ci.yml

name: ci

on:
  push:
  pull_request:
    branches:
      - main
      - develop

concurrency:
  group: test-${{ github.ref_name }}
  cancel-in-progress: true

env:
  PYTHONUNBUFFERED: "1"
  FORCE_COLOR: "1"

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      -
        uses: actions/checkout@v3
      -
        name: Set up Python 3.10
        uses: actions/setup-python@v4
        with:
          python-version: '3.10'
          cache: 'pip'
      -
        name: Install Hatch
        run: |
          pip3 --quiet install --upgrade hatch
      -
        name: Lint project
        run: |
          hatch run lint:all
      -
        name: Check files with pre-commit
        uses: pre-commit/action@v3.0.0
  test:
    name: Python ${{ matrix.python-version }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
    needs:
      - lint
    strategy:
      fail-fast: false
      matrix:
        # No pikepdf wheels for pypy3.8
        python-version: ['3.8', '3.9', '3.10', '3.11', '3.12', 'pypy3.9']

    steps:
    -
      uses: actions/checkout@v3
    -
      name: Start containers
      run: |
        docker compose --file ${GITHUB_WORKSPACE}/.docker/docker-compose.ci-test.yml pull --quiet
        docker compose --file ${GITHUB_WORKSPACE}/.docker/docker-compose.ci-test.yml up --detach
        echo "Wait for container to be started"
        sleep 5
    -
      name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@v4
      with:
        python-version: ${{ matrix.python-version }}
        cache: 'pip'
    -
      name: Install Hatch
      run: pip install --upgrade hatch
    -
      name: Run tests
      run: hatch run cov
    -
      name: Upload coverage to Codecov
      if: matrix.python-version == '3.10'
      uses: codecov/codecov-action@v3
      with:
        # not required for public repos, but intermittently fails otherwise
        token: ${{ secrets.CODECOV_TOKEN }}
    -
      name: Stop containers
      if: always()
      run: |
        docker compose --file ${GITHUB_WORKSPACE}/.docker/docker-compose.ci-test.yml logs
        docker compose --file ${GITHUB_WORKSPACE}/.docker/docker-compose.ci-test.yml down

  build:
    name: Build
    runs-on: ubuntu-latest
    permissions:
      contents: read
    needs:
      - lint
    steps:
      -
        uses: actions/checkout@v3
      -
        name: Set up Python 3.10
        uses: actions/setup-python@v4
        with:
          python-version: '3.10'
          cache: 'pip'
      -
        name: Install Hatch
        run: |
          pip3 --quiet install --upgrade hatch
      -
        name: Build
        run: |
          hatch build --clean
      -
        uses: actions/upload-artifact@v3
        with:
            name: artifacts
            path: dist/*
            if-no-files-found: error
            retention-days: 7

  create-release:
    name: Release
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    permissions:
      contents: write
    needs:
      - build
      - test
    steps:
      -
        uses: actions/checkout@v3
      -
        uses: actions/download-artifact@v3
        with:
          name: artifacts
          path: dist
      -
        name: Get latest release info
        id: query-release-info
        uses: release-flow/keep-a-changelog-action@v2
        with:
          command: query
          version: ${{ github.ref_name }}
      -
        name: Display release info
        run: |
          echo "Version: ${{ steps.query-release-info.outputs.version }}"
          echo "Date: ${{ steps.query-release-info.outputs.release-date }}"
          echo "${{ steps.query-release-info.outputs.release-notes }}"
      -
        uses: ncipollo/release-action@v1
        with:
          artifacts: "dist/*.tar.gz,dist/*.whl"
          body: ${{ steps.query-release-info.outputs.release-notes }}

  pypi-publish:
    name: Publish
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    permissions:
      id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
    needs:
      - build
      - test
    steps:
      -
        uses: actions/download-artifact@v3
        with:
          name: artifacts
          path: dist
      -
        name: Publish build to PyPI
        uses: pypa/gh-action-pypi-publish@v1.8.10