ci.yaml

# Resources and recipes:
# * <https://docs.github.com/en/actions>
# * <https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/>
# * <https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python>
# * <https://github.com/hynek/build-and-inspect-python-package>
# * <https://docs.github.com/en/actions/sharing-automations/avoiding-duplication>

name: ci

on:
    push:
        # This is tricky to get right.
        # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#onpushbranchestagsbranches-ignoretags-ignore
        branches:
            - master
        # Run also on release tags.
        tags:
            - "v[0-9]+.[0-9]+.[0-9]+"
    workflow_dispatch:

concurrency:
    group: ${{ github.workflow }}-${{ github.ref }}
    cancel-in-progress: true

env:
    FORCE_COLOR: "1" # Make tools pretty.

jobs:
    build:
        name: Build and verify package
        runs-on: ubuntu-latest
        steps:
            - name: Checkout source code
              uses: actions/checkout@v4
              with:
                  fetch-depth: 0

            - name: Build and inspect Python package
              uses: hynek/build-and-inspect-python-package@v2
              id: baipp

    test:
        name: Test
        needs: build
        runs-on: ubuntu-latest
        steps:
            - name: Checkout source code
              uses: actions/checkout@v4

            # https://docs.astral.sh/uv/guides/integration/github/
            - name: Setup uv
              uses: astral-sh/setup-uv@v4

            - name: Test package
              run: uvx nox

            - name: Upload coverage reports to Codecov
              uses: codecov/codecov-action@v5.1.1
              with:
                  token: ${{ secrets.CODECOV_TOKEN }}
                  fail_ci_if_error: true

    publish-to-testpypi:
        name: Publish to TestPyPI
        needs: test
        runs-on: ubuntu-latest
        environment:
            name: TestPyPI
            url: https://test.pypi.org/p/gsffile
        permissions:
            id-token: write # IMPORTANT: mandatory for trusted publishing

        steps:
            - name: Download the dists
              uses: actions/download-artifact@v4
              with:
                  name: Packages
                  path: dist/

            - name: Publish to TestPyPI
              uses: pypa/gh-action-pypi-publish@release/v1
              with:
                  repository-url: https://test.pypi.org/legacy/

    publish-to-pypi:
        name: Publish to PyPI
        # Only publish to PyPI on release tags.
        needs: test
        if: startsWith(github.ref, 'refs/tags/v')
        runs-on: ubuntu-latest
        environment:
            name: PyPI
            url: https://pypi.org/p/gsffile
        permissions:
            id-token: write

        steps:
            - name: Download the dists
              uses: actions/download-artifact@v4
              with:
                  name: Packages
                  path: dist/

            - name: Publish to PyPI
              uses: pypa/gh-action-pypi-publish@release/v1

    github-release:
        name: GitHub release
        needs:
            - publish-to-pypi
        runs-on: ubuntu-latest

        permissions:
            contents: write # IMPORTANT: mandatory for making GitHub Releases

        steps:
            - name: Download the dists
              uses: actions/download-artifact@v4
              with:
                  name: Packages
                  path: dist/

            - name: Create GitHub Release
              env:
                  GITHUB_TOKEN: ${{ github.token }}
              run: >-
                  gh release create
                  '${{ github.ref_name }}'
                  --repo '${{ github.repository }}'
                  --notes ""

            - name: Upload artifact signatures to GitHub Release
              env:
                  GITHUB_TOKEN: ${{ github.token }}
              run: >-
                  gh release upload
                  '${{ github.ref_name }}' dist/**
                  --repo '${{ github.repository }}'