deploy.yml

name: deploy.yml

permissions:
  contents: read

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

concurrency:
  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref || github.ref }}
  cancel-in-progress: true

on:
  workflow_dispatch: {}

jobs:
  build_test:
    name: Build and test
    runs-on: ubuntu-latest
    environment: codecov
    permissions:
      contents: read
      issues: write  # Required for actions/github-script to create issues on test failure
    defaults:
      run:
        shell: bash

    steps:
      - name: Check out repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        id: setup_python
        with:
          python-version-file: '.python-version'

      - name: Create virtual environment
        run: python -m venv venv

      - name: Install Poetry
        run: |
          . venv/bin/activate
          pip install poetry==2.3.3

      - name: Install dependencies with Poetry
        run: |
          . venv/bin/activate
          poetry install --with dev
          poetry show -l

      - name: Check and fix with Ruff
        run: |
          . venv/bin/activate
          poetry run ruff check ./tests/*.py ./openseries/*.py --fix --exit-non-zero-on-fix

      - name: Format with Ruff
        run: |
          . venv/bin/activate
          poetry run ruff format

      - name: Type check with Mypy
        run: |
          . venv/bin/activate
          poetry run mypy .

      - name: Tests with Pytest
        id: pytest
        run: |
          . venv/bin/activate
          PYTHONPATH=${PWD} poetry run pytest

      - name: Create GitHub issue on failure
        if: ${{ failure() }}
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        env:
          GH_OWNER: ${{ github.repository_owner }}
          GH_REPO: ${{ github.event.repository.name }}
          GH_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        with:
          script: |
            const { GH_OWNER, GH_REPO, GH_RUN_URL } = process.env;
            await github.rest.issues.create({
              owner: GH_OWNER,
              repo: GH_REPO,
              title: `Tests failed on ${new Date().toDateString()}`,
              body: `See the full logs here: ${GH_RUN_URL}`,
            });

      - name: Upload test results to Codecov
        if: ${{ github.ref_name == 'master' && success() }}
        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          report_type: test_results
          files: junit.xml
          verbose: true

      - name: Upload coverage to Codecov
        if: ${{ github.ref_name == 'master' && success() }}
        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          slug: CaptorAB/openseries
          files: coverage.xml
          verbose: true

  version_tag:
    name: Create version tag
    needs: build_test
    if: ${{ needs.build_test.result == 'success' }}
    runs-on: ubuntu-latest
    environment: release
    permissions:
      contents: write  # Required for git push of signed tag
    defaults:
      run:
        shell: bash
    outputs:
      tag_version: ${{ steps.tag.outputs.tag_version }}

    steps:
      - name: Check out repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Configure git authentication for tag push
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REPO: ${{ github.repository }}
        run: |
          set -euo pipefail
          git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@github.com/${REPO}"

      - name: Import GPG key and create tag
        id: tag
        env:
          GPG_PRIVATE_KEY:    ${{ secrets.GPG_PRIVATE_KEY }}
          GITHUB_ACTOR_EMAIL: ${{ github.actor }}@users.noreply.github.com
        run: |
          set -euo pipefail
          export GNUPGHOME="$HOME/.gnupg"
          mkdir -p "$GNUPGHOME"; chmod 700 "$GNUPGHOME"
          printf 'allow-loopback-pinentry\n' > "$GNUPGHOME/gpg-agent.conf"
          gpgconf --kill gpg-agent || true
          echo "$GPG_PRIVATE_KEY" | gpg --batch --yes --pinentry-mode loopback --import
          FPR="$(gpg --list-secret-keys --with-colons | awk -F: '/^fpr:/ {print $10; exit}')"
          echo "${FPR}:6:" | gpg --import-ownertrust
          git config --global user.name  "${GITHUB_ACTOR}"
          git config --global user.email "${GITHUB_ACTOR_EMAIL}"
          git config --global user.signingkey "$FPR"
          cat > "$HOME/gpg-nopass.sh" <<'EOF'
          #!/usr/bin/env bash
          exec gpg --batch --yes --no-tty --pinentry-mode loopback "$@"
          EOF
          chmod +x "$HOME/gpg-nopass.sh"
          git config --global gpg.program "$HOME/gpg-nopass.sh"
          echo ok > /tmp/_ok
          "$HOME/gpg-nopass.sh" -u "$FPR" --detach-sign -o /tmp/_ok.sig /tmp/_ok
          version=$(grep -oPm1 '(?<=version = ").*(?=")' pyproject.toml)
          echo "Version: $version"
          git tag -s "$version" -m "Release v$version"
          git verify-tag "$version"
          git push origin "$version"
          echo "tag_version=$version" >> "$GITHUB_OUTPUT"

  release:
    name: Create GitHub release
    needs: version_tag
    if: ${{ needs.version_tag.result == 'success' }}
    runs-on: ubuntu-latest
    permissions:
      contents: write  # Required for gh release create
    steps:
      - name: Check out repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Create GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG_VERSION: ${{ needs.version_tag.outputs.tag_version }}
        run: gh release create "$TAG_VERSION" --generate-notes

  build_dist:
    name: Build distributions
    needs: release
    if: ${{ needs.release.result == 'success' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
    defaults:
      run:
        shell: bash
    steps:
      - name: Check out repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version-file: '.python-version'

      - name: Build distributions (sdist + wheel)
        run: |
          python -m venv venv
          . venv/bin/activate
          pip install poetry==2.3.3
          poetry build
          poetry check

      - name: Upload dist artifacts
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: dist
          path: dist/*
          if-no-files-found: error

  publish_testpypi:
    name: Publish to TestPyPI
    needs: build_dist
    if: ${{ needs.build_dist.result == 'success' }}
    runs-on: ubuntu-latest
    environment:
      name: testpypi
      url: https://test.pypi.org/project/openseries/
    permissions:
      contents: read
      id-token: write  # Required for pypa/gh-action-pypi-publish OIDC trusted publishing
    steps:
      - name: Download dist artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: dist
          path: dist

      - name: Publish distributions to TestPyPI (OIDC)
        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
        with:
          repository-url: https://test.pypi.org/legacy/
          skip-existing: true

  publish_pypi:
    name: Publish to PyPI
    needs: publish_testpypi
    if: ${{ needs.publish_testpypi.result == 'success' }}
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/project/openseries/
    permissions:
      contents: read
      id-token: write  # Required for pypa/gh-action-pypi-publish OIDC trusted publishing
    steps:
      - name: Download dist artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: dist
          path: dist

      - name: Publish distributions to PyPI (OIDC)
        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
        with:
          skip-existing: true

  trigger_docs_update:
    name: Trigger documentation update
    needs: publish_pypi
    if: ${{ needs.publish_pypi.result == 'success' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
      actions: write  # Required for actions.createWorkflowDispatch to trigger docs workflow
    steps:
      - name: Trigger documentation update
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          script: |
            await github.rest.actions.createWorkflowDispatch({
              owner: context.repo.owner,
              repo: context.repo.repo,
              workflow_id: 'docs.yml',
              ref: 'master'
            });
            console.log('Documentation update workflow triggered');