python-push.yml

# This workflow will install Python dependencies, run tests and lint with a variety of Python versions
# For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions
name: Trestle Deploy

on:
  push:
    branches:
      - main

permissions: {}

jobs:
  set-versions:
    runs-on: ubuntu-latest
    outputs:
      min: ${{ steps.versions.outputs.min }}
      max: ${{ steps.versions.outputs.max }}
    steps:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
    - id: versions
      run: |
        min_version=$(jq '.PYTHON_MIN' -r version.json)
        max_version=$(jq '.PYTHON_MAX' -r version.json)
        echo "min=$min_version" 
        echo "max=$max_version"
        echo "min=$min_version" >> $GITHUB_OUTPUT
        echo "max=$max_version" >> $GITHUB_OUTPUT

  build:
    needs: set-versions
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        include:
        - os: ubuntu-latest
          pip-cache: ~/.cache/pip
          hatch-cache: ~/.cache/hatch
          hatch-data: ~/.local/share/hatch
        - os: macos-latest
          pip-cache: ~/Library/Caches/pip
          hatch-cache: ~/Library/Caches/hatch
          hatch-data: ~/Library/Application Support/hatch
        - os: windows-latest
          pip-cache: ~\AppData\Local\pip\Cache
          hatch-cache: ~\AppData\Local\hatch\Cache
          hatch-data: ~\AppData\Local\hatch
        python-version: [ '${{ needs.set-versions.outputs.min }}', '${{ needs.set-versions.outputs.max }}']

    steps:
    - name: Don't mess with line endings
      run: |
        git config --global core.autocrlf false
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        submodules: true
    - name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
      with:
        python-version: ${{ matrix.python-version }}
    - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
      with:
        path: |
          ${{ matrix.pip-cache }}
          ${{ matrix.hatch-cache }}
          ${{ matrix.hatch-data }}
        key: ${{ matrix.os }}-${{ matrix.python-version }}-hatch-${{ hashFiles('pyproject.toml') }}
        restore-keys: |
          ${{ matrix.os }}-${{ matrix.python-version }}-hatch-
    - name: Is core test version
      id: core-version
      run: echo "core=${{ (matrix.os == 'ubuntu-latest' && matrix.python-version == needs.set-versions.outputs.max ) }}" >> $GITHUB_OUTPUT

    - name: Install build tools
      run: |
        make develop
    - name: Setup pre-commit
      if: steps.core-version.outputs.core == 'true'
      run: |
        make pre-commit
    - name: Run md document formatting (mdformat)
      if: steps.core-version.outputs.core == 'true'
      run: |
        make mdformat
    - name: Run code formatting (ruff)
      if: steps.core-version.outputs.core == 'true'
      run: |
        make code-format
    - name: Run code linting (ruff)
      if: steps.core-version.outputs.core == 'true'
      run: |
        make code-lint
    - name: Run code typing check (mypy)
      if: steps.core-version.outputs.core == 'true'
      continue-on-error: true
      run: |
        make code-typing
    - name: Install documentation dependencies
      if: steps.core-version.outputs.core == 'true'
      run: |
        make docs-ubuntu-deps
    - name: Validate website content (mkdocs)
      if: steps.core-version.outputs.core == 'true'
      run: |
        make docs-validate
    - name: Recreate hatch test environment
      shell: bash
      run: |
        hatch env remove hatch-test.py${{ matrix.python-version }} 2>/dev/null || true
        hatch env create hatch-test.py${{ matrix.python-version }}
    - name: Pytest Fast
      if: steps.core-version.outputs.core != 'true'
      run: |
        make test
    - name: Pytest Cov
      if: steps.core-version.outputs.core == 'true'
      run: |
        make test-cov

  test-with-codegen:
    needs: set-versions
    runs-on: ubuntu-latest
    strategy:
      matrix:
        os: [ubuntu-latest]
        python-version: [ '${{ needs.set-versions.outputs.max }}' ]
        include:
        - os: ubuntu-latest
          pip-cache: ~/.cache/pip
          hatch-cache: ~/.cache/hatch
          hatch-data: ~/.local/share/hatch
    steps:
    - name: Don't mess with line endings
      run: |
        git config --global core.autocrlf false
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        fetch-depth: 0
        submodules: true
    - name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
      with:
        python-version: ${{ matrix.python-version }}
    - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
      with:
        path: |
          ${{ matrix.pip-cache }}
          ${{ matrix.hatch-cache }}
          ${{ matrix.hatch-data }}
        key: ${{ matrix.os }}-${{ matrix.python-version }}-hatch-${{ hashFiles('pyproject.toml') }}
        restore-keys: |
          ${{ matrix.os }}-${{ matrix.python-version }}-hatch-
    - name: Install hatch
      run: |
        make develop
    - name: gen OSCAL models
      run: |
        make gen-oscal
    - name: Recreate hatch test environment
      shell: bash
      run: |
        hatch env remove hatch-test.py${{ matrix.python-version }} 2>/dev/null || true
        hatch env create hatch-test.py${{ matrix.python-version }}
    - name: Run tests
      run: |
        make test
  deploy:
    runs-on: ubuntu-latest
    needs: [ build, test-with-codegen, set-versions ]
    permissions:
      id-token: write
      attestations: write
      contents: write   # <<< REQUIRED to attach provenance to GitHub Release
    environment:
      name: release
      url: https://pypi.org/p/compliance-trestle
    if: github.ref == 'refs/heads/main' && github.repository == 'oscal-compass/compliance-trestle'
    steps:
    - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
      id: app-token
      with:
        app-id: ${{ secrets.APP_ID }}
        private-key: ${{ secrets.PRIVATE_KEY }}
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        submodules: true
        fetch-depth: 0
        token: ${{ steps.app-token.outputs.token }}
    - name: Set up Python ${{ needs.set-versions.outputs.max }}
      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
      with:
        python-version: ${{ needs.set-versions.outputs.max }}
    - name: Install build tools
      run: |
        make develop

    - name: Python Semantic Release
      id: release
      uses: python-semantic-release/python-semantic-release@350c48fcb3ffcdfd2e0a235206bc2ecea6b69df0 # v10.5.3
      with:
        github_token: ${{ steps.app-token.outputs.token }}

    # --- Generate provenance for the ACTUAL RELEASE ARTIFACTS ---

    - name: Publish package distributions to PyPI
      uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1
      # NOTE: DO NOT wrap the conditional in ${{ }} as it will always evaluate to true.
      # See https://github.com/actions/runner/issues/1173
      if: steps.release.outputs.released == 'true'

    # Sign artifacts to be uploaded to github releases after pypi. Pypi signs it's own
    - uses: sigstore/gh-action-sigstore-python@v3.2.0
      if: steps.release.outputs.released == 'true'
      with:
        inputs: "dist/*"

    - name: Publish package distributions to GitHub Releases
      uses: python-semantic-release/upload-to-gh-release@0a92b5d7ebfc15a84f9801ebd1bf706343d43711 # v9.8.9
      if: steps.release.outputs.released == 'true'
      with:
        github_token: ${{ steps.app-token.outputs.token }}

  merge-main-to-develop:
    name: Merge main -> develop
    runs-on: ubuntu-latest
    needs: deploy
    concurrency:
      group: ${{ github.ref }}-${{ github.workflow }}-${{ github.job }}-main
      cancel-in-progress: true
    if: github.ref == 'refs/heads/main'
    steps:
    - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
      id: app-token
      with:
        app-id: ${{ secrets.APP_ID }}
        private-key: ${{ secrets.PRIVATE_KEY }}
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        submodules: true
        ref: main
        fetch-depth: 0
        token: ${{ steps.app-token.outputs.token }}
    - name: Get GitHub App User ID
      id: get-user-id
      run: echo "user-id=$(gh api "/users/${{ env.SLUG }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
      env:
        GH_TOKEN: ${{ steps.app-token.outputs.token }}
        SLUG: ${{ steps.app-token.outputs.app-slug }}
    - name: Configure Git
      run: |
        git config --global user.name '${{ env.SLUG }}[bot]'
        git config --global user.email '${{ env.ID }}+${{ env.SLUG }}[bot]@users.noreply.github.com'
      env:
        SLUG: ${{ steps.app-token.outputs.app-slug }}
        ID: ${{ steps.get-user-id.outputs.user-id }}
      # https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
    - name: Merge Main to Develop
      run: |
        git checkout develop
        git merge --no-ff main -m "chore: Merge back version tags and changelog into develop."
        git push origin develop