build-reusable.yml

# Environment variables defined in a calling workflow are not accessible to this reusable workflow. Refer to the documentation for further details on this limitation.
name: pypi_build_test_deploy
on:
  workflow_call:
    secrets:
      CODECOV_TOKEN:
        required: true
      ACTIONS_RUNNER_DEBUG:
        required: false
      ACTIONS_STEP_DEBUG:
        required: false
    inputs:
      Pure:
        required: false
        default: true
        type: boolean
      PyVersionLatest:
        required: true
        type: string
      PySourceFolder:
        required: true
        type: string
      PkgName:
        required: true
        type: string
      PkgRootFolder:
        # Relative to github.workspace
        required: false
        type: string
        default: ""
      CIBWBEFOREALLLINUX:
        required: false
        default: ''
        type: string
      CIBWBEFOREALLWINDOWS:
        required: false
        default: ''
        type: string
permissions:
  contents: read
jobs:
  CodeQualityAnalysis-Test:
    # TODO: Only debugging
    if: github.event_name != 'push'
    name: Static Analysis and Tests
    runs-on: windows-2019
    outputs:
      pypi_released: ${{ steps.pythonsemanticrelease.outputs.released }}
      pypi_version: ${{ steps.pythonsemanticrelease.outputs.version }}
      pypi_tag: ${{ steps.pythonsemanticrelease.outputs.tag }}
    steps:
    - uses: actions/checkout@v4.1.0
      with:
        lfs: true
        submodules: recursive
        # Python Semantic Release needs access to the full history to determine whether a release should be made.
        fetch-depth: 0
    - name: Use Python ${{inputs.PyVersionLatest}}
      uses: actions/setup-python@v5.0.0
      with:
        python-version: "${{inputs.PyVersionLatest}}"
        architecture: x64
    - name: Python Semantic Release Setup
      run: python -m pip install --upgrade python-semantic-release
      working-directory: "${{ github.workspace }}/${{inputs.PkgRootFolder}}"
    - name: Python Semantic Release
      id: pythonsemanticrelease
      working-directory: "${{ github.workspace }}/${{inputs.PkgRootFolder}}"
      # TODO: Patch only for testing
      run: semantic-release -vv -c python-semantic-release.json version --patch --changelog --no-commit --no-tag --no-push --no-vcs-release --skip-build
    - name: Environment Setup
      run: python -m pip install --upgrade --requirement requirements_test.txt
      working-directory: "${{ github.workspace }}/${{inputs.PkgRootFolder}}"
    - name: Check Python Versions Consistency
      # Only specify tox.ini and setup.py since .yml uses cibuildwheel
      run: check-python-versions ${{ github.workspace }}\${{inputs.PkgRootFolder}} --only tox.ini,setup.py
    - name: Black Static Analysis
      if: success() || failure()
      run: black -v --line-length 120 --safe --check --diff --color .
      working-directory: "${{ github.workspace }}/${{inputs.PySourceFolder}}"
    - name: Flake8 Static Analysis
      if: success() || failure()
      run: flake8 -v --config ${{ github.workspace }}\${{inputs.PkgRootFolder}}\setup.cfg .
      working-directory: "${{ github.workspace }}/${{inputs.PySourceFolder}}"
    - name: Pylint Static Analysis
      if: success() || failure()
      run: pylint_runner -v --rcfile ${{ github.workspace }}\${{inputs.PkgRootFolder}}\setup.cfg
      working-directory: "${{ github.workspace }}/${{inputs.PySourceFolder}}"
    - name: Mypy Static Analysis
      if: success() || failure()
      run: mypy -v --config-file ${{ github.workspace }}\${{inputs.PkgRootFolder}}\setup.cfg .
      working-directory: "${{ github.workspace }}/${{inputs.PySourceFolder}}"
    - name: Bandit Static Analysis
      if: success() || failure()
      run: bandit -v -r -c ${{ github.workspace }}\${{inputs.PkgRootFolder}}\bandit.yaml .
      working-directory: "${{ github.workspace }}/${{inputs.PySourceFolder}}"
    - name: Set TEMP to ${{ runner.temp }}
      if: success() || failure()
      run: echo "TEMP=${{ runner.temp }}" >> "$GITHUB_ENV"
      shell: bash
    - name: Set TMP to ${{ runner.temp }}
      if: success() || failure()
      run: echo "TMP=${{ runner.temp }}" >> "$GITHUB_ENV"
      shell: bash
    - name: Set TMPDIR to ${{ runner.temp }}
      if: success() || failure()
      run: echo "TMPDIR=${{ runner.temp }}" >> "$GITHUB_ENV"
      shell: bash
    - name: Unit and Integration Tests
      if: success() || failure()
      run: tox -vv -r -s false
      working-directory: "${{ github.workspace }}/${{inputs.PkgRootFolder}}"
      env:
        CovResultsPath: "${{ runner.temp }}\\cov_results\\cov.xml"
        TestResultsPath: "${{ runner.temp }}\\results"
    - name: List files
      run: dir
      working-directory: "${{ runner.temp }}\\cov_results"
    - name: Upload Coverage
      if: success() || failure()
      uses: codecov/codecov-action@v3
      with:
        # Hard copy from step above due to https://github.com/actions/runner/issues/2204
        directory: ${{ runner.temp }}/cov_results
        files: cov.xml
        fail_ci_if_error: true
        verbose: true
        # Only one flag to be safe with
        # https://docs.codecov.com/docs/flags#one-to-one-relationship-of-flags-to-uploads
        flags: ${{matrix.OS}}
        token: ${{ secrets.CODECOV_TOKEN }}
  PackageWheelsNonPure:
    name: Package Non-pure Wheels for ${{ matrix.config.OS }}
    runs-on: ${{ matrix.config.PoolImage }}
    strategy:
      matrix:
        config:
          - {
            PoolImage: ubuntu-latest,
            OS: Linux,
            CIBWBEFOREALL: '${{inputs.CIBWBEFOREALLLINUX}}',
          }
          - {
            PoolImage: windows-2019,
            OS: Windows,
            CIBWBEFOREALL: '${{inputs.CIBWBEFOREALLWindows}}',
          }
    steps:
    - uses: actions/checkout@v4.1.0
      with:
        lfs: true
        submodules: recursive
    - uses: "./.github/actions/steps_package"
      with:
        PyVersionLatest: "${{inputs.PyVersionLatest}}"
        PkgRootFolder: "${{ github.workspace }}/${{inputs.PkgRootFolder}}"
        OS: "${{matrix.config.OS}}"
        CIBWBEFOREALL: "${{matrix.config.CIBWBEFOREALL}}"
    if: inputs.Pure == false && github.event_name != 'push' # TODO: Only debugging
  PackageWheelsPure:
    name: Package Pure Wheels
    runs-on: windows-2019
    if: inputs.Pure == true && github.event_name != 'push' # TODO: Only debugging
    steps:
    - uses: actions/checkout@v4.1.0
      with:
        lfs: true
        submodules: recursive
    - name: Use Python ${{inputs.PyVersionLatest}}
      uses: actions/setup-python@v5.0.0
      with:
        python-version: "${{inputs.PyVersionLatest}}"
        architecture: x64
    - name: Environment Setup
      run: python -m pip install --upgrade --requirement requirements_deploy.txt
      working-directory: "${{ github.workspace }}/${{inputs.PkgRootFolder}}"
    - name: Build Distribution
      run: python setup.py bdist_wheel
      working-directory: "${{ github.workspace }}/${{inputs.PkgRootFolder}}"
    - name: Publish Wheel for Python ${{inputs.PyVersionLatest}}
      uses: actions/upload-artifact@v4.1.0
      with:
        name: Wheel${{inputs.PyVersionLatest}}
        path: "${{ github.workspace }}\\${{inputs.PkgRootFolder}}\\dist"
  PackageSDist:
    if: github.event_name != 'push' # TODO: Only debugging
    name: Package Source Distribution
    runs-on: windows-2019
    steps:
    - uses: actions/checkout@v4.1.0
      with:
        lfs: true
        submodules: recursive
    - name: Use Python ${{inputs.PyVersionLatest}}
      uses: actions/setup-python@v5.0.0
      with:
        python-version: "${{inputs.PyVersionLatest}}"
        architecture: x64
    - name: Environment Setup
      run: python -m pip install --upgrade --requirement requirements_deploy.txt
      working-directory: "${{ github.workspace }}/${{inputs.PkgRootFolder}}"
    - name: Build Distribution
      run: python setup.py sdist
      working-directory: "${{ github.workspace }}/${{inputs.PkgRootFolder}}"
    - name: Publish Sdist
      uses: actions/upload-artifact@v4.1.0
      with:
        name: Sdist
        path: "${{ github.workspace }}\\${{inputs.PkgRootFolder}}\\dist"
  DownloadTestWheelsPure:
    # No need to re-test wheels for non-pure wheels produced through cibuildwheel since already tested there
    # Can be tested anywhere since it is pure
    name: Test Wheel on windows-2019
    runs-on: windows-2019
    steps:
    - uses: actions/checkout@v4.1.0
      with:
        lfs: true
    - uses: "./.github/actions/steps_download"
      with:
        PyVersionLatest: "${{inputs.PyVersionLatest}}"
        ArtifactName: Wheel${{inputs.PyVersionLatest}}
        PkgRootFolder: "${{ github.workspace }}/${{inputs.PkgRootFolder}}"
        RunShell: cmd
    if: inputs.Pure == true && github.event_name != 'push' # TODO: Only debugging
    needs: PackageWheelsPure
  DownloadTestSdist:
    if: github.event_name != 'push' # TODO: Only debugging
    strategy:
      matrix:
        config:
          - {
            OS: ubuntu-latest,
            RunShell: bash,
          }
          - {
            OS: windows-2019,
            RunShell: cmd,
          }
    runs-on: ${{ matrix.config.OS }}
    steps:
    - uses: actions/checkout@v4.1.0
      with:
        lfs: true
    - uses: "./.github/actions/steps_download"
      with:
        PyVersionLatest: "${{inputs.PyVersionLatest}}"
        ArtifactName: Sdist
        PkgRootFolder: "${{ github.workspace }}/${{inputs.PkgRootFolder}}"
        RunShell: ${{ matrix.config.RunShell }}
    needs: PackageSDist
  Upload:
    permissions:
      contents: read
      # IMPORTANT: this permission is mandatory for trusted publishing
      id-token: write
    needs:
    - CodeQualityAnalysis-Test
    - DownloadTestSdist
    - DownloadTestWheelsPure
    - PackageWheelsNonPure
    - PackageWheelsPure
    - PackageSdist
    runs-on: windows-2019
    if: contains(fromJSON('["skipped", "success"]'), needs.DownloadTestSdist.result) && contains(fromJSON('["skipped", "success"]'), needs.DownloadTestWheelsPure.result) && contains(fromJSON('["skipped", "success"]'), needs.PackageWheelsNonPure.result) && contains(fromJSON('["skipped", "success"]'), needs.PackageWheelsPure.result) && contains(fromJSON('["skipped", "success"]'), needs.PackageSdist.result) && github.event_name != 'pull_request' && contains(fromJSON('["skipped", "success"]'), needs.CodeQualityAnalysis-Test.result) # && needs.CodeQualityAnalysis-Test.result == 'success' && needs.CodeQualityAnalysis-Test.outputs.pypi_released == 'true'
    environment:
      # TODO: Only for testing purposes
      # name: pypi
      # url: https://pypi.org/project/pylibCZIrw/${{needs.CodeQualityAnalysis-Test.outputs.pypi_version}}
      name: testpypi
      url: https://test.pypi.org/p/pylibCZIrw/${{needs.CodeQualityAnalysis-Test.outputs.pypi_version}}
    steps:
    - uses: actions/checkout@v4.1.0
    - name: Use Python ${{inputs.PyVersionLatest}}
      uses: actions/setup-python@v5.0.0
      with:
        python-version: "${{inputs.PyVersionLatest}}"
        architecture: x64
    - name: Environment Setup
      run: python -m pip install --upgrade --requirement requirements_deploy.txt
      working-directory: "${{ github.workspace }}/${{inputs.PkgRootFolder}}"
    - name: Download Wheels and Source Distribution
      uses: actions/download-artifact@v4.1.0
    - name: Collect Wheels and Source Distribution
      run: New-Item -Path "." -Name "dist" -ItemType "directory"; Get-ChildItem -Path ".\*.whl",".\*.tar.gz" -Recurse | Move-Item -Destination ".\dist"
      shell: powershell
    - name: Check Rendering
      run: twine check dist/*
    - name: Upload to PyPI
      # As of 06/2024, trusted publishing does not work within reusable workflows located in a different repo
      # Tracked in:
      # https://github.com/pypa/gh-action-pypi-publish/issues/166
      # https://github.com/pypi/warehouse/issues/11096
      # https://docs.pypi.org/trusted-publishers/troubleshooting/#reusable-workflows-on-github
      uses: pypa/gh-action-pypi-publish@release/v1
      with:
        # TODO: Only for testing purposes
        repository-url: https://test.pypi.org/legacy/
  Tag:
    permissions:
      contents: write
    needs: Upload
    runs-on: windows-2019
    steps:
    - uses: actions/checkout@v4.1.0
    - name: Tag with PyPI version
      uses: actions/github-script@v7
      with:
        script: |
          github.rest.git.createRef({
            owner: context.repo.owner,
            repo: context.repo.repo,
            ref: 'refs/tags/${{needs.CodeQualityAnalysis-Test.outputs.pypi_tag}}',
            sha: context.sha
          })