ci_workflows.yml

name: CI

on:
  push:
  pull_request:
  schedule:
    # Weekly Tuesday 6AM build
    # * is a special character in YAML so you have to quote this string
    - cron: '0 6 * * 2'
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  PYSYN_CDBS: "https://ssb.stsci.edu/trds"

jobs:
  initial_check:
    name: Mandatory checks before CI
    runs-on: ubuntu-latest
    steps:
    - name: Check base branch
      uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea  # v7.0.1
      if: github.event_name == 'pull_request'
      with:
        script: |
          const allowed_basebranch = 'master';
          const pr = context.payload.pull_request;
          if (pr.base.ref !== allowed_basebranch) {
            core.setFailed(`PR opened against ${pr.base.ref}, not ${allowed_basebranch}`);
          } else {
            core.info(`PR opened correctly against ${allowed_basebranch}`);
          }

  # The rest only run if above are done

  tests:
    name: ${{ matrix.name }}
    runs-on: ${{ matrix.os }}
    needs: initial_check
    strategy:
      fail-fast: false
      matrix:
        include:

          - name: Code style checks
            os: ubuntu-latest
            python: 3.x
            toxenv: codestyle

          - name: PEP 517 build
            os: ubuntu-latest
            python: 3.x
            toxenv: twine

          - name: Security audit
            os: ubuntu-latest
            python: 3.x
            toxenv: bandit

          - name: Link check
            os: ubuntu-latest
            python: 3.x
            toxenv: linkcheck

          - name: Test without optional deps
            os: ubuntu-latest
            python: 3.9
            toxenv: py39-test

          - name: Coverage test with remote data
            os: ubuntu-latest
            python: '3.10'
            toxenv: py310-test-alldeps-cov
            toxposargs: --remote-data

          - name: Test with dev dependencies
            os: ubuntu-latest
            python: '3.12'
            toxenv: py312-test-devdeps

          - name: Test with old dependencies
            os: ubuntu-20.04
            python: 3.9
            toxenv: py39-test-oldestdeps

          - name: Test in OSX
            os: macos-latest
            python: '3.10'
            toxenv: py310-test

          # NOTE: If TRDS cannot take the hit, disable --remote-data
          - name: Test in Windows with remote data
            os: windows-latest
            python: '3.11'
            toxenv: py311-test
            toxposargs: --remote-data

    steps:
    - name: Checkout code
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
      with:
        fetch-depth: 0
    - name: Set up Python
      uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b  # v5.3.0
      with:
        python-version: ${{ matrix.python }}
    - name: Install Python dependencies
      run: |
        python -m pip install --upgrade pip tox
    - name: Run tests
      run: tox -e ${{ matrix.toxenv }} -- ${{ matrix.toxposargs }}
    - name: Upload coverage to codecov
      if: ${{ contains(matrix.toxenv,'-cov') }}
      uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238  # v4.6.0
      with:
        file: ./coverage.xml