ci.yml

name: CI
on:
  pull_request: {}
  push:
    branches:
      - main
      - '*.*.x'
    tags:
      - '*.*'
      - '*.*.*'

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: true

jobs:
  linux:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        PYTHON:
          - {VERSION: "3.12", NOXSESSION: "flake"}
          - {VERSION: "pypy-3.9", NOXSESSION: "tests-nocoverage", TONGSUO: "8.4.0"}
          - {VERSION: "pypy-3.10", NOXSESSION: "tests-nocoverage", TONGSUO: "8.4.0"}
          - {VERSION: "3.12", NOXSESSION: "tests-randomorder", TONGSUO: "8.4.0"}
          - {VERSION: "3.12", NOXSESSION: "tests", TONGSUO: "8.4.0"}
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v3.1.0
        timeout-minutes: 3
        with:
          persist-credentials: false
      - name: Setup python
        id: setup-python
        uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5.1.1
        with:
          python-version: ${{ matrix.PYTHON.VERSION }}
          cache: pip
          cache-dependency-path: ci-constraints-requirements.txt
      - name: Set TONGSUO_HOME
        shell: bash
        run: echo "TONGSUO_HOME=${GITHUB_WORKSPACE}/tongsuo${VERSION}" >> $GITHUB_ENV
        env:
          VERSION: ${{ matrix.PYTHON.TONGSUO }}
        if: matrix.PYTHON.TONGSUO
      - name: Build custom Tongsuo
        working-directory: ${{ runner.temp }}
        run: |
          wget "https://github.com/Tongsuo-Project/Tongsuo/archive/refs/tags/${VERSION}.tar.gz"
          tar zxf "${VERSION}.tar.gz"
          pushd "Tongsuo-${VERSION}"
          ./config enable-ntls no-shared --prefix=${TONGSUO_HOME}
          make -s -j4
          make install_sw
          popd
        env:
          VERSION: ${{ matrix.PYTHON.TONGSUO }}
        if: matrix.PYTHON.TONGSUO

      - run: python -m pip install -c ci-constraints-requirements.txt 'nox' 'tomli; python_version < "3.11"'
      - name: Create nox environment
        run: |
          nox -v --install-only
        env:
          NOXSESSION: ${{ matrix.PYTHON.NOXSESSION }}

      - name: Tests
        run: |
          nox --no-install --  --color=yes
        env:
          NOXSESSION: ${{ matrix.PYTHON.NOXSESSION }}
          COLUMNS: 80
      - run: ls -l .nox
      - name: Cache nox output
        uses: actions/cache/save@v4
        if: ${{ matrix.PYTHON.NOXSESSION == 'tests' }} || ${{ matrix.PYTHON.NOXSESSION == 'tests-randomorder' }}
        with:
          path: .nox
          key: ${{ runner.os }}-nox-${{ matrix.PYTHON.NOXSESSION }}
      - uses: ./.github/actions/upload-coverage

  macos:
    runs-on: ${{ matrix.RUNNER.OS }}
    strategy:
      fail-fast: false
      matrix:
        RUNNER:
          - {OS: 'macos-13', ARCH: 'x86_64'}
          - {OS: 'macos-14', ARCH: 'arm64'}
        PYTHON:
          - {VERSION: "3.7", NOXSESSION: "tests-nocoverage"}
          - {VERSION: "3.12", NOXSESSION: "tests"}
        exclude:
          # We only test latest Python on arm64. py37 won't work since there's no universal2 binary
          - PYTHON: {VERSION: "3.7", NOXSESSION: "tests-nocoverage"}
            RUNNER: {OS: 'macos-14', ARCH: 'arm64'}
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v3.1.0
        timeout-minutes: 3
        with:
          persist-credentials: false
      - name: Setup python
        id: setup-python
        uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5.1.1
        with:
          python-version: ${{ matrix.PYTHON.VERSION }}
          cache: pip
          cache-dependency-path: ci-constraints-requirements.txt
        timeout-minutes: 3
      - run: python -m pip install -c ci-constraints-requirements.txt 'nox' 'tomli; python_version < "3.11"'
      - name: Set TONGSUO_HOME
        shell: bash
        run: echo "TONGSUO_HOME=${GITHUB_WORKSPACE}/tongsuo${VERSION}" >> $GITHUB_ENV
        env:
          VERSION: 8.4.0
      - name: Build custom Tongsuo
        run: |
          wget "https://github.com/Tongsuo-Project/Tongsuo/archive/refs/tags/${VERSION}.tar.gz"
          tar zxf "${VERSION}.tar.gz"
          pushd "Tongsuo-${VERSION}"
          ./config enable-ntls no-shared --prefix=${TONGSUO_HOME}
          make -s -j4
          make install_sw
          popd
        env:
          VERSION: 8.4.0
      - name: Build nox environment
        run: |
          nox -v --install-only
        env:
          NOXSESSION: ${{ matrix.PYTHON.NOXSESSION }}
      - name: Tests
        run: |
          # delete openssl/include installed in macos-12, fix cffi compile failed
          # rm -rf /usr/local/opt/openssl@1.1/include
          nox --no-install --  --color=yes
        env:
          NOXSESSION: ${{ matrix.PYTHON.NOXSESSION }}
          COLUMNS: 80

      - uses: ./.github/actions/upload-coverage

  windows:
    runs-on: windows-latest
    strategy:
      fail-fast: false
      matrix:
        WINDOWS:
          - { ARCH: 'x86', WINDOWS: 'win32', CONFIG: 'VC-WIN32' }
          - { ARCH: 'x64', WINDOWS: 'win64', CONFIG: 'VC-WIN64A' }
        PYTHON:
          - {VERSION: "3.7", NOXSESSION: "tests-nocoverage", TONGSUO: "8.4.0"}
          - {VERSION: "3.12", NOXSESSION: "tests", TONGSUO: "8.4.0"}
        JOB_NUMBER: [0, 1, 2]
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v3.1.0
        timeout-minutes: 3
        with:
          persist-credentials: false
      - run: choco install -y winrar
      - uses: ilammy/msvc-dev-cmd@v1
        with:
          arch: ${{ matrix.WINDOWS.WINDOWS }}
      - uses: ilammy/setup-nasm@v1
        with:
          platform: ${{ matrix.WINDOWS.WINDOWS }}
      - uses: shogo82148/actions-setup-perl@v1
      - name: Setup python
        id: setup-python
        uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5.1.1
        with:
          python-version: ${{ matrix.PYTHON.VERSION }}
          architecture: ${{ matrix.WINDOWS.ARCH }}
          cache: pip
          cache-dependency-path: ci-constraints-requirements.txt
        timeout-minutes: 3
      - run: python -m pip install -c ci-constraints-requirements.txt "nox" "tomli; python_version < '3.11'"
      - name: Export env
        shell: bash
        run: |
          echo "TONGSUO_VERSION=${VERSION}" >> $GITHUB_ENV
          echo "TONGSUO_HOME=${GITHUB_WORKSPACE}\tongsuo${VERSION}" >> $GITHUB_ENV
        env:
          VERSION: ${{ matrix.PYTHON.TONGSUO }}
      - name: Download Tongsuo source
        run: |
          wget "https://github.com/Tongsuo-Project/Tongsuo/archive/refs/tags/${env:TONGSUO_VERSION}.tar.gz" -OutFile "${env:TONGSUO_VERSION}.tar.gz"
        shell: powershell
      - run: '"C:\Program Files\WinRAR\WinRAR.exe" -INUL x ${{ matrix.PYTHON.TONGSUO }}.tar.gz'
        shell: cmd
      - name: Build custom Tongsuo
        shell: cmd
        run: |
          pushd "Tongsuo-${{ matrix.PYTHON.TONGSUO }}"
          mkdir _build
          pushd _build
          perl ..\Configure no-makedepend no-shared ${{ matrix.WINDOWS.CONFIG }} --prefix=%TONGSUO_HOME%
          nmake /S
          nmake install_sw
          popd
          popd
      - name: Build nox environment
        run: nox -v --install-only
        env:
          NOXSESSION: ${{ matrix.PYTHON.NOXSESSION }}
      - name: Tests
        run: |
          nox --no-install --  --color=yes
        env:
          NOXSESSION: ${{ matrix.PYTHON.NOXSESSION }}
          COLUMNS: 80
      - uses: ./.github/actions/upload-coverage

  all-green:
    # https://github.community/t/is-it-possible-to-require-all-github-actions-tasks-to-pass-without-enumerating-them/117957/4?u=graingert
    runs-on: ubuntu-latest
    needs: [linux, macos, windows]
    if: ${{ always() }}
    timeout-minutes: 3
    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        timeout-minutes: 3
        with:
          persist-credentials: false
      - name: Decide whether the needed jobs succeeded or failed
        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe
        with:
          jobs: ${{ toJSON(needs) }}
      - name: Setup python
        if: ${{ always() }}
        uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5.1.1
        with:
          python-version: '3.12'
          cache: pip
          cache-dependency-path: ci-constraints-requirements.txt
        timeout-minutes: 3
      - run: pip install -c ci-constraints-requirements.txt coverage[toml]
        if: ${{ always() }}
      - name: Download coverage data
        if: ${{ always() }}
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          pattern: coverage-data-*
          merge-multiple: true
      - name: Restore nox output
        uses: actions/cache/restore@v4
        with:
          path: .nox
          key: ${{ runner.os }}-nox
      - run: ls -l .nox
      - name: Combine coverage and fail if it's <85%.
        if: ${{ always() }}
        id: combinecoverage
        run: |
          set +e
          python -m coverage combine
          echo "## Python Coverage" >> $GITHUB_STEP_SUMMARY
          python -m coverage report -m --fail-under=85 > COV_REPORT
          COV_EXIT_CODE=$?
          cat COV_REPORT
          if [ $COV_EXIT_CODE -ne 0 ]; then
            echo "🚨 Python Coverage failed. Under 85" | tee -a $GITHUB_STEP_SUMMARY
          fi
          echo '```' >> $GITHUB_STEP_SUMMARY
          cat COV_REPORT >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
          exit $COV_EXIT_CODE
      - name: Create coverage HTML
        run: python -m coverage html
        if: ${{ failure() && steps.combinecoverage.outcome == 'failure' }}
      - name: Upload HTML report.
        uses: actions/upload-artifact@v3.1.1
        with:
          name: _html-report
          path: htmlcov
          if-no-files-found: ignore
        if: ${{ failure() && steps.combinecoverage.outcome == 'failure' }}