name: CI

on:
  push:
    paths-ignore:
      - '*.md'
  workflow_dispatch:

jobs:
  lint:
    runs-on: ubuntu-latest
    name: Linting
    continue-on-error: "${{ github.ref != 'refs/heads/master' }}"
    steps:
      - name: Checkout
        uses: actions/checkout@v7
      - name: Set up Python
        uses: actions/setup-python@v7
        with:
          python-version: '3.x'
      - name: Run black
        uses: psf/black@stable

  test_local:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version:
          - '3.11'
          - '3.12'
          - '3.13'
          - '3.14'
    name: 'Test / ${{ matrix.python-version }}'
    env:
      CGITIZE_GITHUB_USERNAME: cgitize-test
      CGITIZE_GITHUB_TOKEN: '${{ secrets.CGITIZE_GITHUB_TOKEN }}'
      CGITIZE_BITBUCKET_EMAIL: '${{ secrets.CGITIZE_BITBUCKET_EMAIL }}'
      CGITIZE_BITBUCKET_TOKEN: '${{ secrets.CGITIZE_BITBUCKET_TOKEN }}'
      CGITIZE_GITLAB_USERNAME: cgitize-test
      CGITIZE_GITLAB_TOKEN: '${{ secrets.CGITIZE_GITLAB_TOKEN }}'
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          submodules: recursive
      - name: Set up Python
        uses: actions/setup-python@v7
        with:
          python-version: '${{ matrix.python-version }}'
          cache: pip
      - name: 'Install package & dependencies'
        run: pip install -q -e .
      - name: Verify that scripts are runnable
        run: cgitize --version
      - name: Run tests
        run: make test

  test_docker:
    runs-on: ubuntu-latest
    name: 'Test / Docker'
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          submodules: recursive
      - name: Integration test (Docker)
        run: sudo make test/docker

  test_example_config:
    needs:
      - test_local
      - test_docker
    runs-on: ubuntu-latest
    name: 'Test / example config'
    env:
      CGITIZE_GITHUB_USERNAME: cgitize-test
      CGITIZE_GITHUB_TOKEN: '${{ secrets.CGITIZE_GITHUB_TOKEN }}'
      CGITIZE_BITBUCKET_EMAIL: '${{ secrets.CGITIZE_BITBUCKET_EMAIL }}'
      CGITIZE_BITBUCKET_TOKEN: '${{ secrets.CGITIZE_BITBUCKET_TOKEN }}'
      CGITIZE_GITLAB_USERNAME: cgitize-test
      CGITIZE_GITLAB_TOKEN: '${{ secrets.CGITIZE_GITLAB_TOKEN }}'
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          submodules: recursive
      - name: Set up Python
        uses: actions/setup-python@v7
        with:
          cache: pip
      - name: Install dependencies
        run: pip install -q -r requirements.txt
      - name: Set up ssh-agent
        uses: webfactory/ssh-agent@v0.10.0
        with:
          ssh-private-key: '${{ secrets.SSH_KEY }}'
      - name: Integration tests
        run: make test/integration

  publish_docker:
    needs:
      - lint
      - test_local
      - test_example_config
      - test_docker
    runs-on: ubuntu-latest
    strategy:
      matrix:
        service: [backend, frontend]
        include:
          - {service: backend, file: docker/Dockerfile, image: cgitize}
          - {service: frontend, context: docker/frontend, image: cgitize-frontend}
    name: 'Publish / Docker Hub / ${{ matrix.service }}'
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          submodules: recursive
      # https://github.com/docker/metadata-action#semver
      - id: meta
        name: Docker Hub metadata
        uses: docker/metadata-action@v6
        with:
          images: 'egortensin/${{ matrix.image }}'
          flavor: |
            latest=auto
          tags: |
            type=ref,event=branch
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
      - name: Push? Which platforms?
        id: params
        # Building for ARM for every commit in master is too time-consuming.
        run: |
          if ${{ github.ref == 'refs/heads/master' }}; then
              echo 'push=true' >> "$GITHUB_OUTPUT"
              echo 'platforms=amd64' >> "$GITHUB_OUTPUT"
          elif ${{ startsWith(github.ref, 'refs/tags/') }}; then
              echo 'push=true' >> "$GITHUB_OUTPUT"
              echo 'platforms=amd64,armhf,arm64' >> "$GITHUB_OUTPUT"
          else
              echo 'push=false' >> "$GITHUB_OUTPUT"
              echo 'platforms=amd64' >> "$GITHUB_OUTPUT"
          fi
      - name: Login to Docker Hub
        # https://github.com/orgs/community/discussions/163013
        if: steps.params.outputs.push == 'true'
        uses: docker/login-action@v4
        with:
          username: egortensin
          password: '${{ secrets.DOCKERHUB_TOKEN }}'
      - name: Build and publish
        uses: docker/build-push-action@v7
        with:
          context: '${{ matrix.context }}'
          file: '${{ matrix.file }}'
          labels: '${{ steps.meta.outputs.labels }}'
          platforms: '${{ steps.params.outputs.platforms }}'
          push: '${{ steps.params.outputs.push }}'
          tags: '${{ steps.meta.outputs.tags }}'

  publish_pypi:
    needs:
      - publish_docker
    runs-on: ubuntu-latest
    name: 'Publish / PyPI'
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          submodules: recursive
      - name: Set up Python
        uses: actions/setup-python@v7
      - name: Verify package can be installed
        run: pip install -q .
      - name: Install package builder
        run: pip install -q --upgrade build
      - name: Build package
        run: python -m build
      - name: Publish as artifact
        uses: actions/upload-artifact@v7
        with:
          name: dist
          path: dist
          if-no-files-found: error
      - name: Publish to PyPI
        if: startsWith(github.ref, 'refs/tags/')
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          user: __token__
          password: '${{ secrets.PYPI_API_TOKEN }}'