tests.yml

name: Tests

on:
  - push
  - pull_request

permissions:
  contents: write
  checks: write
  pull-requests: write

jobs:
  tests:
    name: ${{ matrix.session }} ${{ matrix.python }} / ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - { python: "3.12", os: "ubuntu-latest", session: "pre-commit" }
          - { python: "3.12", os: "ubuntu-latest", session: "safety" }
          - { python: "3.12", os: "ubuntu-latest", session: "mypy" }
          - { python: "3.12", os: "ubuntu-latest", session: "tests" }
          - { python: "3.12", os: "ubuntu-latest", session: "typeguard" }

    env:
      NOXSESSION: ${{ matrix.session }}
      FORCE_COLOR: "1"
      PRE_COMMIT_COLOR: "always"

    steps:
      - name: Check out the repository
        uses: actions/checkout@v4

      - name: Set up Python ${{ matrix.python }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python }}

      - name: Install tools using pip
        # github.workspace is a workaround for https://github.com/pypa/pipx/issues/1331
        # which was fixed in https://github.com/pypa/pipx/pull/1390
        # but has not been released as of 2024-08-04
        run: |
          pip install --constraint=${{ github.workspace }}/.github/workflows/constraints.txt pip
          pipx install --pip-args=--constraint=${{ github.workspace }}/.github/workflows/constraints.txt nox
          pipx inject --pip-args=--constraint=${{ github.workspace }}/.github/workflows/constraints.txt nox nox-poetry
          pipx install --pip-args=--constraint=${{ github.workspace }}/.github/workflows/constraints.txt poetry

      - name: Compute pre-commit cache key
        if: matrix.session == 'pre-commit'
        id: pre-commit-cache
        shell: python
        run: |
          import hashlib
          import sys

          python = "py{}.{}".format(*sys.version_info[:2])
          payload = sys.version.encode() + sys.executable.encode()
          digest = hashlib.sha256(payload).hexdigest()
          result = "${{ runner.os }}-{}-{}-pre-commit".format(python, digest[:8])

          print("::set-output name=result::{}".format(result))

      - name: Restore pre-commit cache
        uses: actions/cache@v3
        if: matrix.session == 'pre-commit'
        with:
          path: ~/.cache/pre-commit
          key: ${{ steps.pre-commit-cache.outputs.result }}-${{ hashFiles('.pre-commit-config.yaml') }}
          restore-keys: |
            ${{ steps.pre-commit-cache.outputs.result }}-

      - name: Run Nox
        run: |
          nox --python=${{ matrix.python }}

      - name: Upload coverage data
        if: always() && matrix.session == 'tests'
        uses: actions/upload-artifact@v4
        with:
          name: coverage-data
          path: |
            coverage.xml
            pytest.xml
            htmlcov
            pytest.html
            .coverage.*

      - name: Upload documentation
        if: matrix.session == 'docs-build'
        uses: actions/upload-artifact@v4
        with:
          name: docs
          path: docs/_build

  coverage:
    runs-on: ubuntu-latest
    needs: tests
    steps:
      - name: Check out the repository
        uses: actions/checkout@v4

      - name: Download coverage data
        uses: actions/download-artifact@v4
        with:
          name: coverage-data

      - name: List workspace
        run: ls -la

      - name: Pytest coverage comment
        uses: MishaKav/pytest-coverage-comment@v1.1.52
        with:
          pytest-xml-coverage-path: ./coverage.xml
          junitxml-path: ./pytest.xml

  docker:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
    steps:
      - uses: actions/checkout@v3
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2
      - name: Login to GHCR
        run: echo "${{secrets.GITHUB_TOKEN}}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
      - name: Docker Build
        uses: docker/build-push-action@v4
        with:
          context: .
          platforms: linux/amd64
          push: true
          sbom: true
          labels: |
            org.opencontainers.image.url=https://github.com/${{ github.repository }}
            org.opencontainers.image.source=https://github.com/${{ github.repository }}
            org.opencontainers.image.version=${{ github.ref_name }}
            org.opencontainers.image.revision=${{ github.sha }}
          tags: |
            ghcr.io/${{ github.repository }}:${{ github.sha }}