ci.yml

name: CI

on:
  push:
    branches:
      - main
  pull_request:
  schedule:
    - cron: '0 12 * * *'

jobs:
  test:
    permissions:
      # Needed to access the workflow's OIDC identity.
      id-token: write
    strategy:
      matrix:
        conf:
          - { py: "3.7", os: "ubuntu-latest" }
          - { py: "3.8", os: "ubuntu-latest" }
          - { py: "3.9", os: "ubuntu-latest" }
          - { py: "3.10", os: "ubuntu-latest" }
          - { py: "3.11", os: "ubuntu-latest" }
          # NOTE: We only test Windows and macOS on the latest Python;
          # these primarily exist to ensure that we don't accidentally
          # introduce Linux-isms into the development tooling.
          - { py: "3.11", os: "windows-latest" }
          - { py: "3.11", os: "macos-latest" }
    runs-on: ${{ matrix.conf.os }}
    steps:
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3

      - uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1
        with:
          python-version: ${{ matrix.conf.py }}
          cache: "pip"
          cache-dependency-path: pyproject.toml

      - name: deps
        run: make dev SIGSTORE_EXTRA=test

      - name: test (offline)
        if: matrix.conf.os == 'ubuntu-latest'
        run: |
          # We use `unshare` to "un-share" the default networking namespace,
          # in effect running the tests as if the host is offline.
          # This in turn effectively exercises the correctness of our
          # "online-only" test markers, since any test that's online
          # but not marked as such will fail.
          unshare --map-root-user --net make test TEST_ARGS="--skip-online -vv --showlocals"

      - name: test
        run: make test TEST_ARGS="-vv --showlocals"

      - name: test (interactive)
        if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
        run: make test-interactive TEST_ARGS="-vv --showlocals"

      - uses: ./.github/actions/upload-coverage
        # only aggregate test coverage over linux-based tests to avoid any OS-specific filesystem information stored in
        # coverage metadata.
        if: ${{ matrix.conf.os == 'ubuntu-latest' }}

  all-tests-pass:
    if: always()

    needs:
    - test

    runs-on: ubuntu-latest

    steps:
      - name: check test jobs
        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
        with:
          jobs: ${{ toJSON(needs) }}

  coverage:
    needs:
      - test

    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.2.0

      - uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1
        with:
          python-version: '3.x'

      - run: pip install coverage[toml]

      - name: download coverage data
        uses: actions/download-artifact@v3.0.2
        with:
          name: coverage-data

      - name: combine coverage data
        id: combinecoverage
        run: |
          set +e
          python -m coverage combine
          echo "## python coverage" >> $GITHUB_STEP_SUMMARY
          python -m coverage report -m --format=markdown >> $GITHUB_STEP_SUMMARY