ci.yml

---
name: CI

# yamllint disable-line rule:truthy
on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

jobs:
  build:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ["3.8", "3.9", "3.10", "3.11"]
    steps:
      - uses: actions/checkout@v3
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v4
        with:
          python-version: ${{ matrix.python-version }}
      - name: Install Poetry
        uses: snok/install-poetry@v1
      - name: Install dependencies
        run: |
          poetry install
      - name: Lint
        run: |
          SKIP=no-commit-to-branch poetry run pre-commit run --all-files
      - name: Test coverage
        run: |
          poetry run pytest
      - uses: codecov/codecov-action@v3.1.1
        with:
          token: ${{secrets.CODECOV}}
          file: ./coverage.xml
          flags: unittests
          name: codecov-umbrella
  security:
    name: CodeQL
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    steps:
      - uses: actions/checkout@v3
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v2
        with:
          languages: python
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v2
  noop-release:
    name: Semantic Release Noop
    runs-on: ubuntu-latest
    needs:
      - build
      - security
    if: github.ref != 'refs/heads/main'
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0
      - name: Python Semantic Release Noop
        uses: relekang/python-semantic-release@v7.34.6
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          repository_username: __token__
          repository_password: ${{ secrets.PYPI_TOKEN }}
          additional_options: "--noop"
  release:
    name: Semantic Release
    runs-on: ubuntu-latest
    needs:
      - build
      - security
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0
      - name: Python Semantic Release
        uses: relekang/python-semantic-release@v7.34.6
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          repository_username: __token__
          repository_password: ${{ secrets.PYPI_TOKEN }}