build.yml

name: python

on:
  push:
    branches:
    - main
  pull_request:
    branches:
    - main

permissions:
  checks: write
  contents: read
  id-token: write
  pull-requests: write
  pages: write

jobs:

  python:
    strategy:
      matrix:
        os:
        - macos-latest
        - ubuntu-latest
        - windows-latest
        python-version:
        - 3.11
        - 3.12
        - 3.13

    runs-on: ${{ matrix.os }}

    steps:

    - uses: actions/checkout@v4

    - uses: actions/setup-python@v5
      with:
        python-version: ${{ matrix.python-version }}

    - run: pip install -e .[dev]

    - run: ruff check .

    - run: ruff format --check .

    - run: isort --check .

    - run: pytest

    - run: pyright

    - run: python -m build --wheel

    - uses: haya14busa/action-cond@v1
      id: singleton
      with:
        cond: ${{ matrix.os == 'ubuntu-latest' && matrix.python-version == '3.12' && github.actor != 'dependabot[bot]' }}
        if_true: true

    - if: ${{ steps.singleton.outputs.value }}
      uses: EnricoMi/publish-unit-test-result-action@v2
      with:
        github_token: ${{ secrets.GITHUB_TOKEN }}
        junit_files: coverage.xml

    - if: ${{ steps.singleton.outputs.value }}
      uses: codecov/codecov-action@v5
      with:
        use_oidc: true

    - if: ${{ steps.singleton.outputs.value }}
      run: pytest -m e2e

    - uses: actions/upload-artifact@v4
      with:
        name: release-dists
        path: dist/
      if: ${{ steps.singleton.outputs.value }}

  pypi-publish:
    runs-on: ubuntu-latest
    needs: python
    if: ${{ github.ref == 'refs/heads/main' }}
    environment:
      name: pypi
      url: https://pypi.org/p/ptah-cli
    permissions:
      attestations: write
      contents: read
      id-token: write

    steps:

    - uses: actions/download-artifact@v4
      with:
        name: release-dists
        path: dist/

    -  uses: actions/attest-build-provenance@v2
       with:
         subject-path: dist/*.whl

    - uses: pypa/gh-action-pypi-publish@release/v1
      with:
        print-hash: true
        skip-existing: true