.gitlab-ci.yml

# SPDX-FileCopyrightText: 2021 The eminus developers
# SPDX-License-Identifier: Apache-2.0
default:
  image: python:3.13-slim

stages:
  - test
  - fulltest
  - deploy
  - publish

.pytest:
  stage: test
  script:
    # Use the python3 -m prefix to make the commands work under different OS
    - python3 -m pip install .
    - python3 -m pip install pytest
    - python3 -m pytest tests/ -m "not slow"
  rules:
    - changes:
      - eminus/*.py
      - eminus/**/*.py
      - tests/*.py
      - tests/**/*.py

.pytest-full:
  extends: .pytest
  stage: fulltest
  when: manual
  # Allow failure in manual jobs, otherwise the pipeline status will be manual instead of passed
  # This would, e.g., block the creation of coverage reports
  allow_failure: true

############### test ###############

##### Create coverage reports #####
coverage:
  stage: test
  script:
    - pip install .
    - pip install coverage pyscf pytest
    - coverage run -m pytest tests/ --ignore=tests/examples --ignore=tests/extras
    - coverage report --precision=2
    - coverage html --precision=2
    - coverage xml
  coverage: '/TOTAL.*? (100(?:\.0+)?\%|[1-9]?\d(?:\.\d+)?\%)$/'
  artifacts:
    paths:
      - htmlcov/
    reports:
      coverage_report:
        coverage_format: cobertura
        path: coverage.xml
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH == "main"
      # Fix: Run coverage even if only the lint or pages job runs to prevent an unknown status badge
      # Reference: https://gitlab.com/gitlab-org/gitlab/-/issues/346779
      changes:
      - "*.py"
      - "**/*.py"
      - docs/*
      - docs/**/*

##### Lint Python files #####
lint:
  image: ghcr.io/astral-sh/ruff:alpine
  stage: test
  script:
    - ruff check
  rules:
    - changes:
      - "*.py"
      - "**/*.py"

##### Test the minimally supported versions #####
minimal:
  extends: .pytest
  image: python:3.7-slim
  before_script:
    - pip install numpy==1.17 scipy==1.6

##### Test using the newest dependency versions #####
newest:
  extends: .pytest
  rules:
    # Only run in the dev branch since this is just a subset of the coverage test
    - if: $CI_COMMIT_BRANCH == "dev"
      changes:
      - eminus/*.py
      - eminus/**/*.py
      - tests/*.py
      - tests/**/*.py

##### Type check Python files #####
typecheck:
  stage: test
  script:
    - pip install mypy[faster-cache] numpy
    - mypy . --disable-error-code="import-not-found" --disable-error-code="unused-ignore"
  rules:
    - changes:
      - "*.py"
      - "**/*.py"

############### fulltest ###############

##### Test the docker build #####
docker:
  extends: .pytest-full
  image: docker:latest
  services:
    - docker:dind
  script:
    # Use sed to get the version since CI_COMMIT_TAG is only non-empty when triggered for tags
    - VERSION=$(sed -n 's/^__version__ = "\(.*\)"/\1/p' eminus/version.py)
    - docker buildx build -t wangenau/eminus:"${VERSION}" --build-arg BRANCH=${CI_COMMIT_BRANCH:-main} .
    - docker run wangenau/eminus:"${VERSION}" bash -c "export OMP_NUM_THREADS=$(nproc);export MKL_NUM_THREADS=$(nproc);pytest"

##### Test the code installation after building #####
installation:
  extends: .pytest-full
  script:
    - pip install --upgrade pip
    - pip install build twine
    - python -m build
    # Do a check with twine
    - twine check dist/*
    # Copy the build directory to test the installation
    - cp -r dist/ tmp/
    - cd tmp/
    # Test the source distribution
    - tar -xf eminus-*.tar.gz
    - pip install eminus-*/.
    - python -c "import eminus; assert eminus.demo()"
    # Test the wheel
    - pip uninstall eminus -y
    - pip install eminus-*.whl
    - python -c "import eminus; assert eminus.demo()"
  artifacts:
    paths:
      - dist/

##### Test code functionality under Linux, macOS, NixOS, and Windows #####
platform:linux:
  extends: .pytest-full
  image: ubuntu:latest
  before_script:
    - apt-get update -y
    - apt-get install python3 python3-pip python3-venv -y --no-install-recommends
    - python3 -m venv .venv
    - source .venv/bin/activate

# Disabled due to removed image: https://github.com/sickcodes/Docker-OSX/issues/799
# platform:macos:
#   extends: .pytest-full
#   image: sickcodes/docker-osx:latest
#   before_script:
#     - python3 -m ensurepip

platform:nixos:
  extends: .pytest-full
  image: nixpkgs/nix:latest
  script:
    # In the CI nix develop will open a shell and close it immediately afterwards, use -c to execute commands
    - nix --extra-experimental-features "nix-command flakes" develop -c pytest tests/ -m "not slow"

platform:windows:
  extends: .pytest-full
  tags:
    - saas-windows-medium-amd64
  before_script:
    # Reference: https://gitlab.com/gitlab-org/ci-cd/shared-runners/images/gcp/windows-containers/-/issues/13
    - Import-Module "$env:ChocolateyInstall\helpers\chocolateyProfile.psm1"
    - choco install python -y --no-progress
    - refreshenv
    - Set-Alias -Name python3 -Value python

##### Test code functionality for all supported Python versions #####
python:
  extends: .pytest-full
  image: python:$PYTHON_VERSIONS-slim
  parallel:
    matrix:
      - PYTHON_VERSIONS: ['3.8', '3.9', '3.10', '3.11', '3.12']

############### deploy ###############

##### Build documentation #####
pages:
  stage: deploy
  needs: ["coverage"]
  script:
    - pip install .
    - pip install furo notebook sphinx sphinx-design sphinxcontrib-bibtex
    # Build Sphinx documentation
    - sphinx-build -j "$(nproc)" -b html ./docs ./public
    # Convert notebooks to HTML
    - find examples -name '*.ipynb' -exec jupyter nbconvert --to html {} --template classic \;
    - find examples -name '*.html' -exec mv {} public/_static \;
    # Minify all text files
    - apt-get update -y
    - apt-get install minify -y --no-install-recommends
    - find public \( -name '*.css' -o -name '*.js' -o -name '*.svg' \) -exec minify -vo {} {} \;
    - find public -name '*.html' -exec minify -vo {} {} --html-keep-document-tags --html-keep-end-tags --html-keep-whitespace \;
    # Compress all text files
    - find public \( -name '*.css' -o -name '*.html' -o -name '*.js' -o -name '*.svg' \) -exec gzip -vrk9 {} \;
    # Copy the coverage artifacts
    # For the dev build we do not generate a coverage report, fail without an error in that case
    - cp -r htmlcov/ public/ || true
  artifacts:
    paths:
      - public/
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH == "main"
      changes:
      - docs/*
      - docs/**/*
      - examples/*
      - examples/**/*
      - eminus/version.py

##### Build the documentation for the dev branch under a different URL #####
pages:dev:
  extends: pages
  # Overwrite the pages needs
  needs: []
  after_script:
    - echo "dev pages available at https://$CI_PROJECT_NAMESPACE.gitlab.io/-/$CI_PROJECT_NAME/-/jobs/$CI_JOB_ID/artifacts/public/index.html"
  rules:
    - if: $CI_COMMIT_BRANCH == "dev"
      changes:
      - docs/*
      - docs/**/*
      - examples/*
      - examples/**/*
      - eminus/version.py
  variables:
    PUBLIC_URL: "/-/$CI_PROJECT_NAME/-/jobs/$CI_JOB_ID/artifacts/public"

############### publish ###############

##### Publish the package to Docker Hub #####
dockerhub:
  image: docker:latest
  stage: publish
  services:
    - docker:dind
  needs:
    - job: docker
      optional: true
  script:
    - echo -n $DOCKER_ACCESS_TOKEN | docker login -u wangenau --password-stdin
    # Use sed to get the version since CI_COMMIT_TAG is only non-empty when triggered for tags
    - VERSION=$(sed -n 's/^__version__ = "\(.*\)"/\1/p' eminus/version.py)
    # Build the image with full attestations and push it directly
    - docker buildx create --driver=docker-container --name container default
    - docker buildx build -t wangenau/eminus:"${VERSION}" --builder=container --sbom=true --provenance=true --push .
  rules:
    - if: $CI_COMMIT_BRANCH == "main" || $CI_COMMIT_TAG
      when: manual
      allow_failure: true

##### Publish the package to PyPI #####
pypi:
  stage: publish
  needs:
    - job: installation
      optional: true
  id_tokens:
    PYPI_ID_TOKEN:
      aud: pypi
  script:
    - apt-get update -y
    - apt-get install curl jq -y --no-install-recommends
    - pip install id twine
    # Reference: https://github.com/pypi/warehouse/issues/13575#issuecomment-1961187837
    - OIDC_TOKEN=$(python -m id PYPI)
    - RESP=$(curl -X POST https://pypi.org/_/oidc/mint-token -d "{\"token\":\"${OIDC_TOKEN}\"}")
    - API_TOKEN=$(jq --raw-output '.token' <<< "${RESP}")
    - twine upload -u __token__ -p "${API_TOKEN}" dist/*
  rules:
    - if: $CI_COMMIT_BRANCH == "main" || $CI_COMMIT_TAG
      when: manual
      allow_failure: true