tests.yml

name: Tests

on:
  # https://docs.github.com/en/webhooks-and-events/webhooks/webhook-events-and-payloads#push
  push:
    branches:
      - main
      - feature/**
      - '[0-9].*.x'  # e.g., 1.3.x

  # https://docs.github.com/en/webhooks-and-events/webhooks/webhook-events-and-payloads#pull_request
  pull_request:

  # https://docs.github.com/en/webhooks-and-events/webhooks/webhook-events-and-payloads#workflow_dispatch
  workflow_dispatch:

concurrency:
  # Concurrency group that uses the workflow name and PR number if available
  # or commit SHA as a fallback. If a new build is triggered under that
  # concurrency group while a previous build is running it will be canceled.
  # Repeated pushes to a PR will cancel all previous builds, while multiple
  # merges to main will not cancel.
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: true

jobs:
  # test suite
  tests:
    runs-on: ${{ matrix.runner }}
    defaults:
      run:
        shell: bash -l {0}
    strategy:
      fail-fast: false
      matrix:
        runner: [ubuntu-latest, macos-13, windows-latest]
        python-version: ['3.8', '3.9', '3.10', '3.11']

    steps:
      - name: Checkout repository
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Timestamp
        run: echo "TIMESTAMP=$(date -u "+%Y%m")" >> $GITHUB_ENV
        shell: bash

      - name: Cache conda
        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
        with:
          path: ~/conda_pkgs_dir
          key: ${{ runner.os }}-conda-content-trust-${{ env.TIMESTAMP }}

      - name: Setup miniconda
        uses: conda-incubator/setup-miniconda@a4260408e20b96e80095f42ff7f1a15b27dd94ca # v3.0.4
        with:
          python-version: ${{ matrix.python-version }}

      - name: Setup environment
        run: |
          conda install -q -y -c defaults \
            --file ./tests/requirements.txt
          gpg --import tests/testdata/test_key_*

      - name: Show info
        run: |
          conda info -a
          conda list --show-channel-urls

      - name: Run tests
        run: pytest --cov=conda_content_trust

      - name: Upload coverage
        uses: codecov/codecov-action@5ecb98a3c6b747ed38dc09f787459979aebb39be # v4.3.1
        with:
          flags: ${{ matrix.python-version }},${{ runner.os }}

  # canary builds
  build:
    name: Canary Build
    needs: [tests]
    # only build canary build if
    # - prior steps succeeded,
    # - this is the main repo, and
    # - we are on the main, feature, or release branch
    if: >-
      always()
      && !github.event.repository.fork
      && (
        github.ref_name == 'main'
        || startsWith(github.ref_name, 'feature/')
        || endsWith(github.ref_name, '.x')
      )
    strategy:
      matrix:
        include:
          - runner: ubuntu-latest
            subdir: noarch
    runs-on: ${{ matrix.runner }}
    steps:
      # Clean checkout of specific git ref needed for package metadata version
      # which needs env vars GIT_DESCRIBE_TAG and GIT_BUILD_STR:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          ref: ${{ github.ref }}
          clean: true
          fetch-depth: 0

      # Explicitly use Python 3.11 since each of the OSes has a different default Python
      - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
        with:
          python-version: '3.11'

      - name: Detect label
        shell: python
        run: |
          from pathlib import Path
          from re import match
          from os import environ

          if "${{ github.ref_name }}" == "main":
              # main branch commits are uploaded to the dev label
              label = "dev"
          elif "${{ github.ref_name }}".startswith("feature/"):
              # feature branch commits are uploaded to a custom label
              label = "${{ github.ref_name }}"
          else:
              # release branch commits are added to the rc label
              # see https://github.com/conda/infrastructure/issues/760
              _, name = "${{ github.repository }}".split("/")
              label = f"rc-{name}-${{ github.ref_name }}"

          Path(environ["GITHUB_ENV"]).write_text(f"ANACONDA_ORG_LABEL={label}")

      - name: Create and upload canary build
        uses: conda/actions/canary-release@15f883f14f4232f83658e3609c3316d58905138f # v24.8.0
        env:
          # Run conda-build in isolated activation to properly package conda
          _CONDA_BUILD_ISOLATED_ACTIVATION: 1
        with:
          package-name: ${{ github.event.repository.name }}
          subdir: ${{ matrix.subdir }}
          anaconda-org-channel: conda-canary
          anaconda-org-label: ${{ env.ANACONDA_ORG_LABEL }}
          anaconda-org-token: ${{ secrets.ANACONDA_ORG_CONDA_CANARY_TOKEN }}