code.yml

name: Code CI

on:
  push:
  pull_request:
  schedule:
    # Run weekly to check latest versions of dependencies
    - cron: "0 8 * * WED"
env:
  CONTAINER_PYTHON: '3.10'
  DIST_WHEEL_PATH: dist-${{ github.sha }}

jobs:
  lint:
    # pull requests are a duplicate of a branch push if within the same repo.
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository
    runs-on: ubuntu-latest

    steps:
      - name: Checkout nexgen
        uses: actions/checkout@v4
      
      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.10'
          architecture: x64

      - name: Install python packages
        uses: ./.github/actions/install_requirements
        with:
          requirements_file: requirements-dev-3.x.txt
          install_options: -e .[dev]
          python_version: '3.10'
          artifact_name: lint

      - name: Install ruff
        run: pip install ruff

      - name: Run ruff
        run: ruff check .

  test:
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository
    strategy:
      fail-fast: false
      matrix:
        os: ["ubuntu-latest"] # can add windows-latest, macos-latest
        python: ["3.11", "3.12"]
        install: ["-e .[dev]"]
        # Make one version be non-editable to test both paths of version code
        include:
          - os: "ubuntu-latest"
            python: "3.10"
            install: ".[dev]"

    runs-on: ${{ matrix.os }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          # Need this to get version number from last tag
          fetch-depth: 0

      - name: Install python packages
        uses: ./.github/actions/install_requirements
        with:
          python_version: ${{ matrix.python }}
          requirements_file: requirements-test-${{ matrix.os }}-${{ matrix.python }}.txt
          install_options: ${{ matrix.install }}
          artifact_name: tests

      - name: List dependency tree
        run: pipdeptree

      - name: Run tests
        run: pytest

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v3
        # env:
        #   CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        with:
          name: ${{ matrix.python }}/${{ matrix.os }}
          files: cov.xml

  dist:
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository
    runs-on: "ubuntu-latest"

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          # Need this to get version number from last tag
          fetch-depth: 0

      - name: Build sdist and wheel
        run: |
          export SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct) && \
          pipx run build

      - name: Upload sdist and wheel as artifacts
        uses: actions/upload-artifact@v4.3.3
        with:
          name: ${{ env.DIST_WHEEL_PATH }}
          path: dist

      - name: Check for packaging errors
        run: pipx run twine check --strict dist/*

      - name: Install python packages
        uses: ./.github/actions/install_requirements
        with:
          python_version: '3.10'
          requirements_file: requirements.txt
          install_options: dist/*.whl
          artifact_name: dist

      - name: Test module --version works using the installed wheel
        # If more than one module in src/ replace with module name to test
        run: python -m nexgen --version

  release:
    # upload to PyPI and make a release on every tag
    needs: [lint, dist, test]
    if: ${{ github.event_name == 'push' && github.ref_type == 'tag' }}
    runs-on: ubuntu-latest
    env:
      HAS_PYPI_TOKEN: ${{ secrets.PYPI_TOKEN != '' }}

    environment:
      name: pypi
      url: https://pypi.org/p/nexgen

    steps:
      - name: Download wheel and lockfiles
        uses: actions/download-artifact@v4.1.7
        with:
          pattern: "*dist*"

      - name: Rename lockfiles and dist
        run: |
          mv lockfiles-${{ env.CONTAINER_PYTHON }}-dist-${{ github.sha }} lockfiles
          mv ${{ env.DIST_WHEEL_PATH }} dist

      - name: Fixup blank lockfiles
        # Github release artifacts can't be blank
        run: for f in lockfiles/*; do [ -s $f ] || echo '# No requirements' >> $f; done

      - name: Github Release
        # We pin to the SHA, not the tag, for security reasons.
        # https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#using-third-party-actions
        uses: softprops/action-gh-release@9d7c94cfd0a1f3ed45544c887983e9fa900f0564 # v0.1.15
        with:
          prerelease: ${{ contains(github.ref_name, 'a') || contains(github.ref_name, 'b') || contains(github.ref_name, 'rc') }}
          files: |
            dist/*
            lockfiles/*
          generate_release_notes: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Publish to PyPI
        if: ${{ env.HAS_PYPI_TOKEN }}
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          password: ${{ secrets.PYPI_TOKEN }}