ci_workflows.yml

name: CI

on:
  push:
    branches:
    - main
    - 'v*'
    tags:
    - 'v*'
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  # Github Actions supports ubuntu, windows, and macos virtual environments:
  # https://help.github.com/en/actions/reference/virtual-environments-for-github-hosted-runners
  ci_tests:
    name: ${{ matrix.name }}
    runs-on: ${{ matrix.os }}
    continue-on-error: ${{ matrix.allow_failure }}
    strategy:
      matrix:
        include:
          - name: Code style checks
            os: ubuntu-latest
            python: 3.x
            toxenv: codestyle
            allow_failure: false

          - name: PEP 517
            os: ubuntu-latest
            python: 3.x
            toxenv: pep517
            allow_failure: false

          - name: Security audit
            os: ubuntu-latest
            python: 3.x
            toxenv: securityaudit
            allow_failure: false

          - name: Python 3.11 with coverage checking, all deps, and remote data
            os: ubuntu-latest
            python: '3.11'
            toxenv: py311-test-alldeps-cov
            toxposargs: --remote-data --run-slow
            allow_failure: false

          - name: OS X - Python 3.12
            os: macos-latest
            python: '3.12'
            toxenv: py312-test
            allow_failure: false

          - name: Windows - Python 3.10
            os: windows-latest
            python: '3.10'
            toxenv: py310-test
            allow_failure: false

          # This also runs on cron but we want to make sure new changes
          # won't break this job at the PR stage.
          - name: Python 3.12 with latest dev versions of key dependencies, and remote data
            os: ubuntu-latest
            python: '3.12'
            toxenv: py312-test-devdeps
            toxposargs: --remote-data --run-slow
            allow_failure: true

    steps:
    - name: Checkout code
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
      with:
        fetch-depth: 0
    - name: Set up python ${{ matrix.python }} on ${{ matrix.os }}
      uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b  # v5.3.0
      with:
        python-version: ${{ matrix.python }}
    - name: Install base dependencies
      run: python -m pip install --upgrade pip tox
    - name: Test/run with tox
      run: tox -e ${{ matrix.toxenv }} -- ${{ matrix.toxposargs }}
    - name: Upload coverage to artifacts
      if: "contains(matrix.toxenv, '-cov')"
      uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882  # v4.4.3
      with:
        name: coverage_${{ matrix.toxenv }}.xml
        path: coverage.xml
        if-no-files-found: error

  upload-codecov:
    needs: [ ci_tests ]
    permissions:
      contents: none
    runs-on: ubuntu-latest
    name: Upload Coverage
    steps:
    - name: Download coverage artifacts
      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16  # v4.1.8
      with:
        path: coverage
        pattern: coverage_*
        merge-multiple: true
    - name: Upload report to Codecov
      if: ${{ hashFiles('coverage/') != '' }}
      uses: codecov/codecov-action@015f24e6818733317a2da2edd6290ab26238649a  # v5.0.7
      with:
        token: ${{ secrets.CODECOV_TOKEN }}
        directory: coverage
        fail_ci_if_error: true
        verbose: true