python-package.yml

name: Python package

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:
    inputs:
      bump_type:
        description: 'Version bump type'
        required: true
        default: 'patch'

jobs:
  build:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ['3.9', '3.10', '3.11', '3.12']

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install Poetry
        run: pip install poetry

      - name: Cache Poetry virtual environment
        uses: actions/cache@v4
        with:
          path: ~/.cache/pypoetry
          key: ${{ runner.os }}-poetry-${{ hashFiles('**/pyproject.toml') }}
          restore-keys: ${{ runner.os }}-poetry-

      - name: Install dependencies
        run: poetry install

      - name: Lint (flake8)
        run: poetry run flake8 datasafari tests

      - name: Run tests with coverage (pytest)
        run: poetry run pytest --cov=datasafari --cov-report=xml

      - name: Build the package
        run: poetry build

      - name: Check the package (Twine)
        run: poetry run twine check dist/*

      - name: Static security scan (Bandit)
        run: poetry run bandit -c pyproject.toml -r .

      - name: Scan for dependency vulnerabilities (SafetyCLI 3)
        uses: pyupio/safety-action@v1.0.1
        with:
          api-key: ${{ secrets.SAFETY_CLI_API_KEY }}

      - name: Install SSH key
        uses: webfactory/ssh-agent@v0.9.0
        with:
          ssh-private-key: ${{ secrets.DS_SERVER_SSH_PRIVATE_KEY }}

      - name: Add SSH key to known hosts
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.DS_SERVER_HOST_KEY_RSA }}" >> ~/.ssh/known_hosts
          echo "${{ secrets.DS_SERVER_HOST_KEY_ECDSA }}" >> ~/.ssh/known_hosts
          echo "${{ secrets.DS_SERVER_HOST_KEY_ED25519 }}" >> ~/.ssh/known_hosts

      - name: Configure Git Identity
        run: |
          git config --global user.email "actions@github.com"
          git config --global user.name "GitHub Actions"

      - name: Determine Bump Type
        run: |
          set -e
          TAG=$(git describe --tags $(git rev-list --tags --max-count=1))
          if [[ "$TAG" == *"-patch" ]]; then
            echo "bump_type=patch" >> $GITHUB_ENV
          elif [[ "$TAG" == *"-minor" ]]; then
            echo "bump_type=minor" >> $GITHUB_ENV
          elif [[ "$TAG" == *"-major" ]]; then
            echo "bump_type=major" >> $GITHUB_ENV
          else
            echo "bump_type=patch" >> $GITHUB_ENV
          fi

      - name: Bump Version (bump2version)
        run: poetry run bump2version --config-file .bumpversion.cfg ${{ env.bump_type }} --no-tag --commit

      - name: Build documentation (Sphinx)
        run: poetry run sphinx-build -b html docs/ docs/_build/html

      - name: Sync documentation to server
        run: rsync -avz --delete -e "ssh -p ${{ secrets.DS_SERVER_SSH_PORT }}" --verbose ./docs/_build/html/ ${{ secrets.DS_SERVER_USERNAME }}@${{ secrets.DS_SERVER_IP }}:${{ secrets.DS_SERVER_DOCS_PATH }}
        env:
          RSYNC_RSH: ssh -o StrictHostKeyChecking=accept-new

  publish:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: 3.9

      - name: Install Poetry
        run: pip install poetry

      - name: Install dependencies
        run: poetry install

      - name: Build the package
        run: poetry build

      - name: Create Release Tag and Publish
        run: |
          NEW_TAG=v$(poetry version -s)
          git remote set-url origin https://${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}
          if ! git rev-parse --quiet --verify $NEW_TAG >/dev/null; then
              git tag $NEW_TAG
              git push origin --tags
          else
              echo "Tag $NEW_TAG already exists. No new tag created."
          fi

      - name: Publish to PyPI
        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
        run: poetry publish --username __token__ --password ${{ secrets.PYPI_API_TOKEN }}