pythonpackage.yml

name: Python package

on:
  push:
    # run only when pushed to master branch.
    branches:
      - master

    # run on every publish tags.
    tags:
      - v*

    paths:
      - 'src/**'
      - 'test/**'
      - 'Dockerfile'
      - 'requirements.txt'
      - 'pyproject.toml'

  # run on any pr.
  pull_request:

jobs:
  test:
    name: Python Test - ${{ matrix.python-version }}
    runs-on: ubuntu-latest
    strategy:
      max-parallel: 4
      matrix:
        python-version:
          - "3.11"
          - "3.12"
          #- "3.13"
    steps:
    - uses: actions/checkout@v6

    - name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@v5
      with:
        python-version: ${{ matrix.python-version }}

    - name: Lint with flake8
      run: |
        pip install flake8==7.3.0
        # stop the build if there are Python syntax errors or undefined names
        flake8 . --count --show-source --statistics --exclude=.venv
        # exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide
        flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics --exclude=.venv

    - name: Test with unittest (codecov)
      run: |
        pip install -r requirements.txt
        pip install coverage==7.13
        # discover all tests in the test directory
        python -m coverage run --omit '.venv/*' -m unittest discover test -vv -t .

        # generate coverage xmo report
        python -m coverage xml
        # just print coverage locally
        python -m coverage report --fail-under=85

    - name: Upload Coverage to Codecov
      uses: codecov/codecov-action@v4.3.1
      with:
        token: ${{ secrets.CODECOV_TOKEN }}
        flags: unittests
        name: codecov-pybump
        fail_ci_if_error: true
        verbose: true

  test-results:
    name: Python test results
    needs: [test]
    runs-on: ubuntu-latest
    steps:
      - name: Tests passed
        if: ${{ !(contains(needs.*.result, 'failure')) }}
        run: exit 0
      - name: Tests failed
        if: ${{ (contains(needs.*.result, 'failure')) }}
        run: exit 1

  test-container-image:
    name: Container Image Test
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v6

    - name: Run Checkov action
      id: checkov
      uses: bridgecrewio/checkov-action@v12
      with:
        framework: dockerfile
        dockerfile_path: Dockerfile
        skip_check: CKV_DOCKER_2
        quit: true

    - name: Build container image
      uses: docker/build-push-action@v3
      with:
        push: false
        tags: arielev/pybump:test

    - name: Run simple test case against new image
      run: |
        docker run --rm \
          arielev/pybump:test \
          --version
        docker run --rm \
          arielev/pybump:test \
          --verify v2.3.5+test

  simulate:
    name: Publish Simulation
    if: github.ref != 'refs/heads/master'
    needs: [test, test-container-image]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - name: Bump version using self app
        id: app_version_bump
        run: |
          pip install pybump
          # Bump patch, then set commit SHA as metadata (+sha) for unique test.pypi.org versions
          # Using --metadata flag for PEP 440 compatibility (+ instead of -)
          pybump bump --level patch --file pyproject.toml
          # Append GitHub run number as a numeric release segment (PEP 440 / PyPI compliant)
          sed -i 's/^\(version *= *"\)\([0-9.]*\)\("\)/\1\2.'"$GITHUB_RUN_NUMBER"'\3/' pyproject.toml
      - name: Install uv
        uses: astral-sh/setup-uv@v5
        with:
          version: "0.6.x"
      - name: Build python package and test publish
        run: |
          uv build
          uv publish
        env:
          UV_PUBLISH_USERNAME: ${{ secrets.PYPI_TEST_USERNAME }}
          UV_PUBLISH_PASSWORD: ${{ secrets.PYPI_TEST_PASSWORD }}
          UV_PUBLISH_URL: "https://test.pypi.org/legacy/"

  build-python-package:
    if: github.ref == 'refs/heads/master'
    needs: [test, test-container-image]
    runs-on: ubuntu-latest
    outputs:
      bumped_version: ${{ steps.app_version_bump.outputs.app_version }}
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - name: Bump version using self app
        id: app_version_bump
        run: |
          pip install pybump
          echo "app_version=$(pybump bump --level patch --file pyproject.toml)" >> $GITHUB_OUTPUT

      - name: Install uv
        uses: astral-sh/setup-uv@v5
        with:
          version: "0.6.x"
      - name: Build python package and publish to global pypi
        run: |
          uv build
          uv publish
        env:
          UV_PUBLISH_USERNAME: ${{ secrets.PYPI_USERNAME }}
          UV_PUBLISH_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
          UV_PUBLISH_URL: "https://upload.pypi.org/legacy/"

  build-container-image:
    if: github.ref == 'refs/heads/master'
    needs: [test, test-container-image]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - name: Bump version using self app
        id: app_version_bump
        run: |
          pip install pybump
          echo "app_version=$(pybump bump --level patch --file pyproject.toml)" >> $GITHUB_OUTPUT

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v2

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Login to Docker Hub
        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_PASSWORD }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v4
        with:
          images: docker.io/arielev/pybump

      - name: Build and push docker image
        uses: docker/build-push-action@v3
        with:
          platforms: linux/amd64,linux/arm64
          push: true
          tags: arielev/pybump:${{ steps.app_version_bump.outputs.app_version }},arielev/pybump:latest
          labels: ${{ steps.meta.outputs.labels }}

      - name: Update Docker Hub Description
        if: github.ref == 'refs/heads/master'
        uses: peter-evans/dockerhub-description@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_PASSWORD }}
          readme-filepath: ./README.rst
          repository: arielev/pybump

  commit:
    if: github.ref == 'refs/heads/master'
    needs: [build-python-package, build-container-image]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v6
      # another bump must occur here or there will be no changes in git
      - name: Bump version using self app
        id: app_version_bump
        run: |
          pip install pybump
          echo "app_version=$(pybump bump --level patch --file pyproject.toml)" >> $GITHUB_OUTPUT
      - name: Commit new version
        env:
          NEW_VERSION: ${{needs.build-python-package.outputs.bumped_version}}
        run: |
          # Update version on git repo
          git config --local user.email "$GITHUB_ACTOR@users.noreply.github.com"
          git config --local user.name "GitHub Action"
          git add pyproject.toml
          git commit -m "update version to: $NEW_VERSION (github action)"

          git push https://${GITHUB_ACTOR}:${GITHUB_TOKEN}@github.com/ArieLevs/pybump HEAD:master