.tests-and-publish-python.yml

name: Python CI

on:
  push:
    paths-ignore: ['docs/**', 'docsrc/**', 'docker/**', 'fittrackee_client/**', '*.md']
  pull_request:
    paths-ignore: ['docs/**', 'docsrc/**', 'docker/**', 'fittrackee_client/**', '*.md']
    types: [opened, synchronize, reopened]

env:
  APP_SETTINGS: fittrackee.config.TestingConfig
  DATABASE_TEST_URL: "postgresql://fittrackee:fittrackee@postgres:5432/fittrackee_test"
  EMAIL_URL: "smtp://none:none@0.0.0.0:1025"
  FLASK_APP: fittrackee/__main__.py
  SENDER_EMAIL: fittrackee@example.com
  UI_URL: https://0.0.0.0:5000
  GITHUB_REGISTRY: ghcr.io
  GITHUB_IMAGE_NAME: ${{ github.repository }}

jobs:
  python:
    if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.fork }}
    name: python ${{ matrix.python-version }} (postgresql 17)
    runs-on: ubuntu-latest
    container: python:${{ matrix.python-version }}
    services:
      postgres:
        image: postgres:17
        env:
          POSTGRES_PASSWORD: postgres
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    strategy:
      matrix:
        python-version:  [ "3.9", "3.10", "3.11", "3.12", "3.13" ]
    steps:

      - uses: actions/checkout@v4

      - name: Install Poetry and Dependencies
        run: |
          python -m pip install --upgrade pip
          pip install --quiet poetry
          poetry config virtualenvs.create false
          poetry install --no-interaction --quiet

      - name: Create test databases
        run: python db/create_ci_test_db.py

      - name: Bandit
        if: matrix.python-version == '3.13'
        run: bandit -r fittrackee -c pyproject.toml

      - name: Lint
        if: matrix.python-version == '3.13'
        run: ruff check fittrackee e2e

      - name: Mypy
        if: matrix.python-version == '3.13'
        run: mypy fittrackee

      - name: Pytest
        run: pytest fittrackee -n auto --maxprocesses=2  -p no:warnings --cov fittrackee --cov-report term-missing --maxfail=1

  postgresql:
    if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.fork }}
    name: postgresql ${{ matrix.psql-version }} (python 3.13)
    runs-on: ubuntu-latest
    container: python:3.13
    services:
      postgres:
        image: postgres:${{ matrix.psql-version }}
        env:
          POSTGRES_PASSWORD: postgres
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    strategy:
      matrix:
        psql-version:  [ "12", "13", "14", "15", "16" ]
    steps:

      - uses: actions/checkout@v4

      - name: Install Poetry and Dependencies
        run: |
          python -m pip install --upgrade pip
          pip install --quiet poetry
          poetry config virtualenvs.create false
          poetry install --no-interaction --quiet

      - name: Create test databases
        run: python db/create_ci_test_db.py

      - name: Pytest
        run: pytest fittrackee -n auto --maxprocesses=2 -p no:warnings --cov fittrackee --cov-report term-missing --maxfail=1

  end2end:
    if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.fork }}
    name: e2e tests with sources
    runs-on: ubuntu-latest
    needs: ["python"]
    container: python:3.13
    services:
      postgres:
        image: postgres:17
        env:
          POSTGRES_DB: fittrackee_test
          POSTGRES_USER: fittrackee
          POSTGRES_PASSWORD: fittrackee
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
      selenium:
        image: selenium/standalone-firefox
      mailhog:
        image: mailhog/mailhog:latest
      redis:
        image: redis:latest
    env:
      APP_SETTINGS: fittrackee.config.End2EndTestingConfig
      EMAIL_URL: "smtp://mailhog:1025"
      REDIS_URL: "redis://redis:6379"
    steps:

      - uses: actions/checkout@v4

      - name: Install Poetry and Dependencies
        run: |
          python -m pip install --upgrade pip
          pip install --quiet poetry
          poetry config virtualenvs.create false
          poetry install --no-interaction --quiet

      - name: Run migrations
        run: flask db upgrade --directory fittrackee/migrations

      - name: Start application and run tests with Selenium
        run: |
          setsid nohup flask run --with-threads -h 0.0.0.0 -p 5000 >> nohup.out 2>&1 &
          export TEST_APP_URL=http://$(hostname --ip-address):5000
          sleep 5
          nohup flask worker --processes=1 >> nohup.out 2>&1 &
          pytest e2e --driver Remote --capability browserName firefox --selenium-host selenium --selenium-port 4444 --maxfail=1

  build_package:
    needs: ["python"]
    runs-on: ubuntu-latest
    steps:

    - uses: actions/checkout@v4
      with:
        persist-credentials: false

    - name: Use Node.js 23.x
      uses: actions/setup-node@v4
      with:
        node-version: 23.x

    - name: Install yarn and dependencies
      working-directory: fittrackee_client
      run: |
        npm install --global yarn
        yarn install

    - name: Build dist files
      working-directory: fittrackee_client
      run: yarn build

    - name: Set up Python 3.13
      uses: actions/setup-python@v5
      with:
        python-version: 3.13

    - name: Install poetry
      run: >-
        python3 -m
        pip install
        poetry
        --user

    - name: Build a binary wheel and a source tarball
      run: poetry build

    - name: Store the distribution packages
      uses: actions/upload-artifact@v4
      with:
        name: python-package-distributions
        path: dist/
        retention-days: 5

  end2end_package:
    if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.fork }}
    name: e2e tests with package
    needs: ["build_package"]
    uses: ./.github/workflows/.e2e-tests.yml

  end2end_package_update:
    if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.fork }}
    name: e2e tests after FitTrackee update
    needs: ["build_package"]
    uses: ./.github/workflows/.e2e-tests.yml
    with:
      previous-version: true

  publish-to-pypi:
    if: github.repository == 'SamR1/FitTrackee' && startsWith(github.ref, 'refs/tags/v')
    name: Publish Python distribution to PyPI
    needs: ["end2end", "end2end_package", "end2end_package_update"]
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/p/fittrackee
    permissions:
      id-token: write

    steps:
    - name: Download all the dists
      uses: actions/download-artifact@v4
      with:
        name: python-package-distributions
        path: dist/

    - name: Publish distribution to PyPI
      uses: pypa/gh-action-pypi-publish@release/v1

  github-release:
    if: github.repository == 'SamR1/FitTrackee' && startsWith(github.ref, 'refs/tags/v')
    name: Upload distribution to GitHub Release
    needs: ["publish-to-pypi"]
    runs-on: ubuntu-latest

    permissions:
      contents: write
      id-token: write

    steps:
    - name: Download all the dists
      uses: actions/download-artifact@v4
      with:
        name: python-package-distributions
        path: dist/

    - name: Sign the dists with Sigstore
      uses: sigstore/gh-action-sigstore-python@v3.0.0
      with:
        inputs: >-
          ./dist/*.tar.gz
          ./dist/*.whl

    - name: Create GitHub draft release
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: >-
        gh release create
        "$GITHUB_REF_NAME"
        --repo "$GITHUB_REPOSITORY"
        --draft
        --notes "wip"

    - name: Upload artifact signatures to GitHub Release
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: >-
        gh release upload
        "$GITHUB_REF_NAME" dist/**
        --repo "$GITHUB_REPOSITORY"

  push_to_registries:
    if: github.repository == 'SamR1/FitTrackee' && startsWith(github.ref, 'refs/tags/v')
    name: Push Docker image to multiple registries
    needs: ["end2end", "end2end_package", "end2end_package_update"]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      attestations: write
      id-token: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.GITHUB_REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            fittrackee/fittrackee
            ${{ env.GITHUB_REGISTRY }}/${{ env.GITHUB_IMAGE_NAME}}
          tags: |
            type=pep440,pattern={{version}},prefix=v

      - name: Build and push Docker images
        id: push
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

      - name: Generate artifact attestation
        uses: actions/attest-build-provenance@v2
        with:
          subject-name: ${{ env.GITHUB_REGISTRY }}/${{ env.GITHUB_IMAGE_NAME}}
          subject-digest: ${{ steps.push.outputs.digest }}
          push-to-registry: true