deploy.yml

name: deploy.yml

permissions:
  contents: read

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
  UV_VERSION: "0.11.21"
  UV_PROJECT_ENVIRONMENT: venv

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  workflow_dispatch: {}

jobs:
  gate:
    name: Verify release branch
    runs-on: ubuntu-latest
    steps:
      - name: Require master branch
        env:
          REF: ${{ github.ref }}
        run: |
          if [ "$REF" != "refs/heads/master" ]; then
            echo "::error::Deploy workflow must be run from the master branch."
            exit 1
          fi

  build_test:
    name: Build and test
    needs: gate
    runs-on: ubuntu-latest
    environment: codecov
    permissions:
      contents: read
      issues: write  # Required for actions/github-script to create issues on test failure
    defaults:
      run:
        shell: bash

    steps:
      - name: Check out repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        id: setup_python
        with:
          python-version-file: '.python-version'

      - name: Set up uv
        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
        with:
          version: ${{ env.UV_VERSION }}

      - name: Sync dependencies (locked)
        run: uv sync --locked --extra dev

      - name: Check and fix with Ruff
        run: uv run ruff check ./tests/*.py ./openseries/*.py --fix --exit-non-zero-on-fix

      - name: Format with Ruff
        run: uv run ruff format

      - name: Type check with Mypy
        run: uv run mypy .

      - name: Tests with Pytest
        id: pytest
        run: uv run pytest
        env:
          PYTHONPATH: ${{ github.workspace }}

      - name: Create GitHub issue on failure
        if: ${{ failure() }}
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_OWNER: ${{ github.repository_owner }}
          GH_REPO: ${{ github.event.repository.name }}
          GH_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        with:
          script: |
            const { GH_OWNER, GH_REPO, GH_RUN_URL } = process.env;
            await github.rest.issues.create({
              owner: GH_OWNER,
              repo: GH_REPO,
              title: `Tests failed on ${new Date().toDateString()}`,
              body: `See the full logs here: ${GH_RUN_URL}`,
            });

      - name: Upload test results to Codecov
        if: ${{ github.ref_name == 'master' && success() }}
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          report_type: test_results
          files: junit.xml
          verbose: true

      - name: Upload coverage to Codecov
        if: ${{ github.ref_name == 'master' && success() }}
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          slug: CaptorAB/openseries
          files: coverage.xml
          verbose: true

  tag_and_release:
    name: Tag and create release
    needs: build_test
    if: ${{ needs.build_test.result == 'success' }}
    permissions:
      contents: write  # Required for release-tag reusable workflow to push signed tags
    uses: ./.github/workflows/release-tag.yml
    secrets:
      GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}

  build_dist:
    name: Build distributions
    needs: tag_and_release
    if: ${{ needs.tag_and_release.result == 'success' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
    defaults:
      run:
        shell: bash
    steps:
      - name: Check out release tag
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: refs/tags/${{ needs.tag_and_release.outputs.tag_version }}
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version-file: .python-version

      - name: Set up uv
        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
        with:
          version: ${{ env.UV_VERSION }}
          enable-cache: false

      - name: Verify lockfile
        run: uv lock --check

      - name: Build distributions (sdist + wheel)
        run: |
          set -euo pipefail
          uv build
          uvx twine check dist/*
          (cd dist && sha256sum *.whl *.tar.gz > ../SHA256SUMS && cat ../SHA256SUMS)

      - name: Upload dist artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: dist
          path: |
            dist/
            SHA256SUMS
          if-no-files-found: error

  publish_testpypi:
    name: Publish to TestPyPI
    needs: build_dist
    if: ${{ needs.build_dist.result == 'success' }}
    runs-on: ubuntu-latest
    environment:
      name: testpypi
      url: https://test.pypi.org/project/openseries/
    permissions:
      contents: read
      id-token: write  # Required for pypa/gh-action-pypi-publish OIDC trusted publishing
    steps:
      - name: Download dist artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: dist
          path: .

      - name: Verify distribution checksums
        run: |
          set -euo pipefail
          cd dist
          sha256sum -c ../SHA256SUMS

      - name: Publish distributions to TestPyPI (OIDC)
        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
        with:
          repository-url: https://test.pypi.org/legacy/
          skip-existing: true

  publish_pypi:
    name: Publish to PyPI
    needs: publish_testpypi
    if: ${{ needs.publish_testpypi.result == 'success' }}
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/project/openseries/
    permissions:
      contents: read
      id-token: write  # Required for pypa/gh-action-pypi-publish OIDC trusted publishing
    steps:
      - name: Download dist artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: dist
          path: .

      - name: Verify distribution checksums
        run: |
          set -euo pipefail
          cd dist
          sha256sum -c ../SHA256SUMS

      - name: Publish distributions to PyPI (OIDC)
        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
        with:
          skip-existing: true

  trigger_docs_update:
    name: Trigger documentation update
    needs: publish_pypi
    if: ${{ needs.publish_pypi.result == 'success' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
      actions: write  # Required for actions.createWorkflowDispatch to trigger docs workflow
    steps:
      - name: Trigger documentation update
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            await github.rest.actions.createWorkflowDispatch({
              owner: context.repo.owner,
              repo: context.repo.repo,
              workflow_id: 'docs.yml',
              ref: 'master'
            });
            console.log('Documentation update workflow triggered');