ci.yml

# Run all tests, linters, code analysis and other QA tasks on
# every push to main and PRs.
#
# To SSH into the runner to debug a failure, add the following step before
# the failing step
#    - uses: lhotari/action-upterm@v1
#      with:
#        limit-access-to-actor: true

name: CI

on:
  workflow_dispatch:
  pull_request:
  push:
    branches:
      - main
    tags:
      - '*'


# Prevent multiple jobs running after fast subsequent pushes
concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:

  tests:
    name: Tests

    strategy:
      matrix:
        python: ["python3.9", "python3.10", "python3.11"]
        runner: ["ubuntu-latest", "macos-13"]
        include:
          - runner: "ubuntu-latest"
            arch: "x86_64-linux"
          - runner: "macos-13"
            arch: "x86_64-darwin"

    runs-on: ${{ matrix.runner }}
    steps:
      - name: Convert matrix python version to nix python version
        run: echo "PYTHON=$(echo ${{ matrix.python }} | tr -d .)" >> $GITHUB_ENV

      - uses: actions/checkout@v3
      - uses: cachix/install-nix-action@v22
      - uses: cachix/cachix-action@v12
        with:
          name: oceansprint
          authToken: '${{ secrets.CACHIX_AUTH_TOKEN_PUBLIC }}'

      - name: Run linters and unit tests the Nix way
        run: |
          nix build .#checks.${{ matrix.arch }}.ci-$(echo $PYTHON)

  docker_linux:
    name: Docker on Linux

    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Build Docker image with nix env for tesh development
        run: docker build -t tesh .

      - name: Start a container
        run: docker run -d --rm -v .:/tesh --name tesh -it tesh

      - name: Make git happy so that pre-commit checks in `make lint` work
        run: docker exec tesh git config --global --add safe.directory /tesh

      - name: Run all tests
        run: docker exec tesh nix develop -c make tests

  docker_macos:
    name: Docker on macOS

    runs-on: macos-13
    steps:
      - uses: actions/checkout@v3

      - name: Install & start Docker
        run: |
          brew install docker colima
          colima start

      - name: Build Docker image with nix env for tesh development
        run: docker build -t tesh .

      - name: Start a container
        run: docker run -d --rm -v .:/tesh --name tesh -it tesh

      - name: Make git happy so that pre-commit checks in `make lint` work
        run: docker exec tesh git config --global --add safe.directory /tesh

      - name: Run all tests
        run: docker exec tesh nix develop -c make tests

  release:
    name: Release
    needs: tests

    # To test publishing to testpypi:
    # * comment out "verify git tag matches pyproject.toml version"
    # * uncomment "with: repository-url: https://test.pypi.org/legacy/"

    if:
      github.event_name == 'push' && startsWith(github.ref, 'refs/tags')

    runs-on: ubuntu-latest
    environment: release
    permissions:
      id-token: write

    steps:
      - uses: actions/checkout@v3
      - uses: cachix/install-nix-action@v22
      - uses: cachix/cachix-action@v12
        with:
          name: oceansprint
          authToken: '${{ secrets.CACHIX_AUTH_TOKEN_PUBLIC }}'

      - name: Verify git tag matches pyproject.toml version
        run: |
          GIT_VERSION=$GITHUB_REF_NAME

          nix develop -c bash -c "poetry version --short > poetry_version.txt"
          POETRY_VERSION=`cat poetry_version.txt`

          echo $GIT_VERSION
          echo $POETRY_VERSION

          [[ "$GIT_VERSION" == "$POETRY_VERSION" ]] && exit 0 || exit 1


      - name: Build tesh wheel
        run: |
          nix develop -c poetry build

      - name: Upload wheel to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        # with:
        #   repository-url: https://test.pypi.org/legacy/