python-ci.yaml

# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

# GitHub recommends pinning actions to a commit SHA.
# To get a newer version, you will need to update the SHA.
# You can also reference a tag or branch, but the action may change without warning.

name: CI/CD

on:
  workflow_call:
    inputs:
      test-enabled:
        required: false
        type: boolean
        default: true
        description: 'Should run tests?'
      test-architecture:
        required: false
        type: string
        default: 'amd64'
        description: 'Architecture to use for running tests'
      test-distribution:
        required: false
        type: string
        default: 'trixie'
        description: 'Distribution to use for running tests'
      test-overlay:
        required: false
        type: string
        default: ''
        description: 'Overlay to use for running tests'
      test-timeout:
        required: false
        type: number
        default: 10
        description: 'Test timeout in seconds'
      coverage-enabled:
        required: false
        type: boolean
        default: true
        description: 'Should run with coverage?'
      coverage-comment-enabled:
        required: false
        type: boolean
        default: true
        description: 'Should post coverage comment?'
      coverage-threshold:
        required: false
        type: number
        default: 95
        description: 'Minimum coverage threshold'
      package-architecture:
        required: false
        type: string
        default: '["armhf", "arm64", "amd64"]'
        description: 'Architecture to run builds on (must be valid JSON array format)'
      package-distribution:
        required: false
        type: string
        default: '["bookworm", "trixie"]'
        description: 'Distribution to run builds on (must be valid JSON array format)'
      package-overlay:
        required: false
        type: string
        default: ''
        description: 'Overlay to use for packaging'
      package-type:
        required: false
        type: string
        default: 'wheel, fpm-deb'
        description: 'Packaging types'
      tag-latest:
        required: false
        type: boolean
        default: true
        description: 'Should tag the latest commit with "latest" tag?'
    secrets:
      access-token:
        required: false

concurrency:
  group: ${{ github.workflow }}-${{ github.sha }}
  cancel-in-progress: true

env:
  GITHUB_TOKEN_TO_USE: ${{ secrets.access-token || github.token }}
  GITHUB_ACTION: "TRUE"

jobs:
  test:
    name: Run tests
    if: ${{ inputs.test-enabled }}
    runs-on: ubuntu-latest
    permissions:
      contents: write
      discussions: write
      pull-requests: write

    steps:
      - name: Checkout with submodules
        uses: actions/checkout@v5
        with:
          submodules: true
          token: ${{ env.GITHUB_TOKEN_TO_USE }}

      - name: Set up QEMU for multi-architecture builds
        uses: docker/setup-qemu-action@v3

      - name: Build and test
        uses: devcontainers/ci@v0.3
        with:
          subFolder: "${{ github.workspace }}"
          configFile: .devcontainer/${{ inputs.test-architecture }}-${{ inputs.test-distribution }}${{ inputs.test-overlay && format('-{0}', inputs.test-overlay) }}-container/devcontainer.json
          push: never
          runCmd: |
            if [ ${{ inputs.test-architecture }} == "amd64" ]; then
              dpkgdeps -v . || { echo "dpkgdeps install exited with $?"; exit 1; }

              python3 -m venv --system-site-packages /tmp/venv && source /tmp/venv/bin/activate
            
              pip install -v --no-build-isolation .[dev] || { echo "pip install exited with $?"; exit 1; }
            
              if [ -f requirements.txt ]; then
                pip install -v --no-build-isolation -r requirements.txt || { echo "pip install requirements.txt exited with $?"; exit 1; }
              fi
            
              pip install mypy flake8 pytest pytest-timeout wheel pytest-console-scripts
              python3 -m mypy --install-types --non-interactive || true
              python3 -m mypy || { echo "mypy exited with $?"; exit 1; }
              python3 -m flake8 || { echo "flake exited with $?"; exit 1; }

              if [ ${{ inputs.coverage-enabled }} == true ]; then
                pip install coverage
                python3 -m coverage run -m pytest --timeout=${{ inputs.test-timeout }} || { echo "pytest exited with $?"; exit 1; }
              else
                python3 -m pytest --timeout=${{ inputs.test-timeout }} || { echo "pytest exited with $?"; exit 1; }
              fi
            else
              dpkgdeps -v --arch ${{ inputs.test-architecture }} . || { echo "dpkgdeps install exited with $?"; exit 1; }

              WORKSPACE="/workspaces/$(basename ${{ github.workspace }})"
              BUILDROOT="/var/chroot/buildroot"

              sudo rsync -av --mkpath "${WORKSPACE}/" "${BUILDROOT}${WORKSPACE}/"

              sudo schroot -p -c buildroot -- python3 -m venv --system-site-packages /tmp/venv
            
              sudo schroot -p -c buildroot -- /tmp/venv/bin/pip install -v --no-build-isolation .[dev] || { echo "pip install exited with $?"; exit 1; }
            
              if [ -f "${WORKSPACE}/requirements.txt" ]; then
                sudo schroot -p -c buildroot -- /tmp/venv/bin/pip install -v --no-build-isolation -r "${WORKSPACE}/requirements.txt" || { echo "pip install requirements.txt exited with $?"; exit 1; }
              fi
            
              sudo schroot -p -c buildroot -- /tmp/venv/bin/pip install mypy flake8 pytest pytest-timeout wheel pytest-console-scripts
              sudo schroot -p -c buildroot -- /tmp/venv/bin/mypy --install-types --non-interactive || true
              sudo schroot -p -c buildroot -- /tmp/venv/bin/mypy || { echo "mypy exited with $?"; exit 1; }
              sudo schroot -p -c buildroot -- /tmp/venv/bin/flake8 || { echo "flake exited with $?"; exit 1; }

              if [ ${{ inputs.coverage-enabled }} == true ]; then
                sudo schroot -p -c buildroot -- /tmp/venv/bin/pip install coverage
                sudo schroot -p -c buildroot -- /tmp/venv/bin/coverage run -m pytest --timeout=${{ inputs.test-timeout }} || { echo "pytest exited with $?"; exit 1; }
              else
                sudo schroot -p -c buildroot -- /tmp/venv/bin/pytest --timeout=${{ inputs.test-timeout }} || { echo "pytest exited with $?"; exit 1; }
              fi
            fi

      - name: Coverage comment
        if: ${{ inputs.coverage-enabled && inputs.coverage-comment-enabled }}
        uses: py-cov-action/python-coverage-comment-action@v3
        with:
          GITHUB_TOKEN: ${{ github.token }}

      - name: Enforce minimum coverage
        if: ${{ inputs.coverage-enabled }}
        id: coverage-gate
        run: |
          python3 -m venv --system-site-packages /tmp/venv && source /tmp/venv/bin/activate
          pip install coverage
          python3 -m coverage report --show-missing --fail-under=${{ inputs.coverage-threshold }}

  build_wheel:
    name: Create wheel package
    if: always() && (needs.test.result == 'success' || needs.test.result == 'skipped') && contains(format(',{0},', inputs.package-type), ',wheel,')
    needs: test
    runs-on: ubuntu-latest
    permissions:
      contents: write
      discussions: write
    steps:
      - name: Checkout with submodules
        uses: actions/checkout@v5
        with:
          submodules: true
          token: ${{ env.GITHUB_TOKEN_TO_USE }}

      - name: Create package
        uses: devcontainers/ci@v0.3
        with:
          subFolder: "${{ github.workspace }}"
          configFile: .devcontainer/amd64-bookworm${{ inputs.package-overlay && format('-{0}', inputs.package-overlay) }}-container/devcontainer.json
          push: never
          runCmd: |
            dpkgdeps -v .

            sudo pack_python . -s wheel || { echo "pack_python exited with $?"; exit 1; }

      - name: Upload package
        if: startsWith(github.ref, 'refs/tags/')
        uses: actions/upload-artifact@v4
        with:
          name: ${{ github.event.repository.name }}_wheel
          path: dist/*.whl
          if-no-files-found: error

  build_wheel-deb:
    name: Create debian package with wheel and venv
    if: always() && (needs.test.result == 'success' || needs.test.result == 'skipped') && contains(inputs.package-type, 'wheel-deb')
    needs: test
    runs-on: ubuntu-latest
    strategy:
      matrix:
        architecture: ${{ fromJson(inputs.package-architecture) }}
        distribution: ${{ fromJson(inputs.package-distribution) }}
    permissions:
      contents: write
      discussions: write
    steps:
      - name: Checkout with submodules
        uses: actions/checkout@v5
        with:
          submodules: true
          token: ${{ env.GITHUB_TOKEN_TO_USE }}

      - name: Set up QEMU for multi-architecture builds
        uses: docker/setup-qemu-action@v3

      - name: Create package
        uses: devcontainers/ci@v0.3
        with:
          subFolder: "${{ github.workspace }}"
          configFile: .devcontainer/amd64-${{ matrix.distribution }}${{ inputs.package-overlay && format('-{0}', inputs.package-overlay) }}-container/devcontainer.json
          push: never
          runCmd: |
            sudo apt install -y build-essential

            dpkgdeps -v .

            sudo pack_python . -s wheel-deb -t ${{ matrix.architecture }} || { echo "pack_python exited with $?"; exit 1; }
            
            for package in $(find dist -name *.deb)
            do
              sudo mv -vf $package $(dirname $package)/${{ matrix.distribution }}_$(basename $package)
            done

      - name: Upload package
        if: startsWith(github.ref, 'refs/tags/')
        uses: actions/upload-artifact@v4
        with:
          name: ${{ github.event.repository.name }}_wheel-deb_${{ matrix.architecture }}_${{ matrix.distribution }}
          path: dist/*.deb
          if-no-files-found: error

  build_fpm-deb:
    name: Create debian package with FPM
    if: always() && (needs.test.result == 'success' || needs.test.result == 'skipped') && contains(inputs.package-type, 'fpm-deb')
    needs: test
    runs-on: ubuntu-latest
    strategy:
      matrix:
        distribution: ${{ fromJson(inputs.package-distribution) }}
    permissions:
      contents: write
      discussions: write
    steps:
      - name: Checkout with submodules
        uses: actions/checkout@v5
        with:
          submodules: true
          token: ${{ env.GITHUB_TOKEN_TO_USE }}

      - name: Create package
        uses: devcontainers/ci@v0.3
        with:
          subFolder: "${{ github.workspace }}"
          configFile: .devcontainer/amd64-${{ matrix.distribution }}${{ inputs.package-overlay && format('-{0}', inputs.package-overlay) }}-container/devcontainer.json
          push: never
          runCmd: |
            dpkgdeps -v .

            sudo pack_python . -s fpm-deb || { echo "pack_python exited with $?"; exit 1; }

            for package in $(find dist -name *.deb)
            do
              sudo mv -vf $package $(dirname $package)/${{ matrix.distribution }}_$(basename $package)
            done

      - name: Upload package
        if: startsWith(github.ref, 'refs/tags/')
        uses: actions/upload-artifact@v4
        with:
          name: ${{ github.event.repository.name }}_fpm-deb_${{ matrix.distribution }}
          path: dist/*.deb
          if-no-files-found: error

  build_dh-virtualenv:
    name: Create debian package with dh-virtualenv
    if: always() && (needs.test.result == 'success' || needs.test.result == 'skipped') && contains(inputs.package-type, 'dh-virtualenv')
    needs: test
    runs-on: ubuntu-latest
    strategy:
      matrix:
        architecture: ${{ fromJson(inputs.package-architecture) }}
        distribution: ${{ fromJson(inputs.package-distribution) }}
    permissions:
      contents: write
      discussions: write
    steps:
      - name: Checkout with submodules
        uses: actions/checkout@v5
        with:
          submodules: true
          token: ${{ env.GITHUB_TOKEN_TO_USE }}

      - name: Set up QEMU for multi-architecture builds
        uses: docker/setup-qemu-action@v3

      - name: Create package
        uses: devcontainers/ci@v0.3
        with:
          subFolder: "${{ github.workspace }}"
          configFile: .devcontainer/${{ matrix.architecture }}-${{ matrix.distribution }}${{ inputs.package-overlay && format('-{0}', inputs.package-overlay) }}-container/devcontainer.json
          push: never
          runCmd: |
            dpkgdeps -v --arch ${{ matrix.architecture }} .

            sudo pack_python . -s dh-virtualenv -t ${{ matrix.architecture }} || { echo "pack_python exited with $?"; exit 1; }

            for package in $(find dist -name *.deb)
            do
              sudo mv -vf $package $(dirname $package)/${{ matrix.distribution }}_$(basename $package)
            done

      - name: Upload package
        if: startsWith(github.ref, 'refs/tags/')
        uses: actions/upload-artifact@v4
        with:
          name: ${{ github.event.repository.name }}_dh-virtualenv_${{ matrix.architecture }}_${{ matrix.distribution }}
          path: dist/*.deb
          if-no-files-found: error

  release:
    name: Create release
    if: |
      always() && startsWith(github.ref, 'refs/tags/') &&
      (needs.build_wheel.result == 'success' || needs.build_wheel.result == 'skipped') &&
      (needs.build_wheel-deb.result == 'success' || needs.build_wheel-deb.result == 'skipped') &&
      (needs.build_fpm-deb.result == 'success' || needs.build_fpm-deb.result == 'skipped') &&
      (needs.build_dh-virtualenv.result == 'success' || needs.build_dh-virtualenv.result == 'skipped')
    needs: [ build_wheel, build_wheel-deb, build_fpm-deb, build_dh-virtualenv ]
    runs-on: ubuntu-latest
    permissions:
      contents: write
      discussions: write
    steps:
      - name: Checkout with submodules
        uses: actions/checkout@v5
        with:
          submodules: true
          token: ${{ env.GITHUB_TOKEN_TO_USE }}

      - name: Tag latest
        shell: bash
        if: ${{ inputs.tag-latest }}
        run: |
          COMMIT_SHA=$(git rev-parse HEAD)
          gh api "repos/${GITHUB_REPOSITORY}/git/refs/tags/latest" \
            --method PATCH -F force=true -f sha="${COMMIT_SHA}" ||
          gh api "repos/${GITHUB_REPOSITORY}/git/refs" \
            --method POST -f ref="refs/tags/latest" -f sha="${COMMIT_SHA}"
        env:
          GH_TOKEN: ${{ github.token }}

      - name: Download artifacts
        uses: actions/download-artifact@v5
        with:
          merge-multiple: true
          path: ${{ github.workspace }}/dist

      - name: Create release
        if: ${{ startsWith(github.ref, 'refs/tags/') }}
        uses: softprops/action-gh-release@v2
        with:
          fail_on_unmatched_files: false
          generate_release_notes: true
          make_latest: true
          files: |
            dist/*.deb
            dist/*.whl