name: CI

on:
  push:
    paths-ignore:
      - '*.md'
  workflow_dispatch:

permissions: {}

jobs:
  lint:
    runs-on: ubuntu-latest
    name: Linting
    continue-on-error: "${{ github.ref != 'refs/heads/master' }}"
    permissions:
      security-events: write
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          persist-credentials: false
      - name: Set up Python
        uses: actions/setup-python@v7
        with:
          python-version: '3.x'
      - name: Run black
        uses: psf/black@stable
      - name: Run zizmor
        uses: zizmorcore/zizmor-action@v0.7.1

  test_local:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version:
          - '3.11'
          - '3.12'
          - '3.13'
          - '3.14'
    name: Test / ${{ matrix.python-version }}
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false
          submodules: recursive
      - name: Set up Python
        uses: actions/setup-python@v7
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip
      - name: 'Install package & dependencies'
        run: pip install -q -e .
      - name: Verify that scripts are runnable
        run: cgitize --version
      - name: Run tests
        env:
          CGITIZE_GITHUB_USERNAME: cgitize-test
          CGITIZE_GITHUB_TOKEN: ${{ secrets.TEST_GITHUB_TOKEN }}
          CGITIZE_BITBUCKET_EMAIL: ${{ secrets.TEST_BITBUCKET_EMAIL }}
          CGITIZE_BITBUCKET_TOKEN: ${{ secrets.TEST_BITBUCKET_TOKEN }}
          CGITIZE_GITLAB_USERNAME: cgitize-test
          CGITIZE_GITLAB_TOKEN: ${{ secrets.TEST_GITLAB_TOKEN }}
        run: make test

  test_docker:
    runs-on: ubuntu-latest
    name: Test / Docker
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          persist-credentials: false
          submodules: recursive
      - name: Integration test (Docker)
        run: sudo make test/docker

  test_example_config:
    needs:
      - test_local
      - test_docker
    runs-on: ubuntu-latest
    name: Test / example config
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          persist-credentials: false
          submodules: recursive
      - name: Set up Python
        uses: actions/setup-python@v7
        with:
          cache: pip
      - name: Install dependencies
        run: pip install -q -r requirements.txt
      - name: Set up ssh-agent
        uses: webfactory/ssh-agent@v0.10.0
        with:
          ssh-private-key: ${{ secrets.TEST_SSH_KEY }}
      - name: Integration tests
        env:
          CGITIZE_GITHUB_USERNAME: cgitize-test
          CGITIZE_GITHUB_TOKEN: ${{ secrets.TEST_GITHUB_TOKEN }}
          CGITIZE_BITBUCKET_EMAIL: ${{ secrets.TEST_BITBUCKET_EMAIL }}
          CGITIZE_BITBUCKET_TOKEN: ${{ secrets.TEST_BITBUCKET_TOKEN }}
          CGITIZE_GITLAB_USERNAME: cgitize-test
          CGITIZE_GITLAB_TOKEN: ${{ secrets.TEST_GITLAB_TOKEN }}
        run: make test/integration

  publish_docker:
    needs:
      - lint
      - test_local
      - test_example_config
      - test_docker
    runs-on: ubuntu-latest
    strategy:
      matrix:
        service: [backend, frontend]
        include:
          - {service: backend, file: docker/Dockerfile, image: cgitize}
          - {service: frontend, context: docker/frontend, image: cgitize-frontend}
    name: Publish / Docker Hub / ${{ matrix.service }}
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          persist-credentials: false
          submodules: recursive
      # https://github.com/docker/metadata-action#semver
      - id: meta
        name: Docker Hub metadata
        uses: docker/metadata-action@v6
        with:
          images: egortensin/${{ matrix.image }}
          flavor: |
            latest=auto
          tags: |
            type=ref,event=branch
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
      - name: Push? Which platforms?
        id: params
        # Building for ARM for every commit in master is too time-consuming.
        run: |
          if ${{ github.ref == 'refs/heads/master' }}; then
              echo 'push=true' >> "$GITHUB_OUTPUT"
              echo 'platforms=amd64' >> "$GITHUB_OUTPUT"
          elif ${{ startsWith(github.ref, 'refs/tags/') }}; then
              echo 'push=true' >> "$GITHUB_OUTPUT"
              echo 'platforms=amd64,armhf,arm64' >> "$GITHUB_OUTPUT"
          else
              echo 'push=false' >> "$GITHUB_OUTPUT"
              echo 'platforms=amd64' >> "$GITHUB_OUTPUT"
          fi
      - name: Login to Docker Hub
        # https://github.com/orgs/community/discussions/163013
        if: steps.params.outputs.push == 'true'
        uses: docker/login-action@v4
        with:
          username: egortensin
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Build and publish
        uses: docker/build-push-action@v7
        with:
          context: ${{ matrix.context }}
          file: ${{ matrix.file }}
          labels: ${{ steps.meta.outputs.labels }}
          platforms: ${{ steps.params.outputs.platforms }}
          push: ${{ steps.params.outputs.push }}
          tags: ${{ steps.meta.outputs.tags }}

  publish_pypi:
    needs:
      - publish_docker
    runs-on: ubuntu-latest
    name: Publish / PyPI
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false
          submodules: recursive
      - name: Set up Python
        uses: actions/setup-python@v7
      - name: Verify package can be installed
        run: pip install -q .
      - name: Install package builder
        run: pip install -q --upgrade build
      - name: Build package
        run: python -m build
      - name: Publish as artifact
        uses: actions/upload-artifact@v7
        with:
          name: dist
          path: dist
          if-no-files-found: error
      - name: Publish to PyPI
        if: startsWith(github.ref, 'refs/tags/')
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          user: __token__
          password: ${{ secrets.PYPI_TOKEN }}