main.yml

name: CI

# Workflow does NOT trigger on a feature branch until a pull request is created.
# Workflow will always run when a pull request is merged to the default branch.
on:
  pull_request: {}
  push:
      branches: ["main"]

env:
  PYTHON_VERSION: "3.12"

jobs:
  bandit:
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - name: Install dependencies
        uses: ./.github/actions/install-dependencies
        with:
          test-requirements: "true"

      - name: Run bandit
        run: bandit --ini .bandit -r gbq

  black:
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Set up Python
        uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - name: Install dependencies
        uses: ./.github/actions/install-dependencies
        with:
          test-requirements: "true"

      - name: Run black
        run: black --check gbq tests

  flake8:
    runs-on: ubuntu-latest
    steps:
        - name: Check out code
          uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        - uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
          with:
            python-version: ${{ env.PYTHON_VERSION }}
        - name: Install dependencies
          uses: ./.github/actions/install-dependencies
          with:
            test-requirements: "true"

        - name: Run flake8
          run: flake8 gbq tests

  isort:
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - name: Install dependencies
        uses: ./.github/actions/install-dependencies
        with:
          test-requirements: "true"

      - name: Run isort
        run: isort --check-only gbq tests

  mypy:
    runs-on: ubuntu-latest
    steps:
        - name: Check out code
          uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        - name: Run mypy
          uses: jashparekh/mypy-action@a4eb0d0a6f3dca7c6f03d7723f0f1cf12091fa19 # v3
          with:
            path: "gbq"

  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: [ "3.8", "3.9", "3.10", "3.11", "3.12" ]
    steps:
        - name: Check out code
          uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        - uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
          with:
            python-version: ${{ matrix.python-version }}
        - name: Install dependencies
          uses: ./.github/actions/install-dependencies
          with:
            requirements: "true"
            test-requirements: "true"

        - name: Run pytest
          run: pytest --cov-report xml:coverage-${{ matrix.python-version }}.xml --junitxml=test-results-${{ matrix.python-version }}.xml

        - name: Upload pytest test results artifact
          uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4
          with:
            name: pytest-results-${{ matrix.python-version }}
            path: test-results-${{ matrix.python-version }}.xml
          # Use always() to always run this step to publish test results when there are test failures
          if: ${{ always() }}

        - name: Upload coverage results artifact
          uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4
          with:
            name: pytest-coverage-${{ matrix.python-version }}
            path: coverage-${{ matrix.python-version }}.xml
          # Use always() to always run this step to publish test results when there are test failures
          if: ${{ always() }}

        - name: Publish coverage results to Codecov
          uses: codecov/codecov-action@e0b68c6749509c5f83f984dd99a76a1c1a231044 # v4.0.1
          with:
            token: 2168e29b-e40e-4ddf-acc3-00907462e93e # not ideal, but limited risk
            file: coverage-${{ matrix.python-version }}.xml
            fail_ci_if_error: true

  verify-wheel:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: [ "3.8", "3.9", "3.10", "3.11", "3.12" ]
    steps:
      - name: Check out code
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
        with:
          python-version: ${{ matrix.python-version }}
      - name: Build wheel
        uses: ./.github/actions/build-dist
      - name: Verify wheel
        uses: ./.github/actions/verify-wheel
        with:
          package-import-name: "gbq"

  build-devbox-image:
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Build devbox image
        run: "docker-compose build devbox"

  build-docs:
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - name: Check out code
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install dependencies
        uses: ./.github/actions/install-dependencies
        with:
          requirements: "true"
          docs-requirements: "true"

      - name: Build Docs
        run: mkdocs build --strict

      # upload artifact for dev build
      - name: Upload coverage results artifact
        if: github.ref != 'refs/heads/main'
        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4
        with:
          name: docs-site
          path: site/

  update-dev-docs:
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    steps:
      - name: Check out code
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install dependencies
        uses: ./.github/actions/install-dependencies
        with:
          requirements: "true"
          docs-requirements: "true"

      - name: Push documentation changes
        uses: ./.github/actions/publish-docs-with-mike
        with:
          version_name: dev