verify.yml

name: Verify

on:
  push:
    branches:
      - main
  pull_request:
  workflow_dispatch:

jobs:
  snyk:
    runs-on: ubuntu-latest
    name: Snyk
    permissions:
      contents: read
      actions: read
      security-events: write
      statuses: write
    strategy:
      max-parallel: 4
      matrix:
        python-version: ["3.11"]
        poetry-version: [1.7.1]

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
      - name: Set up Poetry ${{ matrix.poetry-version }}
        uses: abatilo/actions-poetry@v2
        with:
          poetry-version: ${{ matrix.poetry-version }}
      - name: Set up Snyk
        uses: snyk/actions/setup@master

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          poetry install

      - name: Run Snyk
        continue-on-error: true
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        run: |
          snyk monitor
          snyk test --package-manager=poetry --fail-on=all --severity-threshold=medium --remote-repo-url=${{ github.server_url }}/${{ github.repository }} --sarif-file-output=snyk.sarif

      - name: Upload to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: snyk.sarif

  test:
    runs-on: ubuntu-latest
    name: Check the Codebase
    strategy:
      max-parallel: 4
      matrix:
        python-version: ["3.11"]
        poetry-version: [1.7.1]

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
      - name: Set up Poetry ${{ matrix.poetry-version }}
        uses: abatilo/actions-poetry@v2
        with:
          poetry-version: ${{ matrix.poetry-version }}

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          poetry install

      - name: Lint files
        run: |
          poetry check
          poetry run ruff check .

      - name: Run tests
        run: |
          poetry run pytest
          poetry run coverage xml

      - name: Coveralls
        uses: coverallsapp/github-action@v2
        with:
          file: coverage.xml

  build:
    runs-on: ubuntu-latest
    name: Build
    strategy:
      max-parallel: 4
      matrix:
        python-version: ["3.11"]

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install build

      - name: Build a binary wheel and a source tarball
        run: |
          python -m build