test.yaml

name: Pipeline

on:
  push:
  merge_group:
  workflow_dispatch:

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  static_analysis:
    strategy:
      matrix:
        python-version: ["3.9", "3.10", "3.11", "3.12"]
      fail-fast: false
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
      - name: Install Dependencies and library
        shell: bash
        run: |
          set -ux
          python -m pip install --upgrade pip
          pip install -e ".[docs,lint]"
      - name: Run mypy
        shell: bash
        run: mypy google_sheets tests

      - name: Run bandit
        shell: bash
        run: bandit -c pyproject.toml -r google_sheets

      - name: Run Semgrep
        shell: bash
        run: semgrep scan --config auto --error

  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ["3.9", "3.10", "3.11", "3.12"]
        pydantic-version: ["pydantic-v2"]
      fail-fast: false
    steps:
      - uses: actions/checkout@v4
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: "pip"
          cache-dependency-path: pyproject.toml
      - uses: actions/cache@v4
        id: cache
        with:
          path: ${{ env.pythonLocation }}
          key: ${{ runner.os }}-python-${{ env.pythonLocation }}-${{ hashFiles('pyproject.toml') }}-test-v03

      - name: Install Dependencies
        if: steps.cache.outputs.cache-hit != 'true'
        run: pip install .[docs,testing]
      - name: Install Pydantic v1
        if: matrix.pydantic-version == 'pydantic-v1'
        run: pip install "pydantic>=1.10,<2"
      - name: Install Pydantic v2
        if: matrix.pydantic-version == 'pydantic-v2'
        run: pip install --pre "pydantic>=2,<3"
      - run: mkdir coverage
      - name: Create client secrets file
        run: echo '{"web":{"client_id":"dummy.apps.googleusercontent.com","project_id":"dummy-id","auth_uri":"https://accounts.google.com/o/oauth2/auth","token_uri":"https://oauth2.googleapis.com/token","auth_provider_x509_cert_url":"https://www.googleapis.com/oauth2/v1/certs","client_secret":"dummy-secret","redirect_uris":["http://localhost:9000/login/callback"]}}' > client_secret.json
      - name: Prisma generate
        run: prisma generate
      - name: Test
        run: bash scripts/test.sh
        env:
          COVERAGE_FILE: coverage/.coverage.${{ runner.os }}-py${{ matrix.python-version }}-${{ matrix.pydantic-version }}
          CONTEXT: ${{ runner.os }}-py${{ matrix.python-version }}-${{ matrix.pydantic-version }}
      - name: Store coverage files
        uses: actions/upload-artifact@v4
        with:
          name: .coverage.${{ runner.os }}-py${{ matrix.python-version }}-${{ matrix.pydantic-version }}
          path: coverage
          if-no-files-found: error
          include-hidden-files: true

  test-macos-latest:
    if: github.event.pull_request.draft == false
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"
          cache: "pip"
          cache-dependency-path: pyproject.toml

      - name: Install Dependencies
        if: steps.cache.outputs.cache-hit != 'true'
        run: pip install .[docs,testing]
      - name: Create client secrets file
        run: echo '{"web":{"client_id":"dummy.apps.googleusercontent.com","project_id":"dummy-id","auth_uri":"https://accounts.google.com/o/oauth2/auth","token_uri":"https://oauth2.googleapis.com/token","auth_provider_x509_cert_url":"https://www.googleapis.com/oauth2/v1/certs","client_secret":"dummy-secret","redirect_uris":["http://localhost:9000/login/callback"]}}' > client_secret.json
      - name: Prisma generate
        run: prisma generate
      - name: Test
        run: bash scripts/test.sh

  test-windows-latest:
    if: github.event.pull_request.draft == false
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"
          cache: "pip"
          cache-dependency-path: pyproject.toml

      - name: Install Dependencies
        if: steps.cache.outputs.cache-hit != 'true'
        run: pip install .[docs,testing]
      - name: Create client secrets file
        run: echo '{"web":{"client_id":"dummy.apps.googleusercontent.com","project_id":"dummy-id","auth_uri":"https://accounts.google.com/o/oauth2/auth","token_uri":"https://oauth2.googleapis.com/token","auth_provider_x509_cert_url":"https://www.googleapis.com/oauth2/v1/certs","client_secret":"dummy-secret","redirect_uris":["http://localhost:9000/login/callback"]}}' > client_secret.json
      - name: Prisma generate
        run: prisma generate
      - name: Test
        run: bash scripts/test.sh

  coverage-combine:
    if: github.event.pull_request.draft == false
    needs:
      - test
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.9"
          cache: "pip"
          cache-dependency-path: pyproject.toml

      - name: Get coverage files
        uses: actions/download-artifact@v4
        with:
          pattern: .coverage*
          path: coverage
          merge-multiple: true

      - run: pip install coverage[toml]

      - run: ls -la coverage
      - run: coverage combine coverage
      - run: coverage report
      - run: coverage html --show-contexts --title "google-sheets coverage for ${{ github.sha }}"

      - name: Store coverage html
        uses: actions/upload-artifact@v4
        with:
          name: coverage-html
          path: htmlcov

  docker_build_push:
    runs-on: ubuntu-22.04
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Log in to the Container registry
        uses: docker/login-action@v3.3.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - run: docker pull ghcr.io/$GITHUB_REPOSITORY:$GITHUB_REF_NAME || docker pull ghcr.io/$GITHUB_REPOSITORY:dev || true
      - run: docker build --build-arg PORT=$PORT -t ghcr.io/$GITHUB_REPOSITORY:${GITHUB_REF_NAME////-} .
      - name: Add tag latest if branch is main
        if: github.ref_name == 'main'
        run: docker tag ghcr.io/$GITHUB_REPOSITORY:$GITHUB_REF_NAME ghcr.io/$GITHUB_REPOSITORY:latest
      - name: Push only if branch name is main or dev
        if: github.ref_name == 'main' || github.ref_name == 'dev'
        run: docker push ghcr.io/$GITHUB_REPOSITORY --all-tags

  pre-commit-check:
    runs-on: ubuntu-latest
    env:
      SKIP: "static-analysis"
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
      - name: Set $PY environment variable
        run: echo "PY=$(python -VV | sha256sum | cut -d' ' -f1)" >> $GITHUB_ENV
      - uses: actions/cache@v4
        with:
          path: ~/.cache/pre-commit
          key: pre-commit|${{ env.PY }}|${{ hashFiles('.pre-commit-config.yaml') }}
      - name: Install Dependencies
        run: pip install .[docs,testing]
      - uses: pre-commit/action@v3.0.1

  # https://github.com/marketplace/actions/alls-green#why
  check: # This job does nothing and is only used for the branch protection
    if: github.event.pull_request.draft == false

    needs:
      - static_analysis
      - pre-commit-check
      - coverage-combine
      - test-macos-latest
      - test-windows-latest
      - docker_build_push

    runs-on: ubuntu-latest

    steps:
      - name: Decide whether the needed jobs succeeded or failed
        uses: re-actors/alls-green@release/v1 # nosemgrep
        with:
          jobs: ${{ toJSON(needs) }}

  deploy:
    runs-on: ubuntu-22.04
    defaults:
      run:
        shell: bash
    needs: [check]
    if: github.ref_name == 'main' || github.ref_name == 'dev'
    env:
      CLIENT_SECRET: ${{ github.ref_name == 'main' && secrets.PROD_CLIENT_SECRET || secrets.STAGING_CLIENT_SECRET }}
      DATABASE_URL: ${{ github.ref_name == 'main' && secrets.PROD_DATABASE_URL || secrets.STAGING_DATABASE_URL }}
      GITHUB_USERNAME: ${{ github.actor }}
      GITHUB_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
      # DEVELOPER_TOKEN: ${{ secrets.DEVELOPER_TOKEN }}
      DOMAIN: ${{ github.ref_name == 'main' && vars.PROD_DOMAIN || vars.STAGING_DOMAIN }}
      REDIRECT_DOMAIN: ${{ github.ref_name == 'main' && vars.PROD_REDIRECT_DOMAIN || vars.STAGING_REDIRECT_DOMAIN }}
      SSH_KEY: ${{ github.ref_name == 'main' && secrets.PROD_SSH_KEY || secrets.STAGING_SSH_KEY }}
    steps:
      - uses: actions/checkout@v3 # Don't change it to cheackout@v4. V4 is not working with container image.
      # This is to fix GIT not liking owner of the checkout dir - https://github.com/actions/runner/issues/2033#issuecomment-1204205989
      - run: chown -R $(id -u):$(id -g) $PWD

      - run: if [[ $GITHUB_REF_NAME == "main" ]]; then echo "TAG=latest" >> $GITHUB_ENV ; else echo "TAG=dev" >> $GITHUB_ENV ; fi;

      - run: echo "PATH=$PATH:/github/home/.local/bin" >> $GITHUB_ENV
      - run: "which ssh-agent || ( apt-get update -y && apt-get install openssh-client git gettext -y )"
      - run: eval $(ssh-agent -s)
      - run: mkdir -p ~/.ssh
      - run: chmod 700 ~/.ssh
      - run: ssh-keyscan "$DOMAIN" >> ~/.ssh/known_hosts
      - run: chmod 644 ~/.ssh/known_hosts
      - run: echo "$SSH_KEY" | base64 --decode > key.pem
      - run: chmod 600 key.pem

      - run: ssh -o StrictHostKeyChecking=no -i key.pem azureuser@"$DOMAIN" "docker images"
      - run: bash scripts/deploy.sh

      - run: rm key.pem