Upload distribution files
        uses: actions/upload-artifact@v3
        with:
          name: dist-packages
          path: dist/
          if-no-files-found: error

  test-installation:
    name: Test package installation in different architectures
    needs: ["build"]
    runs-on: ubuntu-20.04
    steps:
      - name: Fetch sources
        uses: actions/checkout@v4
      - name: Download package
        uses: actions/download-artifact@v3
        with:
          name: dist-packages
          path: dist
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      - name: Set up docker-buildx
        uses: docker/setup-buildx-action@v3
      - name: Test Installation
        uses: docker/build-push-action@v5
        with:
          context: .
          file: .github/containers/test-installation/Dockerfile
          platforms: linux/amd64,linux/arm64
          tags: localhost/test-installation
          push: false

  test-docs:
    name: Test documentation website generation
    if: github.event_name != 'push'
    runs-on: ubuntu-20.04
    steps:
      - name: Fetch sources
        uses: actions/checkout@v4
        with:
          submodules: true

      - name: Setup Git user and e-mail
        uses: frequenz-floss/setup-git-user@v2

      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
          cache: 'pip'

      - name: Install build dependencies
        run: |
          python -m pip install -U pip
          python -m pip install .[dev-mkdocs]
          pip freeze

      - name: Generate the documentation
        env:
          MIKE_VERSION: gh-${{ github.job }}
        run: |
          mike deploy $MIKE_VERSION
          mike set-default $MIKE_VERSION

      - name: Upload site
        uses: actions/upload-artifact@v3
        with:
          name: docs-site
          path: site/
          if-no-files-found: error

  publish-docs:
    name: Publish documentation website to GitHub pages
    needs: ["nox-all", "test-installation", "protolint"]
    if: github.event_name == 'push'
    runs-on: ubuntu-20.04
    permissions:
      contents: write
    steps:
      - name: Fetch sources
        uses: actions/checkout@v4
        with:
          submodules: true

      - name: Setup Git user and e-mail
        uses: frequenz-floss/setup-git-user@v2

      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
          cache: 'pip'

      - name: Install build dependencies
        run: |
          python -m pip install -U pip
          python -m pip install .[dev-mkdocs]
          pip freeze

      - name: Calculate and check version
        id: mike-version
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_REPO: ${{ github.repository }}
          GIT_REF: ${{ github.ref }}
          GIT_SHA: ${{ github.sha }}
        run: |
          python -m frequenz.repo.config.cli.version.mike.info

      - name: Fetch the gh-pages branch
        if: steps.mike-version.outputs.version
        run: git fetch origin gh-pages --depth=1

      - name: Build site
        if: steps.mike-version.outputs.version
        env:
          VERSION: ${{ steps.mike-version.outputs.version }}
          TITLE: ${{ steps.mike-version.outputs.title }}
          ALIASES: ${{ steps.mike-version.outputs.aliases }}
          # This is not ideal, we need to define all these variables here
          # because we need to calculate all the repository version information
          # to be able to show the correct versions in the documentation when
          # building it.
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_REPO: ${{ github.repository }}
          GIT_REF: ${{ github.ref }}
          GIT_SHA: ${{ github.sha }}
        run: |
          mike deploy --update-aliases --title "$TITLE" "$VERSION" $ALIASES

      - name: Sort site versions
        if: steps.mike-version.outputs.version
        run: |
          git checkout gh-pages
          python -m frequenz.repo.config.cli.version.mike.sort versions.json
          git commit -a -m "Sort versions.json"

      - name: Publish site
        if: steps.mike-version.outputs.version
        run: |
          git push origin gh-pages

  create-github-release:
    name: Create GitHub release
    needs: ["publish-docs"]
    # Create a release only on tags creation
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    permissions:
      # We need write permissions on contents to create GitHub releases and on
      # discussions to create the release announcement in the discussion forums
      contents: write
      discussions: write
    runs-on: ubuntu-20.04
    steps:
      - name: Download distribution files
        uses: actions/download-artifact@v3
        with:
          name: dist-packages
          path: dist

      - name: Download RELEASE_NOTES.md
        run: |
          set -ux
          gh api \
              -X GET \
              -f ref=$REF \
              -H "Accept: application/vnd.github.raw" \
              "/repos/$REPOSITORY/contents/RELEASE_NOTES.md" \
            > RELEASE_NOTES.md
        env:
          REF: ${{ github.ref }}
          REPOSITORY: ${{ github.repository }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Create GitHub release
        run: |
          set -ux
          extra_opts=
          if echo "$REF_NAME" | grep -- -; then extra_opts=" --prerelease"; fi
          gh release create \
            -R "$REPOSITORY" \
            --notes-file RELEASE_NOTES.md \
            --generate-notes \
            $extra_opts \
            $REF_NAME \
            dist/*
        env:
          REF_NAME: ${{ github.ref_name }}
          REPOSITORY: ${{ github.repository }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  publish-to-pypi:
    name: Publish packages to PyPI
    needs: ["create-github-release"]
    runs-on: ubuntu-20.04
    permissions:
      # For trusted publishing. See:
      # https://blog.pypi.org/posts/2023-04-20-introducing-trusted-publishers/
      id-token: write
    steps:
      - name: Download distribution files
        uses: actions/download-artifact@v3
        with:
          name: dist-packages
          path: dist

      - name: Publish the Python distribution to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1