ci.yml

---
name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

env:
  FORCE_COLOR: "1" # Make tools pretty.
  PIP_DISABLE_PIP_VERSION_CHECK: 1
  PIP_NO_PYTHON_VERSION_WARNING: 1

permissions: {}


jobs:
  build-package:
    name: Build & verify package
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: hynek/build-and-inspect-python-package@v2

  tests:
    name: Tests & Mypy on ${{ matrix.python-version }}
    runs-on: ubuntu-latest
    needs: build-package
    strategy:
      matrix:
        python-version:
          - "3.7"
          - "3.8"
          - "3.9"
          - "3.10"
          - "3.11"
          - "3.12"
          - "pypy-3.7"
          - "pypy-3.8"
          - "pypy-3.9"
          - "pypy-3.10"

    steps:
      - name: Download pre-built packages
        uses: actions/download-artifact@v4
        with:
          name: Packages
          path: dist
      - run: tar xf dist/*.tar.gz --strip-components=1
      - uses: actions/setup-python@v5
        with:
          cache: pip
          python-version: ${{ matrix.python-version }}
          allow-prereleases: true

      - name: Prepare tox & run tests
        run: |
          V=${{ matrix.python-version }}
          if [[ "$V" = pypy-* ]]; then
            V=pypy3
          else
            V=py$(echo $V | tr -d .)
          fi

          echo TOX_PYTHON=$V >>$GITHUB_ENV

          python -Im pip install tox

      - run: |
          python -Im tox run \
            --installpkg dist/*.whl \
            -f ${{ env.TOX_PYTHON }}-tests
      - run: |
          python -Im tox run \
            --installpkg dist/*.whl \
            -f ${{ env.TOX_PYTHON }}-mypy
        if: ${{ !startsWith(matrix.python-version, 'pypy-') }}

      - name: Upload coverage data
        uses: actions/upload-artifact@v4
        with:
          name: coverage-data-${{ matrix.python-version }}
          path: .coverage.*
          if-no-files-found: ignore

  coverage:
    name: Combine & check coverage
    runs-on: ubuntu-latest
    needs: tests

    steps:
      - name: Download pre-built packages
        uses: actions/download-artifact@v4
        with:
          name: Packages
          path: dist
      - run: tar xf dist/*.tar.gz --strip-components=1
      - uses: actions/setup-python@v5
        with:
          cache: pip
          python-version-file: .python-version-default
      - uses: actions/download-artifact@v4
        with:
          pattern: coverage-data-*
          merge-multiple: true

      - name: Combine coverage & fail if it's <100%.
        run: |
          python -Im pip install coverage[toml]

          python -Im coverage combine
          python -Im coverage html --skip-covered --skip-empty

          # Report and write to summary.
          python -Im coverage report --format=markdown >> $GITHUB_STEP_SUMMARY

          # Report again and fail if under 100%.
          python -Im coverage report --fail-under=100

      - name: Upload HTML report if check failed.
        uses: actions/upload-artifact@v4
        with:
          name: html-report
          path: htmlcov
        if: ${{ failure() }}

  system-package:
    name: Install & test with system package of Argon2.
    runs-on: ubuntu-latest
    needs: build-package

    steps:
      - name: Download pre-built packages
        uses: actions/download-artifact@v4
        with:
          name: Packages
          path: dist
      - run: tar xf dist/*.tar.gz --strip-components=1
      - uses: actions/setup-python@v5
        with:
          cache: pip
          python-version-file: .python-version-default

      - name: Install dependencies
        run: |
          sudo apt-get install libargon2-0 libargon2-0-dev
          python -VV
          python -Im site
          python -Im pip install --upgrade wheel tox

      - run: python -Im tox run -e system-argon2

  mypy-pkg:
    name: Type-check code base
    runs-on: ubuntu-latest
    needs: build-package
    steps:
      - name: Download pre-built packages
        uses: actions/download-artifact@v4
        with:
          name: Packages
          path: dist
      - run: tar xf dist/*.tar.gz --strip-components=1
      - uses: actions/setup-python@v5
        with:
          cache: pip
          python-version-file: .python-version-default
      - run: python -Im pip install tox

      - run: python -Im tox run -e mypy-pkg

  pyright:
    name: Check code base & API w/ Pyright
    runs-on: ubuntu-latest
    needs: build-package

    steps:
      - name: Download pre-built packages
        uses: actions/download-artifact@v4
        with:
          name: Packages
          path: dist
      - run: tar xf dist/*.tar.gz --strip-components=1
      - uses: actions/setup-python@v5
        with:
          cache: pip
          python-version-file: .python-version-default

      - run: |
          python -Im venv .venv
          .venv/bin/python -Im pip install .[typing]
          echo "$PWD/.venv/bin" >> $GITHUB_PATH
      - uses: jakebailey/pyright-action@v1

  docs:
    name: Build docs & run doctests
    runs-on: ubuntu-latest
    needs: build-package
    steps:
      - name: Download pre-built packages
        uses: actions/download-artifact@v4
        with:
          name: Packages
          path: dist
      - run: tar xf dist/*.tar.gz --strip-components=1
      - uses: actions/setup-python@v5
        with:
          cache: pip
          # Keep in-sync with .readthedocs.yaml and tox.ini/docs.
          python-version: "3.12"

      - name: Prepare & run tox
        run: |
          python -Im pip install tox
          python -Im tox run -e docs

  install-dev:
    name: Verify dev env
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]

    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          cache: pip
          python-version-file: .python-version-default

      - name: Install in dev mode and run CLI
        run: |
         python -Im pip install -e .[dev]
         python -Im argon2 -n 1 -t 1 -m 8 -p 1

  # Ensure everything required is passing for branch protection.
  required-checks-pass:
    if: always()

    needs:
      - coverage
      - mypy-pkg
      - pyright
      - docs
      - install-dev
      - system-package

    runs-on: ubuntu-latest

    steps:
      - name: Decide whether the needed jobs succeeded or failed
        uses: re-actors/alls-green@release/v1
        with:
          jobs: ${{ toJSON(needs) }}