python-package.yml

# This workflow will install Python dependencies, run tests and lint with a variety of Python versions
# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python

name: build

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]

permissions:
  contents: read

jobs:
  prepare:
    runs-on: ubuntu-latest
    outputs:
      package: ${{ steps.pkg.outputs.package }}
      pypi_url: ${{ steps.pkg.outputs.pypi_url }}
    steps:
      - name: Compute package name from the repository's
        id: pkg
        run: |
          name="${GITHUB_REPOSITORY##*/}"
          echo "package=${name#python-}" >> $GITHUB_OUTPUT
          echo "pypi_url=https://pypi.org/p/${name#python-}" >> $GITHUB_OUTPUT
  build:
    needs: prepare
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest]
        python-version: ["3.10", "3.11", "3.12", "3.13"]
    env:
      package: ${{ needs.prepare.outputs.package }}
      cov_python_version: "3.13"
    steps:
    - uses: actions/checkout@v7
    - name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@v7
      with:
        python-version: ${{ matrix.python-version }}
    - name: Install ${{ env.package }}
      run: |
        python -m pip install --upgrade pip
        python -m pip install pytest pytest-cov
        pip install -r requirements.txt
        pip install "tinyscript>=1.31"
        pip install .[bcrypt]
    - name: Test ${{ env.package }} with pytest
      run: |
        pytest --cov=$package --cov-report=xml
    - name: Upload coverage report
      if: matrix.python-version == env.cov_python_version
      uses: actions/upload-artifact@v7
      with:
        name: coverage-report
        path: coverage.xml
  coverage:
    # only publish the badge for commits on main (not for pull requests)
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    needs: build
    permissions:
      contents: write
    runs-on: ubuntu-latest
    env:
      cov_badge_path: docs/coverage.svg
    steps:
    - uses: actions/checkout@v7
    - name: Set up Python
      uses: actions/setup-python@v7
      with:
        python-version: "3.13"
    - name: Download coverage report
      uses: actions/download-artifact@v8
      with:
        name: coverage-report
    - name: Make coverage badge
      run: |
        pip install genbadge[coverage]
        genbadge coverage -i coverage.xml -o $cov_badge_path
    - name: Push coverage badge
      run: |
        # keep the badge alone on an orphan branch so that main is never modified by the workflow
        git config --local user.email "github-actions[bot]@users.noreply.github.com"
        git config --local user.name "github-actions[bot]"
        if git fetch --depth=1 origin coverage-badge 2>/dev/null && \
           git show FETCH_HEAD:$cov_badge_path | cmp -s - $cov_badge_path; then
          echo "Coverage badge unchanged"
          exit 0
        fi
        git checkout --orphan coverage-badge
        git rm -rqf --cached .
        git add $cov_badge_path
        git commit -m "Update coverage badge"
        git push origin coverage-badge --force
  deploy:
    # only release from main, never from pull requests
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    environment:
      name: pypi
      url: ${{ needs.prepare.outputs.pypi_url }}
    permissions:
      contents: read
      id-token: write  # for PyPI trusted publishing (OIDC)
    runs-on: ubuntu-latest
    needs: [prepare, build]
    env:
      package: ${{ needs.prepare.outputs.package }}
    steps:
    - uses: actions/checkout@v7
    - name: Check whether the version is already on PyPI
      # comparing with PyPI (not with the previous commit) also releases a version whose push did not trigger a deploy
      id: version
      run: |
        version=$(tr -d '[:space:]' < src/$package/VERSION.txt)
        status=$(curl -s -o /dev/null -w '%{http_code}' --retry 3 "https://pypi.org/pypi/$package/$version/json")
        case "$status" in
          200) echo "Version $version is already on PyPI" ; echo "new=false" >> "$GITHUB_OUTPUT" ;;
          404) echo "Version $version is not on PyPI yet" ; echo "new=true" >> "$GITHUB_OUTPUT" ;;
          *)   echo "::error::Unexpected HTTP status $status from PyPI" ; exit 1 ;;
        esac
    - if: steps.version.outputs.new == 'true'
      name: Set up Python
      uses: actions/setup-python@v7
      with:
        python-version: "3.13"
    - if: steps.version.outputs.new == 'true'
      name: Cleanup README
      run: |
        sed -ri 's/^(##*)\s*:.*:\s*/\1 /g' README.md
        awk '{if (match($0,"## Supporters")) exit; print}' README.md > README
        mv -f README README.md
    - if: steps.version.outputs.new == 'true'
      name: Build ${{ needs.prepare.outputs.package }} package
      run: python -m pip install --upgrade build && python -m build
    - if: steps.version.outputs.new == 'true'
      name: Publish to PyPI
      uses: pypa/gh-action-pypi-publish@release/v1