name: CI

on:
  push:
    branches:
      - main
  pull_request:
  schedule:
    - cron: "0 12 * * *"
  workflow_dispatch:

permissions: {}

jobs:
  unit-test:
    strategy:
      matrix:
        conf:
          - { py: "3.9", os: "ubuntu-latest" }
          - { py: "3.10", os: "ubuntu-latest" }
          - { py: "3.11", os: "ubuntu-latest" }
          - { py: "3.12", os: "ubuntu-latest" }
          - { py: "3.13", os: "ubuntu-latest" }
          - { py: "3.14", os: "ubuntu-latest" }
          - { py: "pypy3.11", os: "ubuntu-latest" }
          # NOTE: We only test Windows and macOS on the latest Python;
          # these primarily exist to ensure that we don't accidentally
          # introduce Linux-isms into the development tooling.
          - { py: "3.14", os: "windows-latest" }
          - { py: "3.14", os: "macos-latest" }
    runs-on: ${{ matrix.conf.os }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
        with:
          python-version: ${{ matrix.conf.py }}
          cache: "pip"
          cache-dependency-path: pyproject.toml

      - name: deps
        run: make dev ID_EXTRA=test

      - name: test
        run: make test TEST_ARGS="-vv --showlocals"

  github-actions-test:
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false
    runs-on: ubuntu-latest
    permissions:
      id-token: write # for OIDC
    steps:
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

      - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548
        with:
          python-version: "3.x"
          cache: "pip"
          cache-dependency-path: pyproject.toml

      - name: deps
        run: pip install .

      - name: Test id with GitHub Actions OIDC
        shell: python
        run: |
          import id
          assert id.detect_credential("my-audience")

  all-tests-pass:
    if: always()

    needs:
      - unit-test
      - github-actions-test

    runs-on: ubuntu-latest

    steps:
      - name: check test jobs
        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
        with:
          jobs: ${{ toJSON(needs) }}
          allowed-skips: github-actions-test
