tox.yml

---
name: tox
on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: true

env:
  FORCE_COLOR: 1 # tox, pytest
  PY_COLORS: 1

jobs:
  prepare:
    name: prepare
    runs-on: ubuntu-24.04
    outputs:
      matrix: ${{ steps.generate_matrix.outputs.matrix }}
    steps:
      - name: Determine matrix
        id: generate_matrix
        uses: coactions/dynamic-matrix@v3
        with:
          min_python: "3.9"
          max_python: "3.12"
          default_python: "3.9"
          other_names: |
            lint
            docs
            pkg
            py39:tox -e py39 --notest
            py310:tox -e py310 --notest
            py311:tox -e py311 --notest
            py312:tox -e py312 --notest
            py39-macos:tox -e py312 --notest
            py312-macos:tox -e py312 --notest
          # ^ macos is also used to validate arm64 building
          platforms: linux,macos
          skip_explode: "1"
  build:
    name: ${{ matrix.name }}
    runs-on: ${{ matrix.os || 'ubuntu-24.04' }}
    needs:
      - prepare
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.prepare.outputs.matrix) }}
    steps:

      - name: Install package dependencies (ubuntu)
        if: ${{ contains(matrix.os, 'ubuntu') }}
        run: |
          sudo apt remove -y docker-compose
          sudo apt-get update -y
          sudo apt-get --assume-yes --no-install-recommends install -y apt-transport-https curl libkrb5-dev

      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # needed by setuptools-scm
          submodules: true

      - name: Set pre-commit cache
        uses: actions/cache@v4
        if: ${{ contains(matrix.name, 'lint') }}
        with:
          path: |
            ~/.cache/pre-commit
          key: pre-commit-${{ matrix.name }}-${{ hashFiles('.pre-commit-config.yaml') }}

      - name: Set up Python ${{ matrix.python_version || '3.10' }}
        uses: actions/setup-python@v5
        with:
          cache: pip
          python-version: ${{ matrix.python_version || '3.10' }}
          cache-dependency-path: "*requirements*.txt"

      - name: Install tox
        run: |
          python3 -m pip install --upgrade pip wheel tox

      - run: ${{ matrix.command }}

      - run: ${{ matrix.command2 }}
        if: ${{ matrix.command2 }}

      - run: ${{ matrix.command3 }}
        if: ${{ matrix.command3 }}

      - run: ${{ matrix.command4 }}
        if: ${{ matrix.command4 }}

      - run: ${{ matrix.command5 }}
        if: ${{ matrix.command5 }}

      - name: Archive logs
        uses: actions/upload-artifact@v4
        with:
          name: logs-${{ matrix.name }}.zip
          if-no-files-found: error
          path: |
            .tox/**/log/
            .tox/**/coverage.xml

      - name: Report failure if git reports dirty status
        run: |
          if [[ -n $(git status -s) ]]; then
            # shellcheck disable=SC2016
            echo -n '::error file=git-status::'
            printf '### Failed as git reported modified and/or untracked files\n```\n%s\n```\n' "$(git status -s)" | tee -a "$GITHUB_STEP_SUMMARY"
            exit 99
          fi
        # https://github.com/actions/toolkit/issues/193
  check:
    if: always()
    environment: check
    permissions:
      id-token: write
      checks: read

    needs:
      - build

    runs-on: ubuntu-24.04

    steps:
      # checkout needed for codecov action which needs codecov.yml file
      - uses: actions/checkout@v4

      - name: Set up Python # likely needed for coverage
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - run: pip3 install 'coverage>=7.5.1'

      - name: Merge logs into a single archive
        uses: actions/upload-artifact/merge@v4
        with:
          name: logs.zip
          pattern: logs-*.zip
          # artifacts like py312.zip and py312-macos do have overlapping files
          separate-directories: true

      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          name: logs.zip
          path: .

      - name: Check for expected number of coverage.xml reports
        run: |
          JOBS_PRODUCING_COVERAGE=0
          if [ "$(find . -name coverage.xml | wc -l | bc)" -ne "${JOBS_PRODUCING_COVERAGE}" ]; then
            echo "::error::Number of coverage.xml files was not the expected one (${JOBS_PRODUCING_COVERAGE}): $(find . -name coverage.xml |xargs echo)"
            exit 1
          fi

      # Single uploads inside check job for codecov to allow use to retry
      # it when it fails without running tests again. Fails often enough!
      - name: Upload junit xml reports
        # PRs from forks might not have access to the secret
        if: env.CODECOV_TOKEN
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN || env.CODECOV_TOKEN }}
        uses: codecov/test-results-action@v1
        with:
          name: ${{ matrix.name }}
          files: "*/tests/output/junit/*.xml"
          fail_ci_if_error: true
          token: ${{ secrets.CODECOV_TOKEN }}

      - name: Upload coverage data
        uses: codecov/codecov-action@v4
        with:
          name: ${{ matrix.name }}
          # verbose: true # optional (default = false)
          fail_ci_if_error: false
          use_oidc: true # cspell:ignore oidc
          files: "*/tests/output/reports/coverage.xml"

      # - name: Check codecov.io status
      #   if: github.event_name == 'pull_request'
      #   uses: coactions/codecov-status@main

      - name: Decide whether the needed jobs succeeded or failed
        uses: re-actors/alls-green@release/v1
        with:
          jobs: ${{ toJSON(needs) }}

      - name: Delete Merged Artifacts
        uses: actions/upload-artifact/merge@v4
        with:
          delete-merged: true