ci.yml

---
name: CI

on:  # yamllint disable-line rule:truthy
  push:
    branches:
      - main  # forward-compatibility with new GitHub default branch naming
      - master  # backward-compatibility with old GitHub default branch naming
  pull_request:
    branches:
      - main  # forward-compatibility with new GitHub default branch naming
      - master  # backward-compatibility with old GitHub default branch naming
  workflow_dispatch:

jobs:

  # Quality jobs ----------------------
  code-quality:
    strategy:
      matrix:
        python-version: ["3.11"]

    name: Code Quality
    runs-on: "ubuntu-latest"
    steps:
      - name: Check out the repository
        uses: actions/checkout@v3.0.2

      - name: Set up Python
        uses: actions/setup-python@v4.2.0
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install Poetry
        run: |
          pip install --constraint=.github/workflows/constraints.txt poetry
          poetry --version

      - name: Configure Poetry
        run: |
          poetry config cache-dir "${GITHUB_WORKSPACE}/.cache/pypoetry"
          poetry config virtualenvs.in-project true
          poetry config --list

      - name: Install Tox
        run: |
          pip install --constraint=.github/workflows/constraints.txt tox
          tox --version

      - name: Load cached tox testenv(s) (if they exist)
        id: cached-poetry-dependencies
        uses: actions/cache@v3.0.1
        with:
          path: |
            .tox
          key: tox-${{ github.workflow }}-${{ github.job }}-${{ runner.os }}-CPython${{ matrix.python-version }}-${{ hashFiles('**/poetry.lock') }}

      - name: Run static analysis
        run: |
          make pre-commit


  # Security jobs ----------------------
  dependency-security-vulnerability-analysis:
    strategy:
      matrix:
        python-version: ["3.11"]

    name: Dependency Security Vulnerability Analysis
    runs-on: "ubuntu-latest"
    steps:
      - name: Check out the repository
        uses: actions/checkout@v3.0.2

      - name: Set up Python
        uses: actions/setup-python@v4.2.0
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install Poetry
        run: |
          pip install --constraint=.github/workflows/constraints.txt poetry
          poetry --version

      - name: Configure Poetry
        run: |
          poetry config cache-dir "${GITHUB_WORKSPACE}/.cache/pypoetry"
          poetry config virtualenvs.in-project true
          poetry config --list

      - name: Install Tox
        run: |
          pip install --constraint=.github/workflows/constraints.txt tox
          tox --version

      - name: Load cached tox testenv(s) (if they exist)
        id: cached-poetry-dependencies
        uses: actions/cache@v3.0.1
        with:
          path: |
            .tox
          key: tox-${{ github.workflow }}-${{ github.job }}-${{ runner.os }}-CPython${{ matrix.python-version }}-${{ hashFiles('**/poetry.lock') }}


      - name: Run dependency security vulnerability analysis
        run: |
          make scan-dependencies


  # Code quality AND security job ----------------------
  semgrep:
    runs-on: ubuntu-latest
    name: Semgrep
    steps:
      - name: Check out the repository
        uses: actions/checkout@v3.0.2

      - name: Disable Git LFS
        run: |
          rm .git/hooks/post-checkout || true

      - name: Run Semgrep
        id: semgrep
        uses: returntocorp/semgrep-action@v1
        with:
          config: r/python

  # Tests jobs ------------------------
  test:
    strategy:
      matrix:
        os: ["ubuntu-latest", "windows-latest", "macos-latest"]
        python-version: ["3.8", "3.9", "3.10", "3.11"]

    name: Python ${{ matrix.python-version }} (${{ matrix.os }})
    runs-on: ${{ matrix.os }}

    env:
      USING_COVERAGE_OS: "ubuntu"
      USING_COVERAGE_PY_VER: "3.11"

    steps:
      - name: Check out the repository
        uses: actions/checkout@v3.0.2

      - name: Set up Python
        uses: actions/setup-python@v4.2.0
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install Poetry
        run: |
          pip install --constraint=.github/workflows/constraints.txt poetry
          poetry --version

      - name: Configure Poetry
        run: |
          poetry config cache-dir "${GITHUB_WORKSPACE}/.cache/pypoetry"
          poetry config virtualenvs.in-project true
          poetry config --list

      - name: Install Tox & Tox GH Actions Plugin
        run: |
          pip install --constraint=.github/workflows/constraints.txt tox tox-gh-actions
          tox --version


      - name: Load cached tox testenv(s) (if they exist)
        id: cached-poetry-dependencies
        uses: actions/cache@v3.0.1
        with:
          path: |
            .tox
          key: tox-${{ github.workflow }}-${{ github.job }}-${{ runner.os }}-CPython${{ matrix.python-version }}-${{ hashFiles('**/poetry.lock') }}


      - name: Run tox targets for ${{ matrix.python-version }}
        uses: nick-invision/retry@v2
        with:
          timeout_minutes: 10
          max_attempts: 3
          shell: bash
          command: |
            git fetch origin master:refs/remotes/origin/master
            make test

      - name: Upload coverage to Codecov
        if: "contains(matrix.os, env.USING_COVERAGE_OS) &&
             contains(matrix.python-version, env.USING_COVERAGE_PY_VER)"
        uses: "codecov/codecov-action@v3.1.0"
        with:
          file: ./.tox/coverage.xml
          fail_ci_if_error: true

  # Documentation build testing jobs ------------------------
  test-documentation-building:
    strategy:
      matrix:
        python-version: ["3.11"]

    name: Documentation build testing
    runs-on: "ubuntu-latest"
    steps:
      - name: Check out the repository
        uses: actions/checkout@v3.0.2

      - name: Set up Python
        uses: actions/setup-python@v4.2.0
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install Poetry
        run: |
          pip install --constraint=.github/workflows/constraints.txt poetry
          poetry --version

      - name: Configure Poetry
        run: |
          poetry config cache-dir "${GITHUB_WORKSPACE}/.cache/pypoetry"
          poetry config virtualenvs.in-project true
          poetry config --list

      - name: Load cached venv(s) (if they exist)
        id: cached-poetry-dependencies
        uses: actions/cache@v3.0.1
        with:
          path: |
            .venv
          key: venv-${{ runner.os }}-CPython${{ matrix.python-version }}-${{ hashFiles('**/poetry.lock') }}

      - name: Install dependencies
        run: |
          make install-dependencies

      - name: Install project
        run: |
          make install-project

      - name: Build Documentation
        run: |
          make docs-html \
            LAUNCH_DOCS_PREVIEW=false
  # Mutation testing jobs ------------------------
  test-mutations:
    strategy:
      matrix:
        python-version: ["3.10"]

    name: Mutation testing
    runs-on: "ubuntu-latest"

    steps:
      - name: Check out the repository
        uses: actions/checkout@v3.0.2
        with:
          lfs: true

      - name: Set up Python
        uses: actions/setup-python@v4.2.0
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install Poetry
        run: |
          pip install --constraint=.github/workflows/constraints.txt poetry
          poetry --version

      - name: Configure Poetry
        run: |
          poetry config cache-dir "${GITHUB_WORKSPACE}/.cache/pypoetry"
          poetry config virtualenvs.in-project true
          poetry config --list

      - name: Install Tox
        run: |
          pip install --constraint=.github/workflows/constraints.txt tox
          tox --version

      - name: Load cached tox testenv(s) (if they exist)
        id: cached-poetry-dependencies
        uses: actions/cache@v3.0.1
        with:
          path: |
            .tox
          key: tox-${{ github.workflow }}-${{ github.job }}-${{ runner.os }}-CPython${{ matrix.python-version }}-${{ hashFiles('**/poetry.lock') }}

      - name: Run mutation testing
        run: |
          make test-mutations