main.yml

# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: 'Main'

on:
  push:
    tags: ['*']
    branches: ['*']
  pull_request:
    branches: ['*']
  schedule:
    - cron: '25 12 * * 3'
  workflow_dispatch:

permissions: {}

jobs:

  build:
    name: 'Build on Python ${{ matrix.python_version }} on ${{ matrix.os }}'
    runs-on: '${{ matrix.os }}'
    permissions:
      contents: 'read'
    strategy:
      fail-fast: false
      matrix:
        python_version: ['3.x', '3.10', 'pypy3.10']
        os: ['ubuntu-latest', 'windows-latest', 'macos-latest']
    steps:
      - name: 'Checkout'
        uses: 'actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332'
      - name: 'Use Python ${{ matrix.python_version }}'
        uses: 'actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d'
        with:
          python-version: '${{ matrix.python_version }}'
          check-latest: true
          cache: 'pip'
          cache-dependency-path: |
            **/requirements.txt
            **/requirements-dev.txt
      - name: 'Build'
        run: 'make all'
      - name: 'Verify that the working tree is clean'
        shell: 'bash'
        run: '[ -z "$(git status --porcelain ./)" ] || { git diff >&2; exit 1; }'

  build-push-docker:
    name: 'Build and push Docker images'
    needs: ['build']
    runs-on: 'ubuntu-latest'
    permissions:
      contents: 'read'
      packages: 'write'
    steps:
      - name: 'Checkout'
        uses: 'actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332'
      - name: 'Set up QEMU'
        uses: 'docker/setup-qemu-action@5927c834f5b4fdf503fca6f4c7eccda82949e1ee'
      - name: 'Set up Docker Buildx'
        uses: 'docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb'
      - name: 'Login to GitHub Container Registry'
        if: "github.event_name != 'pull_request'"
        uses: 'docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446'
        with:
          registry: 'ghcr.io'
          username: '${{ github.actor }}'
          password: '${{ secrets.GITHUB_TOKEN }}'
      - name: 'Extract metadata'
        id: 'meta'
        uses: 'docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81'
        with:
          images: |
            ghcr.io/${{ github.repository }}
          tags: |
            type=ref,event=branch
            type=semver,pattern=v{{version}}
            type=semver,pattern=v{{major}}.{{minor}}
            type=semver,pattern=v{{major}}
      - name: 'Build and push'
        uses: 'docker/build-push-action@15560696de535e4014efeff63c48f16952e52dd1'
        with:
          context: './'
          platforms: 'linux/amd64,linux/arm64'
          tags: '${{ steps.meta.outputs.tags }}'
          labels: '${{ steps.meta.outputs.labels }}'
          push: "${{ github.event_name != 'pull_request' }}"

  publish-github-release:
    name: 'Publish GitHub release'
    if: "startsWith(github.ref, 'refs/tags/v')"
    needs: ['build', 'build-push-docker']
    runs-on: 'ubuntu-latest'
    permissions:
      contents: 'write'
    steps:
      - name: 'Publish'
        env:
          GITHUB_PAT: '${{ secrets.GITHUB_TOKEN }}'
        run: |
          RELEASE_STATUS="$(curl -fs --proto '=https' --tlsv1.3 --globoff \
            --url "https://api.github.com/repos/${GITHUB_REPOSITORY:?}/releases/tags/${GITHUB_REF_NAME:?}" \
            --header "Authorization: Bearer ${GITHUB_PAT:?}" \
            --header 'Accept: application/vnd.github.v3+json' \
            --header 'Content-Type: application/json' \
            --write-out '%{http_code}' --output /dev/null ||:)"
          if [ "${RELEASE_STATUS:?}" = '200' ]; then exit 0; fi
          RELEASE_ID="$(curl -fsS --proto '=https' --tlsv1.3 --globoff \
            --url "https://api.github.com/repos/${GITHUB_REPOSITORY:?}/releases" \
            --header "Authorization: Bearer ${GITHUB_PAT:?}" \
            --header 'Accept: application/vnd.github.v3+json' \
            --header 'Content-Type: application/json' \
            --data "$(jq -rn --arg tag "${GITHUB_REF_NAME:?}" '{"name": $tag, "tag_name": $tag, "generate_release_notes": true}')" | jq -r '.id')"
          if [ -z "${RELEASE_ID-}" ] || [ "${RELEASE_ID:?}" = 'null' ]; then exit 1; fi