test.yml

name: wagtail_periodic_review CI

on:
  push:
    branches:
      - main
      - 'stable/**'

  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read # to fetch code (actions/checkout)

env:
  FORCE_COLOR: "1" # Make tools pretty.
  TOX_TESTENV_PASSENV: FORCE_COLOR
  PIP_DISABLE_PIP_VERSION_CHECK: "1"
  PIP_NO_PYTHON_VERSION_WARNING: "1"
  # Keep in sync with .pre-commit-config.yaml/default_language_version/python.
  PYTHON_LATEST: "3.12"

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Set up Python
        uses: actions/setup-python@v5
        id: setup_python
        with:
          python-version: ${{env.PYTHON_LATEST}}

      - name: Install pre-commit
        if: steps.cache.outputs.cache-hit != 'true'
        run: python -Im pip install pre-commit

      - name: Cache pre-commit tools
        uses: actions/cache@v4
        id: cache
        with:
          key: pre-commit-${{ runner.os }}-${{ steps.setup_python.outputs.python-version}}-${{ hashFiles('.pre-commit-config.yaml') }}
          path: ~/.cache/pre-commit

      - name: Run pre-commit
        run: pre-commit run --all-files

  tests:
    runs-on: ubuntu-latest
    needs: lint
    strategy:
      matrix:
        python-version: ['3.8', '3.9', '3.10', '3.11', '3.12']

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            files.pythonhosted.org:443
            objects.githubusercontent.com:443
            github.com:443
            pypi.org:443
            api.github.com:443
      - uses: actions/checkout@v4
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
      - name: ⬇️ Install dependencies
        run: |
          python -Im pip install --upgrade pip
          python -Im pip install flit tox tox-gh-actions
          python -Im flit install --symlink

      - name: 🏗️ Build wheel
        run: python -Im flit build --format wheel

      - name: 🧪 Run tox targets for Python ${{ matrix.python-version }}
        run: tox --installpkg ./dist/*.whl

      - name: ⬆️ Upload coverage data
        uses: actions/upload-artifact@v4
        with:
          name: coverage-data-${{ matrix.python-version }}
          path: .coverage.*
          if-no-files-found: ignore
          retention-days: 1

  coverage:
    runs-on: ubuntu-latest
    needs: tests

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@v2
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            files.pythonhosted.org:443
            github.com:443
            pypi.org:443
            api.github.com:443
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          # Use latest Python, so it understands all syntax.
          python-version: ${{env.PYTHON_LATEST}}

      - run: python -Im pip install --upgrade coverage[toml]

      - name: ⬇️ Download coverage data
        uses: actions/download-artifact@v4
        with:
          pattern: coverage-data-*
          merge-multiple: true

      - name: ＋ Combine coverage
        run: |
          python -Im coverage combine
          python -Im coverage html --skip-covered --skip-empty
          python -Im coverage report
          echo "## Coverage summary" >> $GITHUB_STEP_SUMMARY
          python -Im coverage report --format=markdown >> $GITHUB_STEP_SUMMARY
      - name: 📈 Upload HTML report
        uses: actions/upload-artifact@v4
        with:
          name: html-report
          path: htmlcov