name: CI

on:
  push:
  workflow_dispatch:

permissions: {}

jobs:
  lint:
    runs-on: ubuntu-latest
    name: Linting
    continue-on-error: "${{ github.ref != 'refs/heads/master' }}"
    permissions:
      security-events: write
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          persist-credentials: false
      - name: Set up Python
        uses: actions/setup-python@v7
        with:
          python-version: '3.x'
      - name: Run black
        uses: psf/black@stable
      - name: Run zizmor
        uses: zizmorcore/zizmor-action@v0.7.1

  test:
    strategy:
      matrix:
        python-version:
          - '3.9'
          - '3.10'
          - '3.11'
          - '3.12'
          - '3.13'
          - '3.14'
          - '3.x'
    runs-on: ubuntu-latest
    name: Python ${{ matrix.python-version }}
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          persist-credentials: false
          submodules: recursive
      - name: Set up Python
        uses: actions/setup-python@v7
        with:
          python-version: ${{ matrix.python-version }}
      - name: Run tests as root
        run: sudo ./test/runner/harness
      - name: Run tests
        run: ./test/runner/harness

  aur:
    name: Publish to AUR
    needs:
      - lint
      - test
    runs-on: ubuntu-latest
    if: |
      startsWith(github.ref, 'refs/tags/')
      && !startsWith(github.ref, 'refs/tags/debian/')
    container:
      image: archlinux:base-devel
    permissions:
      contents: write
    steps:
      # This step must be done before actions/checkout. From the latter's
      # output:
      #
      #     To create a local Git repository instead, add Git 2.18 or higher to the PATH
      #
      - name: Install dependencies
        run: |
          pacman -Syu --noconfirm git openssh
      - name: Checkout
        uses: actions/checkout@v7
        with:
          persist-credentials: true
          ref: aur
          submodules: recursive
      - name: Run maintenance
        env:
          SSH_KEY: ${{ secrets.SSH_KEY }}
        run: |
          make -C "$GITHUB_WORKSPACE" ci