ci.yml

# Run all tests, linters, code analysis and other QA tasks on
# every push to main and PRs.
#
# To SSH into the runner to debug a failure, add the following step before
# the failing step
#    - uses: lhotari/action-upterm@v1
#      with:
#        limit-access-to-actor: true

name: CI

on:
  workflow_dispatch:
  pull_request:
  push:
    branches:
      - main
    tags:
      - '*'


# Prevent multiple jobs running after fast subsequent pushes
concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:

  pure_tests:
    name: Pure Tests

    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: cachix/install-nix-action@v22
      - uses: cachix/cachix-action@v12
        with:
          name: niteo-public
          authToken: '${{ secrets.CACHIX_AUTH_TOKEN_PUBLIC }}'

      - name: Run linters and unit tests the Nix way
        run: |
          nix flake check
          nix run .#impure-checks

  impure_tests:
    name: Impure Tests

    strategy:
      matrix:
        python-version: ["3.9", "3.10", "3.11"]

    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v4
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install Poetry
        uses: snok/install-poetry@v1


      - name: Install Poetry environment
        env:
          PYTHON: python${{ matrix.python-version }}
        run: |
          poetry env use $PYTHON
          poetry install

      - name: Install test dependencies
        run: sudo apt-get -y install nmap

      - name: Run linters and unit tests the Poetry way
        run: |
          # make lint -> pre-commit-config.yaml is managed by Nix,
          # so path entries won't work in Poetry env
          source $(poetry env info --path)/bin/activate
          make types
          make unit
          make tesh

      - uses: cachix/install-nix-action@v22

      - name: Run 'make examples'
        run: poetry run tesh examples/

  release:
    name: Release
    needs: [pure_tests, impure_tests]

    # To test publishing to testpypi:
    # * comment out "verify git tag matches pyproject.toml version"
    # * uncomment "with: repository-url: https://test.pypi.org/legacy/"

    if:
      github.event_name == 'push' && startsWith(github.ref, 'refs/tags')

    runs-on: ubuntu-latest
    environment: release
    permissions:
      id-token: write

    steps:
      - uses: actions/checkout@v3
      - uses: cachix/install-nix-action@v22
      - uses: cachix/cachix-action@v12
        with:
          name: niteo-public
          authToken: '${{ secrets.CACHIX_AUTH_TOKEN_PUBLIC }}'

      - name: Verify git tag matches pyproject.toml version

        run: |
          GIT_VERSION=$GITHUB_REF_NAME
          POETRY_VERSION=`nix-shell --run "poetry version --short"`

          echo $GIT_VERSION
          echo $POETRY_VERSION

          [[ "$GIT_VERSION" == "$POETRY_VERSION" ]] && exit 0 || exit 1


      - name: Build tesh wheel
        run: |
          nix-shell --run "poetry build"

      - name: Upload wheel to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        # with:
        #   repository-url: https://test.pypi.org/legacy/