python-package.yml

---
name: CI/CD
on:
  push:
    branches: [master]
  pull_request:
    branches: [master]
  release:
    types: [created]
    branches: [master]
env:
  FORCE_COLOR: '1'  # Make tools pretty.
  PIP_DISABLE_PIP_VERSION_CHECK: '1'
  PIP_NO_PYTHON_VERSION_WARNING: '1'
  PYTHON_LATEST: '3.12'

  # For re-actors/checkout-python-sdist
  sdist-artifact: python-package-distributions
jobs:
  lint:
    name: Check linting
    runs-on: ubuntu-latest
    steps:
      - name: Checkout project
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_LATEST }}
          cache: pip
      - run: |
          python -m pip install build
          python -m pip install -r requirements/test.txt
        name: Install core libraries for build and install
      - name: Run linting checks
        run: scripts/check
  test-pytest:
    name: 'Python ${{ matrix.python-version }}/Cython: ${{ matrix.use-cython }}'
    runs-on: ubuntu-latest
    timeout-minutes: 10  # Maybe we should remove this someday but the PyPy tests are acting strange
    strategy:
      # Complete all jobs even if one fails, allows us to see
      # for example if a test fails only when Cython is enabled
      fail-fast: false
      matrix:
        python-version: ['3.8', '3.9', '3.10', '3.11']
        use-cython: ['true', 'false']
        experimental: [false]
        include:
          - python-version: 'pypy3.9'
            use-cython: false
            experimental: true
          - python-version: ~3.13.0-0
            experimental: true
            use-cython: false
          - python-version: 3.12
            experimental: true
            use-cython: false
          - python-version: 3.12
            experimental: true
            use-cython: true
    env:
      USE_CYTHON: ${{ matrix.use-cython }}
    continue-on-error: ${{ matrix.experimental }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip
          cache-dependency-path: requirements/test.txt
      - name: Install dependencies
        run: |
          pip install -r requirements/test.txt
          pip install .
      - name: Run tests
        run: scripts/tests
      - name: Enforce coverage
        uses: codecov/codecov-action@v3
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
  check:  # This job does nothing and is only used for the branch protection
    name: ✅ Ensure the required checks passing
    if: always()
    needs: [lint, test-pytest]
    runs-on: ubuntu-latest
    steps:
      - name: Decide whether the needed jobs succeeded or failed
        uses: re-actors/alls-green@release/v1
        with:
          jobs: ${{ toJSON(needs) }}
  build_wheels:
    name: 📦 Build wheels on ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    needs: check
    if: github.event_name == 'release' && github.event.action == 'created'
    strategy:
      matrix:
        os: [ubuntu-20.04, macos-13, macos-14]
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Build wheels
        uses: pypa/cibuildwheel@v2.10.1
      - uses: actions/upload-artifact@v3
        with:
          path: ./wheelhouse/*.whl
  build_sdist:
    name: 📦 Build the source distribution
    runs-on: ubuntu-latest
    needs: check
    if: github.event_name == 'release' && github.event.action == 'created'
    steps:
      - uses: actions/checkout@v4
        name: Checkout source repository
        with:
          fetch-depth: 0
      - uses: actions/setup-python@v5
      - name: Build sdist
        run: >
          pip3 install pkgconfig cython --upgrade &&
          python3 setup.py sdist
      - uses: actions/upload-artifact@v3
        name: Upload build artifacts
        with:
          path: dist/*.tar.gz
  publish:
    name: 📦 Publish to PyPI
    runs-on: ubuntu-latest
    needs: [build_wheels, build_sdist]
    permissions:
      id-token: write
    environment: pypi
    if: github.event_name == 'release' && github.event.action == 'created'
    steps:
      - name: Download the sdist artifact
        uses: actions/download-artifact@v3
        with:
          name: artifact
          path: dist
      - name: Publish package to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          password: ${{ secrets.PYPI_API_TOKEN }}