main.yml

name: main

on:
  pull_request:
    branches:
      - '*'
  push:
    branches:
      - main
    tags:
      - '*'

jobs:

  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install UV
        uses: astral-sh/setup-uv@v2
        with:
          version: "latest"
          enable-cache: true

      - name: Install Python 3.11
        run: uv python install 3.11

      - name: Run Ruff + Safety
        run: |
          uv tool run ruff check .
          uv tool run safety check -i 42240,66963,70612,65213

  test:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:13
        env:
          POSTGRES_DB: portail_test
          POSTGRES_USER: portail_dev_limited_rw
          POSTGRES_PASSWORD: portail_psswd
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U testuser"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis

      - name: Install UV
        uses: astral-sh/setup-uv@v4
        with:
          version: "latest"
          enable-cache: true

      - name: Install Python 3.11 and deps
        run: uv python install 3.11

      - name: Install system deps
        run: |
          sudo apt-get update && sudo apt-get -y install gcc libkrb5-dev
          sudo locale-gen fr_FR.utf8
          sudo update-locale 

      - name: Install dependencies
        run: uv sync

      - name: Set up log dir and DB config
        run: |
          mkdir log
          echo "DATABASE_URL=postgres://portail_dev_limited_rw:portail_psswd@localhost:5432/portail_test" >> $GITHUB_ENV

      - name: Run Django migrations
        run: |
          cp .conf/.test.env admin_cohort/.env
          uv run python manage.py migrate

      - name: Run tests
        run: |
          uv run coverage run --source='.' --omit="*/test*","*/migrations/*" manage.py test
          uv run coverage xml --omit="*/test*","*/migrations/*" -o coverage.xml
      - name: Upload coverage report
        uses: actions/upload-artifact@v4
        with:
          name: coverage-report
          path: coverage.xml

  sonar:
    needs: test
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
      - name: Download coverage report
        uses: actions/download-artifact@v4
        with:
          name: coverage-report
      - name: SonarCloud Scan
        uses: sonarsource/sonarqube-scan-action@v4
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  publish:
    if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')
    needs: test
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Retrieve version
        run: |
          VERSION=$(grep '^version =' pyproject.toml | sed -E 's/version = "(.*)"/\1/')
          echo "VERSION=$VERSION" >> $GITHUB_ENV

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to DockerHub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Build and push Docker image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./Dockerfile
          push: true
          tags: ${{ github.ref == 'refs/heads/main' && format('aphpid/cohort360-backend:{0},aphpid/cohort360-backend:latest',env.VERSION) || format('aphpid/cohort360-backend:{0}',env.VERSION) }}