config.yml

version: 2.1
orbs:
  docker: circleci/docker@2.1.4

jobs:
  build:
    environment:
      - TZ: "/usr/share/zoneinfo/America/Los_Angeles"
      - MRIQC_API_TAG: 1.1.0
      - MRIQC_API_DOCKER_IMAGES: "nginx:latest swaggerapi/swagger-ui:latest mongo:latest
          python:3.7-slim"
    machine:
      # https://discuss.circleci.com/t/linux-machine-executor-images-2021-april-q2-update/39928
      # upgrade Docker version
      image: ubuntu-2204:2023.02.1
      docker_layer_caching: true
    working_directory: /tmp/src/mriqc
    steps:
      - checkout
      - persist_to_workspace:
          root: /tmp
          paths:
            - src/mriqc
      - run:
          name: Check whether build should be skipped
          command: |
            if [[ "$( git log --format='format:%s' -n 1 $CIRCLE_SHA1 | grep -i -E '^docs?(\(\w+\))?:' )" != "" ]]; then
              echo "Only docs build"
              circleci step halt
            fi
      - restore_cache:
          keys:
            - build-v4-{{ .Branch }}-{{ .Revision }}
            - build-v4--{{ .Revision }}
            - build-v4-{{ .Branch }}-
            - build-v4-master-
            - build-v4-
          paths:
            - /tmp/docker
            - /tmp/images
      - docker/install-docker-credential-helper
      - run:
          name: Docker authentication
          command: |
            if [[ -n $DOCKER_PAT ]]; then
              echo "$DOCKER_PAT" | docker login -u $DOCKER_USER --password-stdin
            fi
      - run:
          name: Set up Docker registry
          command: |
            if [[ -f /tmp/images/registry.tar.gz ]]; then
              echo "Loading saved registry image"
              docker load < /tmp/images/registry.tar.gz
            else
              echo "Pulling registry image from DockerHub"
              docker pull registry:2
              mkdir -p /tmp/images
              docker save registry:2 | gzip > /tmp/images/registry.tar.gz
            fi
            docker run -d -p 5000:5000 --restart=always --name=registry \
                -v /tmp/docker:/var/lib/registry registry:2
      - run:
          name: Pull images
          command: |
            set +e
            docker pull localhost:5000/miniconda
            success=$?
            set -e
            if [[ "$success" = "0" ]]; then
                echo "Pulling from local registry"
                docker tag localhost:5000/miniconda nipreps/miniconda:py39_2403.0
                docker pull localhost:5000/mriqc
                docker tag localhost:5000/mriqc nipreps/mriqc:latest
                docker tag localhost:5000/mriqc nipreps/mriqc
            else
                echo "Pulling from Docker Hub"
                docker pull nipreps/miniconda:py39_2403.0
                docker tag nipreps/miniconda:py39_2403.0 localhost:5000/miniconda
                docker push localhost:5000/miniconda
                docker pull nipreps/mriqc:latest
            fi

      - run:
          name: MRIQCWebAPI - Pull Docker images
          command: |
            webapi_images=($MRIQC_API_DOCKER_IMAGES)
            for image in ${webapi_images[@]}; do
                set +e
                docker pull localhost:5000/${image}
                success=$?
                set -e
                if [[ "$success" = "0" ]]; then
                    docker tag localhost:5000/${image} ${image}
                else
                    docker pull ${image}
                    docker tag ${image} localhost:5000/${image}
                    docker push localhost:5000/${image}
                fi
            done;

      - run:
          name: Prepare MRIQCWebAPI
          command: |
            set +e
            docker pull localhost:5000/dockereve-master-endpoints:latest
            success=$?
            set -e
            if [[ "$success" = 0 ]]; then
                docker tag localhost:5000/dockereve-master-endpoints:latest dockereve-master-endpoints:latest
            fi

            rm -rf /tmp/src/mriqcwebapi
            git clone https://github.com/nipreps/mriqcwebapi.git /tmp/src/mriqcwebapi
            cd /tmp/src/mriqcwebapi
            git checkout ${MRIQC_API_TAG}
            if [ "${MRIQC_API_SECRET_TOKEN}" != "" ]; then
              sed -i -E "s/<secret_token>/$MRIQC_API_SECRET_TOKEN/" dockereve-master/.env
              grep -q -i $MRIQC_API_SECRET_TOKEN dockereve-master/.env
            fi
            docker-compose -f /tmp/src/mriqcwebapi/dockereve-master/docker-compose.yml pull
            docker-compose -f /tmp/src/mriqcwebapi/dockereve-master/docker-compose.yml build

            docker tag dockereve-master-endpoints:latest localhost:5000/dockereve-master-endpoints:latest
            docker push localhost:5000/dockereve-master-endpoints:latest
      - run:
          name: Build Docker image
          no_output_timeout: 60m
          command: |
            python3 -m pip install hatch

            # Get version before making repo dirty
            THISVERSION=$( python3 -m hatch version )
            # Inject MRIQC-WebAPI secret
            if [ "${MRIQC_API_SECRET_TOKEN}" != "" ]; then
              sed -i -E "s/<secret_token>/$MRIQC_API_SECRET_TOKEN/" mriqc/config.py
              grep -q -i $MRIQC_API_SECRET_TOKEN mriqc/config.py
            fi

            if [[ ${THISVERSION:0:1} == "0" ]] ; then
              echo "WARNING: latest git tag could not be found"
              echo "Please, make sure you fetch all tags from upstream with"
              echo "the command ``git fetch --tags --verbose`` and push"
              echo "them to your fork with ``git push origin --tags``"
            fi

            # Build docker image
            e=1 && for i in {1..5}; do
              docker build \
                --cache-from=nipreps/mriqc \
                -t nipreps/mriqc:latest \
                --build-arg BUILD_DATE=`date -u +"%Y-%m-%dT%H:%M:%SZ"` \
                --build-arg VCS_REF=`git rev-parse --short HEAD` \
                --build-arg VERSION="${CIRCLE_TAG:-$THISVERSION}" . \
              && e=0 && break || sleep 15
            done && [ "$e" -eq "0" ]
      - run:
          name: Docker push to local registry
          no_output_timeout: 40m
          command: |
            docker tag nipreps/mriqc:latest localhost:5000/mriqc
            docker push localhost:5000/mriqc
            webapi_images=($MRIQC_API_DOCKER_IMAGES)
            for image in ${webapi_images[@]}; do
                docker tag ${image} localhost:5000/${image}
                docker push localhost:5000/${image}
            done
      - run:
          name: Docker registry garbage collection
          command: |
            docker exec -it registry /bin/registry garbage-collect --delete-untagged \
              /etc/docker/registry/config.yml
      - save_cache:
          key: build-v4-{{ .Branch }}-{{ .Revision }}
          paths:
            - /tmp/docker
            - /tmp/images
      - persist_to_workspace:
          root: /tmp
          paths:
            - src/mriqc
            - src/mriqcwebapi

  get_data:
    machine:
      image: ubuntu-2204:2023.02.1
    environment:
      - TZ: "/usr/share/zoneinfo/America/Los_Angeles"
      - TEST_DATA_NAME: "circle-tests"
      - TEST_DATA_URL: "https://files.osf.io/v1/resources/fvuh8/providers/osfstorage/5b\
          6c9950fed49e001a7885b6"
    working_directory: /home/circleci/data
    steps:
      - checkout:
          path: /tmp/src/mriqc
      - run:
          name: Check whether build should be skipped
          command: |
            cd /tmp/src/mriqc
            if [[ "$( git log --format='format:%s' -n 1 $CIRCLE_SHA1 | grep -i -E '^docs?(\(\w+\))?:' )" != "" ]]; then
              echo "Only docs build"
              circleci step halt
            fi
      - restore_cache:
          keys:
            - data-v2-{{ epoch }}
            - data-v2-
      - run:
          name: Get test data
          command: |
            mkdir -p /tmp/data
            if [[ ! -d /tmp/data/${TEST_DATA_NAME} ]]; then
              wget --retry-connrefused --waitretry=5 --read-timeout=20 --timeout=15 -t 0 -q \
                -O ${TEST_DATA_NAME}.tar.gz "${TEST_DATA_URL}"
              tar xvzf ${TEST_DATA_NAME}.tar.gz -C /tmp/data/
            else
              echo "Dataset ${TEST_DATA_NAME} was cached"
            fi
      - run:
          name: Create Nipype config files
          command: |
            mkdir -p /tmp/t1w /tmp/bold
            printf "[execution]\nstop_on_first_crash = true\n" > /tmp/t1w/nipype.cfg
            echo "poll_sleep_duration = 0.01" >> /tmp/t1w/nipype.cfg
            echo "hash_method = content" >> /tmp/t1w/nipype.cfg
            cp /tmp/t1w/nipype.cfg /tmp/bold/nipype.cfg
      - save_cache:
          key: data-v2-{{ epoch }}
          paths:
            - /tmp/data
            - /tmp/t1w
            - /tmp/bold

  test_pytest:
    machine:
      image: ubuntu-2204:2023.02.1
    working_directory: /home/circleci/out/tests
    steps:
      - attach_workspace:
          at: /tmp
      - run:
          name: Check whether build should be skipped
          command: |
            cd /tmp/src/mriqc
            if [[ "$( git log --format='format:%s' -n 1 $CIRCLE_SHA1 | grep -i -E '^docs?(\(\w+\))?:' )" != "" ]]; then
              echo "Only docs build"
              circleci step halt
            fi
            if [[ "$( git log --format=oneline -n 1 $CIRCLE_SHA1 | grep -i -E '\[only[ _]?(anat|func|smoke)\]' )" != "" ]]; then
              echo "Only smoke-tests build"
              circleci step halt
            fi
      - restore_cache:
          keys:
            - build-v4-{{ .Branch }}-{{ .Revision }}
          paths:
            - /tmp/docker
            - /tmp/images
      - docker/install-docker-credential-helper
      - run:
          name: Docker authentication
          command: |
            if [[ -n $DOCKER_PAT ]]; then
              echo "$DOCKER_PAT" | docker login -u $DOCKER_USER --password-stdin
            fi
      - run:
          name: Set-up a Docker registry
          command: |
            if [[ -f /tmp/images/registry.tar.gz ]]; then
              echo "Loading saved registry image"
              docker load < /tmp/images/registry.tar.gz
            else
              echo "Pulling registry image from DockerHub"
              docker pull registry:2
            fi
            docker run -d -p 5000:5000 --restart=always --name=registry \
                -v /tmp/docker:/var/lib/registry registry:2
      - run:
          name: Pull images from local registry
          command: |
            docker pull localhost:5000/mriqc
            docker tag localhost:5000/mriqc nipreps/mriqc:latest
      - run:
          name: Generate _version.py
          command: |
            python3 -m pip install build

            pushd /tmp/src/mriqc
            python3 -m build
            popd
      - run:
          name: Run MRIQC tests
          no_output_timeout: 2h
          command: |
            docker run --rm -ti -v $PWD:/scratch --entrypoint="pytest" \
              -v /tmp/src:/src -w /src/mriqc \
              nipreps/mriqc:latest mriqc \
              --junitxml=/scratch/tests.xml \
              --doctest-modules --ignore=mriqc/bin \
              --ignore=mriqc/interfaces/transitional.py
      - store_test_results:
          path: /home/circleci/out/tests

  T1w:
    environment:
      - TZ: "/usr/share/zoneinfo/America/Los_Angeles"
      - TEST_DATA_NAME: "circle-tests"
      - MRIQC_API_DOCKER_IMAGES: "nginx:latest swaggerapi/swagger-ui:latest mongo:latest
          python:3.7-slim dockereve-master-endpoints:latest"
      - MIGAS_OPTOUT: "1"
    machine:
      # https://discuss.circleci.com/t/linux-machine-executor-images-2021-april-q2-update/39928
      # upgrade Docker version
      image: ubuntu-2204:2023.02.1
    resource_class: large
    working_directory: /tmp/t1w
    steps:
      - attach_workspace:
          at: /tmp
      - run:
          name: Check whether build should be skipped
          command: |
            cd /tmp/src/mriqc
            if [[ "$( git log --format='format:%s' -n 1 $CIRCLE_SHA1 | grep -i -E '^docs?(\(\w+\))?:' )" != "" ]]; then
              echo "Only docs build"
              circleci step halt
            fi
            if [[ "$( git log --format=oneline -n 1 $CIRCLE_SHA1 | grep -i -E '\[only[ _]?func\]' )" != "" ]]; then
              echo "Only functional smoke-tests build"
              circleci step halt
            fi
      - restore_cache:
          keys:
            - build-v4-{{ .Branch }}-{{ .Revision }}
          paths:
            - /tmp/docker
            - /tmp/images
      - run:
          name: Set-up a Docker registry
          command: |
            if [[ -f /tmp/images/registry.tar.gz ]]; then
              echo "Loading saved registry image"
              docker load < /tmp/images/registry.tar.gz
            else
              echo "Pulling registry image from DockerHub"
              docker pull registry:2
            fi
            docker run -d --restart=always --name=registry \
                -e REGISTRY_HTTP_ADDR=0.0.0.0:5001 -p 5001:5001 \
                -v /tmp/docker:/var/lib/registry registry:2
      - run:
          name: Pull images from local registry
          command: |
            docker pull localhost:5001/mriqc
            docker tag localhost:5001/mriqc nipreps/mriqc:latest

            webapi_images=($MRIQC_API_DOCKER_IMAGES)
            for image in ${webapi_images[@]}; do
                docker pull localhost:5001/${image}
                docker tag localhost:5001/${image} ${image}
            done;
      - run:
          name: Start MRIQC WebAPI endpoint
          command: |
            docker-compose -f /tmp/src/mriqcwebapi/dockereve-master/docker-compose.yml --verbose up -d
          background: true
      - restore_cache:
          keys:
            - data-v2-{{ epoch }}
            - data-v2-
      - restore_cache:
          keys:
            - t1w-v6-{{ .Branch }}
            - t1w-v6-master
            - t1w-v6-

      - run:
          name: Remove old, cached configs
          command: |
            rm -f /tmp/t1w/work/.mriqc.*.toml
            rm -f /tmp/t1w/work/.resources.*.tsv
            rm -f /tmp/t1w/work/.resources.*.png

      - run:
          name: Run participant-level on T1w images
          no_output_timeout: 2h
          command: |
            mkdir -p /tmp/t1w/work /tmp/t1w/derivatives
            # Run MRIQC
            docker run -u $( id -u ) --rm -ti \
                       -v /tmp/data/${TEST_DATA_NAME}:/data:ro \
                       -v /tmp/t1w:/scratch -w /scratch \
                       nipreps/mriqc:latest \
                       /data derivatives/ participant \
                       -vv --verbose-reports --profile -m T1w --dsname circletests \
                       --resource-monitor \
                       --n_procs 2 --ants-nthreads 1 --ants-float \
                       --webapi-url http://$( hostname -I | awk '{print $1}' )/api/v1 --upload-strict

      - run:
          name: Move temporary but relevant artifacts
          command: |
            mkdir /tmp/t1w/misc
            mv /tmp/t1w/work/.mriqc.*.toml /tmp/t1w/misc
            mv /tmp/t1w/work/.resources.*.tsv /tmp/t1w/misc
            mv /tmp/t1w/work/.resources.*.png /tmp/t1w/misc

      - store_artifacts:
          path: /tmp/t1w/misc

      - save_cache:
          key: t1w-v6-{{ .Branch }}
          paths:
            - /tmp/t1w/work

      - run:
          name: Run group-level on T1w images
          no_output_timeout: 2h
          command: |
            docker run -u $( id -u ) --rm -ti \
                       -v /tmp/data/${TEST_DATA_NAME}:/data:ro \
                       -v /tmp/t1w:/scratch -w /scratch \
                       nipreps/mriqc:latest \
                       /data derivatives/ group \
                       -m T1w -vv

      - store_artifacts:
          path: /tmp/t1w/derivatives

      - run:
          name: Checking presence of outputs
          command: |
            mkdir -p /tmp/t1w/test
            find /tmp/t1w/derivatives | sed s+/tmp/t1w/derivatives/++ | sort > /tmp/t1w/test/outputs.out
            diff /tmp/src/mriqc/.circleci/circle_T1w.txt /tmp/t1w/test/outputs.out
            exit $?

      - run:
          name: Clean-up work directory (just leave reports & commandlines)
          command: |
            find /tmp/t1w/work -type f -not -name "report.rst" -and -not -name "command.txt" -delete

      - store_artifacts:
          path: /tmp/t1w/work

      - run:
          name: Checking changes on IQMs
          command: |
            docker run --rm -ti -v $PWD:/scratch -w /scratch -v /tmp/src:/src \
              --entrypoint="dfcheck" nipreps/mriqc:latest \
              -i /scratch/derivatives/group_T1w.tsv \
              -r /src/mriqc/mriqc/data/testdata/group_T1w.tsv \
            || true  # ignore failure

      - run:
          name: WebAPI - Check records
          command: |
            docker run --rm -ti \
              --entrypoint="/opt/conda/bin/mriqcwebapi_test" \
              nipreps/mriqc:latest \
              T1w 4 \
              --webapi-url http://$( hostname -I | awk '{print $1}' )/api/v1/T1w

      - store_artifacts:
          path: /tmp/t1w/test

  bold:
    environment:
      - TZ: "/usr/share/zoneinfo/America/Los_Angeles"
      - TEST_DATA_NAME: "circle-tests"
      - MRIQC_API_DOCKER_IMAGES: "nginx:latest swaggerapi/swagger-ui:latest mongo:latest
          python:3.7-slim dockereve-master-endpoints:latest"
      - MIGAS_OPTOUT: "1"
    machine:
      # https://discuss.circleci.com/t/linux-machine-executor-images-2021-april-q2-update/39928
      # upgrade Docker version
      image: ubuntu-2204:2023.02.1
    working_directory: /tmp/bold
    steps:
      - attach_workspace:
          at: /tmp
      - run:
          name: Check whether build should be skipped
          command: |
            cd /tmp/src/mriqc
            if [[ "$( git log --format='format:%s' -n 1 $CIRCLE_SHA1 | grep -i -E '^docs?(\(\w+\))?:' )" != "" ]]; then
              echo "Only docs build"
              circleci step halt
            fi
            if [[ "$( git log --format=oneline -n 1 $CIRCLE_SHA1 | grep -i -E '\[only[ _]?anat\]' )" != "" ]]; then
              echo "Only anatomical smoke-tests build"
              circleci step halt
            fi
      - restore_cache:
          keys:
            - build-v4-{{ .Branch }}-{{ .Revision }}
          paths:
            - /tmp/docker
            - /tmp/images
      - run:
          name: Set-up a Docker registry
          command: |
            if [[ -f /tmp/images/registry.tar.gz ]]; then
              echo "Loading saved registry image"
              docker load < /tmp/images/registry.tar.gz
            else
              echo "Pulling registry image from DockerHub"
              docker pull registry:2
            fi
            docker run -d --restart=always --name=registry \
                -e REGISTRY_HTTP_ADDR=0.0.0.0:5001 -p 5001:5001 \
                -v /tmp/docker:/var/lib/registry registry:2
      - run:
          name: Pull images from local registry
          command: |
            docker pull localhost:5001/mriqc
            docker tag localhost:5001/mriqc nipreps/mriqc:latest

            webapi_images=($MRIQC_API_DOCKER_IMAGES)
            for image in ${webapi_images[@]}; do
                docker pull localhost:5001/${image}
                docker tag localhost:5001/${image} ${image}
            done;
      - run:
          name: Start MRIQC WebAPI endpoint
          command: |
            docker-compose -f /tmp/src/mriqcwebapi/dockereve-master/docker-compose.yml --verbose up -d
          background: true

      - restore_cache:
          keys:
            - data-v2-{{ epoch }}
            - data-v2-
      - restore_cache:
          keys:
            - bold-v5-{{ .Branch }}
            - bold-v5-master
            - bold-v5-

      - run:
          name: Remove old, cached configs
          command: |
            rm -f /tmp/bold/work/.mriqc.*.toml
            rm -f /tmp/bold/work/.resources.*.tsv
            rm -f /tmp/bold/work/.resources.*.png

      - run:
          name: Run participant-level on BOLD images
          no_output_timeout: 2h
          command: |
            mkdir -p /tmp/bold/work /tmp/bold/derivatives
            # Run MRIQC
            docker run -u $( id -u ) --rm -ti -v /tmp/data/${TEST_DATA_NAME}:/data:ro \
                       -v $PWD:/scratch -w /scratch \
                       nipreps/mriqc:latest \
                       /data derivatives/ participant \
                       -vv --verbose-reports --profile -m bold --dsname circletests \
                       --n_procs 2 --ants-nthreads 1 --ants-float \
                       --resource-monitor --testing \
                       --webapi-url http://$( hostname -I | awk '{print $1}' )/api/v1 --upload-strict
      - run:
          name: Move temporary but relevant artifacts
          command: |
            mkdir /tmp/bold/misc
            mv /tmp/bold/work/.mriqc.*.toml /tmp/bold/misc
            mv /tmp/bold/work/.resources.*.tsv /tmp/bold/misc
            mv /tmp/bold/work/.resources.*.png /tmp/bold/misc

      - store_artifacts:
          path: /tmp/bold/misc

      - save_cache:
          key: bold-v5-{{ .Branch }}
          paths:
            - /tmp/bold/work

      - run:
          name: Run group-level on BOLD images
          no_output_timeout: 2h
          command: |
            docker run -u $( id -u ) --rm -ti -v /tmp/data/${TEST_DATA_NAME}:/data:ro \
                       -v $PWD:/scratch -w /scratch \
                       nipreps/mriqc:latest \
                       /data derivatives/ group \
                       -m bold -vv

      - store_artifacts:
          path: /tmp/bold/derivatives

      - run:
          name: Checking presence of outputs
          command: |
            mkdir -p /tmp/bold/test
            find /tmp/bold/derivatives | sed s+/tmp/bold/derivatives/++ | sort > /tmp/bold/test/outputs.out
            diff /tmp/src/mriqc/.circleci/circle_bold.txt /tmp/bold/test/outputs.out
            exit $?

      - run:
          name: Clean-up work directory (just leave reports & commandlines)
          command: |
            find /tmp/bold/work -type f -not -name "report.rst" -and -not -name "command.txt" -delete

      - store_artifacts:
          path: /tmp/bold/work

      - run:
          name: Checking changes on IQMs
          command: |
            docker run -u $( id -u ) --rm -ti -v /tmp/src:/src -v $PWD:/scratch -w /scratch \
              --entrypoint="dfcheck" nipreps/mriqc:latest \
              -i /scratch/derivatives/group_bold.tsv \
              -r /src/mriqc/mriqc/data/testdata/group_bold.tsv

      - run:
          name: WebAPI - Check records
          command: |
            docker run --rm -ti \
              --entrypoint="/opt/conda/bin/mriqcwebapi_test" \
              nipreps/mriqc:latest \
              bold 9 \
              --webapi-url http://$( hostname -I | awk '{print $1}' )/api/v1/bold

      - store_artifacts:
          path: /tmp/bold/test
    # The resource_class feature allows configuring CPU and RAM resources for each job. Different resource classes are available for different executors. https://circleci.com/docs/2.0/configuration-reference/#resourceclass
    resource_class: large

  build_docs:
    docker:
      - image: cimg/python:3.10
    environment:
      - FSLOUTPUTTYPE: NIFTI
    steps:
      - checkout
      - run:
          name: Install Graphviz
          command: sudo apt update && sudo apt -y install graphviz
      - run:
          name: Install deps
          command: |
            pip install -U pip hatch docutils
            hatch version
            pip install .[docs]
      - run:
          name: Build MRIQC documentation
          no_output_timeout: 2h
          command: |
            make -C docs SPHINXOPTS="-W" html | tee $PWD/builddocs.log
            cat $PWD/builddocs.log
            grep -qv "ERROR" $PWD/builddocs.log
      - store_artifacts:
          path: ./docs/_build/html

  test_package:
    docker:
      - image: cimg/python:3.9
    working_directory: /tmp/src/mriqc
    steps:
      - checkout
      - run:
          name: Start virtual environment
          command: |
            python -m venv /tmp/venv
            source /tmp/venv/bin/activate
            python -m pip install -U build hatch hatchling pip twine docutils
      - run:
          name: Build and check
          command: |
            source /tmp/venv/bin/activate
            python -m build -s -w
            python -m twine check dist/*
      - run:
          name: Validate version
          command: |
            source /tmp/venv/bin/activate
            THISVERSION=$( python3 -m hatch version | tail -n1 | xargs )
            python -m pip install dist/*.tar.gz
            mkdir empty
            cd empty
            INSTALLED=$( python -c 'import mriqc; print(mriqc.__version__)' )
            test "${CIRCLE_TAG:-$THISVERSION}" == "$INSTALLED"

  deploy_pypi:
    docker:
      - image: cimg/python:3.8.5
    working_directory: /tmp/src/mriqc
    steps:
      - checkout
      - run:
          name: Start virtual environment
          command: |
            python -m venv /tmp/venv
            source /tmp/venv/bin/activate
            python -m pip install -U hatch hatchling pip build twine docutils
      - run:
          name: Deploy to PyPi
          command: |
            source /tmp/venv/bin/activate

            # Set version on stone before editing the bundle
            export SETUPTOOLS_SCM_PRETEND_VERSION=$( python -m hatch version | tail -n1 | xargs )

            # Inject MRIQC-WebAPI secret
            if [ "${MRIQC_API_SECRET_TOKEN}" != "" ]; then
              sed -i -E "s/<secret_token>/$MRIQC_API_SECRET_TOKEN/" mriqc/config.py
              grep -q -i $MRIQC_API_SECRET_TOKEN mriqc/config.py
            fi
            python -m build -s -w
            python -m twine check dist/*
            python -m twine upload dist/*

  deploy_docker:
    machine:
      image: ubuntu-2004:202104-01
    working_directory: /tmp/src/mriqc
    steps:
      - restore_cache:
          keys:
            - build-v4-{{ .Branch }}-{{ .Revision }}
          paths:
            - /tmp/docker
            - /tmp/images
      - docker/install-docker-credential-helper
      - run:
          name: Docker authentication
          command: |
            if [[ -n $DOCKER_PAT ]]; then
              echo "$DOCKER_PAT" | docker login -u $DOCKER_USER --password-stdin
            fi
      - run:
          name: Set-up a Docker registry
          command: |
            if [[ -f /tmp/images/registry.tar.gz ]]; then
              echo "Loading saved registry image"
              docker load < /tmp/images/registry.tar.gz
            else
              echo "Pulling registry image from DockerHub"
              docker pull registry:2
            fi
            docker run -d -p 5000:5000 --restart=always --name=registry \
                -v /tmp/docker:/var/lib/registry registry:2
      - run:
          name: Pull images from local registry
          command: |
            docker pull localhost:5000/mriqc
            docker tag localhost:5000/mriqc nipreps/mriqc:latest

      - run:
          name: Deploy to Docker Hub
          no_output_timeout: 40m
          command: |
            docker push nipreps/mriqc:latest
            docker tag nipreps/mriqc nipreps/mriqc:$CIRCLE_TAG
            docker push nipreps/mriqc:$CIRCLE_TAG

workflows:
  version: 2
  build_test_deploy:
    jobs:
      - build_docs:
          filters:
            tags:
              only: /.*/

      - build:
          context:
            - nipreps-common
          filters:
            branches:
              ignore: /docs?\/.*/
            tags:
              only: /.*/

      - get_data:
          filters:
            branches:
              ignore: /docs?\/.*/
            tags:
              only: /.*/

      - test_package:
          context:
            - nipreps-common
          filters:
            branches:
              ignore: /docs?\/.*/
            tags:
              only: /.*/

      - test_pytest:
          context:
            - nipreps-common
          requires:
            - build
          filters:
            branches:
              ignore: /docs?\/.*/
            tags:
              only: /.*/

      - T1w:
          requires:
            - get_data
            - build
          filters:
            branches:
              ignore: /docs?\/.*/
            tags:
              only: /.*/

      - bold:
          requires:
            - get_data
            - build
          filters:
            branches:
              ignore: /docs?\/.*/
            tags:
              only: /.*/

      - deploy_docker:
          context:
            - nipreps-common
          requires:
            - build
            - test_pytest
            - test_package
            - build_docs
            - T1w
            - bold
          filters:
            branches:
              ignore: /.*/
            tags:
              only: /.*/

      - deploy_pypi:
          context:
            - nipreps-common
          requires:
            - deploy_docker
          filters:
            branches:
              ignore: /.*/
            tags:
              only: /.*/