ci.yml

---
name: CI

on:  # yamllint disable-line rule:truthy
  push:
    branches:
      - main  # forward-compatibility with new GitHub default branch naming
      - master  # backward-compatibility with old GitHub default branch naming
  pull_request:
    branches:
      - main  # forward-compatibility with new GitHub default branch naming
      - master  # backward-compatibility with old GitHub default branch naming
  workflow_dispatch:

jobs:

  # Quality jobs ----------------------

  code-quality:
    name: Code Quality
    runs-on: "ubuntu-latest"
    steps:
      - name: Check out the repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5.0.0
        with:
          python-version: "3.10"

      - name: Install Poetry
        run: |
          pip install --constraint=.github/workflows/constraints.txt poetry
          poetry --version

      - name: Configure Poetry
        run: |
          poetry config cache-dir "${GITHUB_WORKSPACE}/.cache/pypoetry"
          poetry config virtualenvs.in-project true
          poetry config --list

      - name: Install Tox
        run: |
          pip install --constraint=.github/workflows/constraints.txt tox
          tox --version

      - name: Load cached tox testenv(s) (if they exist)
        id: cached-poetry-dependencies
        uses: actions/cache@v4
        with:
          path: |
            .tox
          key: tox-${{ github.workflow }}-${{ github.job }}-${{ runner.os }}-CPython${{ matrix.python-version }}-${{ hashFiles('**/poetry.lock') }}


      - name: Install Go for pre-commit hook (shfmt)
        run: |
          GO_TAR=go1.16.linux-amd64.tar.gz && \
          wget --quiet https://golang.org/dl/$GO_TAR && \
          sudo tar -C /usr/local -xzf $GO_TAR && \
          rm $GO_TAR && \
          export GO111MODULE=on && \
          export CGO_ENABLED=0 && \
          export GOOS=linux && \
          export GOARCH=amd64 && \
          sudo ln -sf /usr/local/go/bin/go /usr/bin/go

      - name: Run static analysis
        run: |
          make pre-commit || true

  # Security jobs ----------------------

  dependency-security-vulnerability-analysis:
    name: Dependency Security Vulnerability Analysis
    runs-on: "ubuntu-latest"
    steps:
      - name: Check out the repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5.0.0
        with:
          python-version: "3.10"

      - name: Install Poetry
        run: |
          pip install --constraint=.github/workflows/constraints.txt poetry
          poetry --version

      - name: Configure Poetry
        run: |
          poetry config cache-dir "${GITHUB_WORKSPACE}/.cache/pypoetry"
          poetry config virtualenvs.in-project true
          poetry config --list

      - name: Install Tox
        run: |
          pip install --constraint=.github/workflows/constraints.txt tox
          tox --version

      - name: Load cached tox testenv(s) (if they exist)
        id: cached-poetry-dependencies
        uses: actions/cache@v4
        with:
          path: |
            .tox
          key: tox-${{ github.workflow }}-${{ github.job }}-${{ runner.os }}-CPython${{ matrix.python-version }}-${{ hashFiles('**/poetry.lock') }}


      - name: Run dependency security vulnerability analysis
        run: |
          make scan-dependencies

  # Code quality AND security job ----------------------

  semgrep:
    runs-on: ubuntu-latest
    name: Semgrep
    steps:
      - name: Check out the repository
        uses: actions/checkout@v4

      - name: Disable Git LFS
        run: |
          rm .git/hooks/post-checkout || true

      - name: Run Semgrep
        id: semgrep
        uses: returntocorp/semgrep-action@v1
        with:
          config: r/python

  # Tests jobs ------------------------

  test:
    strategy:
      matrix:
        os: ["ubuntu-latest", "macos-latest"]
        python-version: ["3.10"]

    name: Python ${{ matrix.python-version }} (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    env:
      USING_COVERAGE_OS: "ubuntu"
      USING_COVERAGE_PY_VER: "3.10"

    steps:
      - name: Check out the repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5.0.0
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install Poetry
        run: |
          pip install --constraint=.github/workflows/constraints.txt poetry
          poetry --version

      - name: Configure Poetry
        run: |
          poetry config cache-dir "${GITHUB_WORKSPACE}/.cache/pypoetry"
          poetry config virtualenvs.in-project true
          poetry config --list

      - name: Install Tox & Tox GH Actions Plugin
        run: |
          pip install --constraint=.github/workflows/constraints.txt tox tox-gh-actions
          tox --version


      - name: Load cached tox testenv(s) (if they exist)
        id: cached-poetry-dependencies
        uses: actions/cache@v4
        with:
          path: |
            .tox
          key: tox-${{ github.workflow }}-${{ github.job }}-${{ runner.os }}-CPython${{ matrix.python-version }}-${{ hashFiles('**/poetry.lock') }}


      - name: Run tox targets for ${{ matrix.python-version }}
        run: |
          git fetch origin master:refs/remotes/origin/master
          make test

      - name: Upload coverage to Codecov
        if: "contains(matrix.os, env.USING_COVERAGE_OS) &&
             contains(matrix.python-version, env.USING_COVERAGE_PY_VER)"
        uses: "codecov/codecov-action@v3.1.1"
        with:
          file: ./.tox/coverage.xml
          token: ${{ secrets.CODECOV_TOKEN }}
          fail_ci_if_error: true

  # Documentation build testing jobs ------------------------
  test-documentation-building:
    strategy:
      matrix:
        python-version: ["3.10"]

    name: Documentation build testing
    runs-on: "ubuntu-latest"
    steps:
      - name: Check out the repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5.0.0
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install Poetry
        run: |
          pip install --constraint=.github/workflows/constraints.txt poetry
          poetry --version

      - name: Configure Poetry
        run: |
          poetry config cache-dir "${GITHUB_WORKSPACE}/.cache/pypoetry"
          poetry config virtualenvs.in-project true
          poetry config --list

      - name: Load cached venv(s) (if they exist)
        id: cached-poetry-dependencies
        uses: actions/cache@v4
        with:
          path: |
            .venv
          key: venv-${{ runner.os }}-CPython${{ matrix.python-version }}-${{ hashFiles('**/poetry.lock') }}

      - name: Install dependencies
        if: steps.cached-poetry-dependencies.outputs.cache-hit != 'true'
        run: |
          make install-dependencies

      - name: Install project
        run: |
          make install-project

      - name: Build Documentation
        run: |
          make docs-html \
            LAUNCH_DOCS_PREVIEW=false