ci.yaml

#
# GitHub actions to test chevah-compat.
#
# Available VMs. Don't use `-latest` as we want to pin an OS version.
# https://help.github.com/en/actions/reference/virtual-environments-for-github-hosted-runners
#
# Available images https://github.com/actions/runner-images
#
# When running a tmate debug session you might need to increase the
# timeout-minutes for each build.

name: CI

on:
  push:
    branches: [ master ]
  pull_request:

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

defaults:
  run:
    shell: bash


jobs:

  # Try to run using oldest Ubuntu version available on GitHub
  ubuntu-old-unicode-path:
    # The type of runner that the job will run on
    runs-on: ubuntu-20.04
    timeout-minutes: 30

    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:

    # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
    - uses: actions/checkout@v4

    - name: Cache build
      uses: actions/cache@v4
      with:
        path: |
          build-py3
        key: ${{ runner.os }}-${{ hashFiles('pavement.py') }}-${{ hashFiles('pythia.conf') }}-unicode

    - name: Deps
      run: ./pythia.sh deps

    - uses: chevah/python-info-action@v1
      with:
        python-path: build-py3/bin/python

    - name: Move build to Unicode path
      run: mv build-py3 build-py3-ț

    - name: Tmate debug on failure
      if: ${{ !cancelled() && runner.debug }}
      uses: chevah/action-tmate@v3
      with:
        limit-access-to-actor: true

    - name: Test pynose
      run: |
        ./pythia.sh test_ci2
      env:
        CHEVAH_BUILD: build-py3-ț

    - name: Test pytest
      run: |
        ./pythia.sh pytest
      env:
        CHEVAH_BUILD: build-py3-ț

    - name: Test pytest elevated
      run: |
        sudo -E ./pythia.sh pytest src/chevah_compat/tests/elevated/
      env:
        CHEVAH_BUILD: build-py3-ț

    - name: Move build back to to ascii
      run: mv build-py3-ț build-py


  # Try to run with latest Ubuntu version available on GitHub
  ubuntu-latest-ascii-path:
    runs-on: ubuntu-24.04
    timeout-minutes: 30

    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:
    # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
    - uses: actions/checkout@v4
      with:
        fetch-depth: 2

    - name: Fail on skip-ci
      if: ${{ github.event.after }}
      run: git log -1 --pretty=format:"%s" ${{ toJSON(github.event.after) }} | grep -v 'skip-ci'

    - name: Cache build
      uses: actions/cache@v4
      with:
        path: |
          build-py3
        key: ${{ runner.os }}-${{ hashFiles('pavement.py') }}-${{ hashFiles('pythia.conf') }}-ascii

    - name: Deps
      run: ./pythia.sh deps

    - name: Tmate debug on failure
      if: ${{ !cancelled() && runner.debug }}
      uses: chevah/action-tmate@v3
      with:
        limit-access-to-actor: true

    - name: Test
      run: ./pythia.sh test_ci2
      env:
        CODECOV_TOKEN: enabled

    - name: Test pytest
      run: |
        ./pythia.sh pytest

    - name: Test pytest elevated
      run: |
        sudo -E ./pythia.sh pytest src/chevah_compat/tests/elevated/

    - name: Publish cov
      run: ./pythia.sh codecov_publish
      env:
        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

    - name: Lint
      run: ./pythia.sh lint --no-cache


  macos-m1-unicode-path:
    strategy:
      fail-fast: false
      matrix:
        runs-on: [ macos-14 ]
    runs-on: ${{ matrix.runs-on }}
    timeout-minutes: 30
    steps:
    - uses: actions/checkout@v4

    - name: Cache build
      uses: actions/cache@v4
      with:
        path: |
          build-py3
        key: ${{ runner.os }}-${{ hashFiles('pavement.py') }}-${{ hashFiles('pythia.conf') }}-unicode

    - name: Deps
      run: ./pythia.sh deps

    - name: Move build to Unicode path
      run: mv build-py3 build-py3-ț

    - name: Tmate debug on failure
      if: ${{ !cancelled() && runner.debug }}
      uses: chevah/action-tmate@v3
      with:
        limit-access-to-actor: true

    - name: Test
      run: ./pythia.sh test_ci2
      env:
        CHEVAH_BUILD: build-py3-ț
        CODECOV_TOKEN: enabled

    - name: Move build back to to ascii
      run: mv build-py3-ț build-py3

    - name: Publish cov
      run: ./pythia.sh codecov_publish
      env:
        CODECOV_TOKEN: enabled

    - name: Deps
      run: |
        ./pythia.sh deps
        ./pythia.sh build

    - name: Tmate debug on failure
      if: ${{ !cancelled() && runner.debug }}
      uses: chevah/action-tmate@v3
      with:
        limit-access-to-actor: true

    - name: Test
      run: ./pythia.sh test_ci2
      env:
        CODECOV_TOKEN: enabled

    - name: Test pytest
      run: |
        ./pythia.sh pytest

    - name: Test pytest elevated
      run: |
        sudo -E ./pythia.sh pytest src/chevah_compat/tests/elevated/

    - name: Publish cov
      run: ./pythia.sh codecov_publish
      env:
        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

    - name: Lint
      run: ./pythia.sh lint --no-cache


  windows:
    runs-on: 'windows-2022'
    timeout-minutes: 120

    steps:
    - uses: actions/checkout@v4

    - name: Cache build
      uses: actions/cache@v4
      with:
        path: |
          build-py3
        key: ${{ runner.os }}-${{ hashFiles('pavement.py') }}-${{ hashFiles('pythia.conf') }}

    - name: Deps
      run: |
        ./pythia.sh deps
        ./pythia.sh build

    - name: Tmate debug on failure
      if: ${{ !cancelled() && runner.debug }}
      uses: chevah/action-tmate@v3
      with:
        limit-access-to-actor: true

    # FIXME:691:
    # We should have just a single test step here to run all the tests in one
    # go.
    # Not sure why on Windows the normal tests are not discovered by default.
    - name: Test normal
      run: |
        ./pythia.sh test -vs normal
      env:
        CODECOV_TOKEN: enabled
        USER: runneradmin

    - name: Test elevated
      run: |
        ./pythia.sh test_ci2 elevated
      env:
        CODECOV_TOKEN: enabled
        USER: runneradmin

    - name: Test pytest
      run: |
        ./pythia.sh pytest
      env:
        USER: runneradmin

    - name: Test pytest elevated
      run: |
        ./pythia.sh pytest src/chevah_compat/tests/elevated/
      env:
        USER: runneradmin

    - name: Public coverage
      if: ${{ !cancelled() }}
      run: ./pythia.sh codecov_publish
      env:
        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

    - name: Lint
      run: ./pythia.sh lint --no-cache


  docker:

    name: docker-${{ matrix.container }}
    container: ${{ matrix.container }}
    env:
      CHEVAH_REPO: compat
      USER: chevah
      CHEVAH_CONTAINER: yes
    defaults:
      run:
        shell: sh
    strategy:
      fail-fast: false
      matrix:
        container:
          - alpine:3.16
          - amazonlinux:2022
          - oraclelinux:8
          - rockylinux:9
          - ubuntu:22.04
          - ubuntu:24.04

    # ubuntu-latest is GitHub's newest well-suported Linux distro.
    runs-on: ubuntu-latest
    timeout-minutes: 15
    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:

    - name: Alpine setup
      if: startsWith(matrix.container, 'alpine')
      run: apk add git bash shadow sudo curl tar

    - name: Amazon Linux 2022 setup
      if: matrix.container == 'amazonlinux:2022' || matrix.container == 'rockylinux:9'
      run: yum -y install libxcrypt-compat findutils

    - name: Yum-based setup
      if: startsWith(matrix.container, 'rocky') || startsWith(matrix.container, 'amazon') || startsWith(matrix.container, 'oracle')
      run: yum -y install git tar which sudo

    - name: Ubuntu setup
      if: startsWith(matrix.container, 'ubuntu')
      run: |
        apt-get update
        apt-get dist-upgrade -y
        apt-get install -y git curl sudo

    # On a Docker container, everything runs as root by default.
    - name: Chevah user setup
      run: |
        useradd -g adm -s /bin/bash -m chevah
        echo '%adm    ALL=NOPASSWD: ALL' > /etc/sudoers

    - uses: actions/checkout@v4

    - name: Cache build
      uses: actions/cache@v4
      with:
        path: |
          build-py3
        key: ${{ runner.os }}-${{ hashFiles('pavement.py') }}-${{ hashFiles('pythia.conf') }}-${{ matrix.container }}

    - name: Deps
      run: |
        chown -R chevah .
        su chevah -c "./pythia.sh deps"

    - uses: chevah/python-info-action@v1
      with:
        python-path: build-py3/bin/python

    - name: Build
      run: |
        su chevah -c "./pythia.sh build"

    - name: Test
      run: |
        su chevah -c "./pythia.sh test_ci2"


  # Helper so that on GitHub repo settings we can configure a single job as
  # required.
  ci-required:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    if: always()
    needs:
      - ubuntu-old-unicode-path
      - ubuntu-latest-ascii-path
      - macos-m1-unicode-path
      - windows
      - docker
    steps:
      - name: Require all successes
        shell: python3 {0}
        env:
          RESULTS: ${{ toJSON(needs.*.result) }}
        run: |
          import json
          import os
          import sys
          results = json.loads(os.environ["RESULTS"])
          sys.exit(0 if all(result == "success" for result in results) else 1)