test.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read # to fetch code (actions/checkout)

env:
  FORCE_COLOR: "1" # Make tools pretty.
  TOX_TESTENV_PASSENV: FORCE_COLOR
  PIP_DISABLE_PIP_VERSION_CHECK: "1"
  PIP_NO_PYTHON_VERSION_WARNING: "1"
  # Keep in sync with .pre-commit-config.yaml/default_language_version/python.
  PYTHON_LATEST: "3.11"

jobs:
  tests:
    name: Python ${{ matrix.python-version }}
    runs-on: ubuntu-latest

    strategy:
      matrix:
        python-version: ["3.8", "3.9", "3.10", "3.11", "3.12"]

    steps:
      - name: 🔒 Harden Runner
        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            files.pythonhosted.org:443
            objects.githubusercontent.com:443
            github.com:443
            pypi.org:443
            api.github.com:443
      - uses: actions/checkout@v4
      - name: 🐍 Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}

      - name: ⬇️ Install dependencies
        run: |
          python -Im pip install --upgrade pip
          python -Im pip install flit tox tox-gh-actions

      - name: 🏗️ Build wheel
        run: python -Im flit build --format wheel

      - name: 🧪 Run tox targets for Python ${{ matrix.python-version }}
        run: tox --installpkg ./dist/*.whl

      - name: ⬆️ Upload coverage data
        uses: actions/upload-artifact@v3
        with:
          name: coverage-data
          path: .coverage.*
          if-no-files-found: ignore
          retention-days: 1

  coverage:
    runs-on: ubuntu-latest
    needs: tests

    steps:
      - name: 🔒 Harden Runner
        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            files.pythonhosted.org:443
            github.com:443
            pypi.org:443
            api.github.com:443
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-python@v5
        with:
          # Use latest Python, so it understands all syntax.
          python-version: ${{env.PYTHON_LATEST}}

      - run: python -Im pip install --upgrade coverage

      - name: Download coverage data
        uses: actions/download-artifact@v3
        with:
          name: coverage-data

      - name: ＋  Combine coverage
        run: |
          python -Im coverage combine
          python -Im coverage html --skip-covered --skip-empty
          python -Im coverage report
          echo "## Coverage summary" >> $GITHUB_STEP_SUMMARY
          python -Im coverage report --format=markdown >> $GITHUB_STEP_SUMMARY
      - name: 📈 Upload HTML report if check failed.
        uses: actions/upload-artifact@v3
        with:
          name: html-report
          path: htmlcov