main.yml

name: CI

# Workflow does NOT trigger on a feature branch until a pull request is created.
# Workflow will always run when a pull request is merged to the default branch.
on:
  pull_request: {}
  push:
      branches: ["main"]
env:
  PYTHON_VERSION: "3.12"

jobs:
  bandit:
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - name: Initialize Hatch
        uses: ./.github/actions/initialize-hatch

      - name: Run bandit
        run: hatch run bandit-ci

  black:
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Set up Python
        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - name: Initialize Hatch
        uses: ./.github/actions/initialize-hatch

      - name: Run black
        run: hatch run black-check

  flake8:
    runs-on: ubuntu-latest
    steps:
        - name: Check out code
          uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
          with:
            python-version: ${{ env.PYTHON_VERSION }}
        - name: Initialize Hatch
          uses: ./.github/actions/initialize-hatch

        - name: Run flake8
          run: hatch run flake8-check

  isort:
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - name: Initialize Hatch
        uses: ./.github/actions/initialize-hatch

      - name: Run isort
        run: hatch run isort-check

  mypy:
    runs-on: ubuntu-latest
    steps:
        - name: Check out code
          uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
          with:
            python-version: ${{ env.PYTHON_VERSION }}
        - name: Initialize Hatch
          uses: ./.github/actions/initialize-hatch

        - name: Run mypy
          run: hatch run typing

  renovate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: 🧼 lint renovate config # Validates changes to renovate.json config file
        uses: suzuki-shunsuke/github-action-renovate-config-validator@36a15b83e37bf3221dc9c02ff5ffdaefb51ca1cf # v1.1.0
        with:
          config_file_path: 'renovate.json'

  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
    steps:
        - name: Check out code
          uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
          with:
            python-version: ${{ matrix.python-version }}
        - name: Initialize Hatch
          uses: ./.github/actions/initialize-hatch

        - name: Run pytest
          run: hatch run test-ci --cov-report xml:coverage-${{ matrix.python-version }}.xml --junitxml=test-results-${{ matrix.python-version }}.xml

        - name: Upload pytest test results artifact
          uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
          with:
            name: pytest-results-${{ matrix.python-version }}
            path: test-results-${{ matrix.python-version }}.xml
          # Use always() to always run this step to publish test results when there are test failures
          if: ${{ always() }}

        - name: Upload coverage results artifact
          uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
          with:
            name: pytest-coverage-${{ matrix.python-version }}
            path: coverage-${{ matrix.python-version }}.xml
          # Use always() to always run this step to publish test results when there are test failures
          if: ${{ always() }}

        - name: Publish coverage results to Codecov
          uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4.6.0
          with:
            file: coverage-${{ matrix.python-version }}.xml
            fail_ci_if_error: true
            token: ${{ secrets.CODECOV_TOKEN }}

  verify-wheel:
    runs-on: ubuntu-latest
    strategy:
          matrix:
            python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
    steps:
      - name: Check out code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
        with:
          python-version: ${{ matrix.python-version }}
      - name: Build wheel
        uses: ./.github/actions/build-dist
      - name: Verify wheel
        uses: ./.github/actions/verify-wheel
        with:
          package-import-name: "columbo"

  build-devbox-image:
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Build devbox image
        run: docker compose build devbox

  validate-doc-examples:
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Initialize Hatch
        uses: ./.github/actions/initialize-hatch

      - name: Validate docs
        run: hatch run test-docs-examples

  build-docs:
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - name: Check out code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - name: Initialize Hatch
        uses: ./.github/actions/initialize-hatch
        with:
          environment-name: "docs"

      - name: Build Docs
        run: hatch run docs:build

      - name: Upload coverage results artifact
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        with:
          name: docs-site
          path: site/

  update-dev-docs:
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    steps:
      - name: Check out code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - name: Initialize Hatch
        uses: ./.github/actions/initialize-hatch
        with:
          environment-name: "docs"
          activate: "true"

      - name: Push documentation changes
        uses: ./.github/actions/publish-docs-with-mike
        with:
          version_name: dev