wipac-cicd.yml

name: wipac ci/cd

on: [push]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  # don't cancel on main/master/default
  cancel-in-progress: ${{ format('refs/heads/{0}', github.event.repository.default_branch) != github.ref }}


jobs:

  py-versions:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.versions.outputs.matrix }}
    steps:
      - uses: actions/checkout@v3
      - id: versions
        uses: WIPACrepo/wipac-dev-py-versions-action@v2.1


  flake8:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-python@v4
      - uses: WIPACrepo/wipac-dev-flake8-action@v1.0


  mypy:
    needs: [py-versions]
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        py3: ${{ fromJSON(needs.py-versions.outputs.matrix) }}
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-python@v4
        with:
          python-version: ${{ matrix.py3 }}
      - uses: WIPACrepo/wipac-dev-mypy-action@v2.0


  py-setup:
    runs-on: ubuntu-latest
    steps:
      # dependabot can't access normal secrets
      #   & don't run non-branch triggers (like tags)
      #   & we don't want to trigger an update on PR's merge to main/master/default (which is a branch)
      # IOW: only for non-dependabot branches
      - if: |
          github.actor != 'dependabot[bot]' &&
          github.ref_type == 'branch' &&
          format('refs/heads/{0}', github.event.repository.default_branch) != github.ref
        name: checkout (only for non-dependabot non-default branches)
        uses: actions/checkout@v3
        with:
          token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
      - if: |
          github.actor != 'dependabot[bot]' &&
          github.ref_type == 'branch' &&
          format('refs/heads/{0}', github.event.repository.default_branch) != github.ref
        name: wipac-dev-py-setup-action (only for non-dependabot non-default branches)
        uses: WIPACrepo/wipac-dev-py-setup-action@dockerfile-user-perm-fix
        with:
          base-keywords: "WIPAC IceCube"


  unit-tests:
    needs: [py-versions]
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        py3: ${{ fromJSON(needs.py-versions.outputs.matrix) }}
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-python@v3
        with:
          python-version: ${{ matrix.py3 }}
      - name: run
        run: |
          pip install --upgrade pip wheel setuptools
          pip install .[tests]
          cp resources/dummy_client_secrets.json client_secrets.json
          pytest -vvv tests/unit


  test-build-docker:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: docker/setup-buildx-action@v2
      - uses: docker/build-push-action@v3
        with:
          context: .
          cache-from: type=gha
          cache-to: type=gha,mode=min
          file: Dockerfile
          tags: moudash:local


  integration-tests:
    needs: [test-build-docker]
    runs-on: ubuntu-latest
    services:
      mongo:
        image: mongo:3
        ports:
        - 27017:27017
    steps:
      - uses: actions/checkout@v3
      - uses: docker/setup-buildx-action@v2
      - uses: docker/build-push-action@v3
        with:
          context: .
          cache-from: type=gha
          # cache-to: type=gha,mode=min
          file: Dockerfile
          tags: moudash:local
          load: true

      - name: run
        run: |
          export CI_TEST_ENV=true

          # rest server (background)
          docker run --network="host" --rm -i --name rest \
              --env CI_TEST_ENV=true \
              moudash:local \
              python -m rest_server \
              &

          sleep 30
          pip install pytest wipac-rest-tools
          pytest -vvv tests/integration

      - name: dump rest logs
        if: always()
        run: |
          docker logs rest || true

      - name: dump mongo logs
        if: always()
        run: |
          docker logs mongo || true


  release:
    # only run on main/master/default
    if: format('refs/heads/{0}', github.event.repository.default_branch) == github.ref
    needs: [flake8, mypy, py-setup, unit-tests, integration-tests]
    runs-on: ubuntu-latest
    concurrency: release
    steps:
    - uses: actions/checkout@v3
      with:
        fetch-depth: 0
        token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
    - name: Python Semantic Release
      uses: python-semantic-release/python-semantic-release@v7.34.6
      with:
        github_token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
        # repository_username: __token__
        # repository_password: ${{ secrets.PYPI_TOKEN }}