---
name: CI

on:
  push:
    branches: [main]
    tags: [v*]
  pull_request:
    branches: [main]
  merge_group:
  workflow_dispatch:

permissions: {}

env:
  PYTHON_LATEST: 3.13

jobs:
  build:
    name: Build package
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
      prerelease: ${{ steps.version.outputs.prerelease }}
    steps:
    - uses: actions/checkout@v5
      with:
        fetch-depth: 0
        persist-credentials: false
    - uses: actions/setup-python@v6
      with:
        python-version: ${{ env.PYTHON_LATEST }}
    - name: Install tox
      run: python -m pip install tox
    - name: Build package and check distributions
      run: tox run -e build
    - name: List result
      run: ls -l dist
    - name: Install pytest-asyncio
      run: pip install .
    - name: Get version info
      id: version
      run: python ./tools/get-version.py >> $GITHUB_OUTPUT
    - name: Upload artifacts
      uses: actions/upload-artifact@v5
      with:
        name: dist
        path: dist

  lint:
    name: Run linters
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v5
      with:
        fetch-depth: 0
        persist-credentials: false
    - uses: actions/setup-python@v6
      with:
        python-version: ${{ env.PYTHON_LATEST }}
    - name: Install GitHub matcher for ActionLint checker
      run: |
        echo "::add-matcher::.github/actionlint-matcher.json"
    - name: Install pre-commit
      run: python -m pip install pre-commit
    - name: Run pre-commit checks
      run: pre-commit run --all-files --show-diff-on-failure

  test:
    name: ${{ matrix.os }} - Python ${{ matrix.python-version }}
    runs-on: ${{ matrix.os }}-latest
    continue-on-error: ${{ !matrix.required }}
    strategy:
      matrix:
        os: [ubuntu, windows]
        python-version: ['3.10', '3.11', '3.12', '3.13', '3.14', 3.14t]
        required: [true]

    steps:
    - uses: actions/checkout@v5
      with:
        persist-credentials: false
    - uses: actions/setup-python@v6
      with:
        python-version: ${{ matrix.python-version }}
    - name: Install dependencies
      run: |
        python -VV
        python -m site
        python -m pip install --upgrade pip
        python -m pip install --upgrade coverage[toml] virtualenv tox tox-gh-actions
    - name: Run tox targets for ${{ matrix.python-version }}
      run: python -m tox

    - name: Store coverage data
      uses: actions/upload-artifact@v5
      if: "!endsWith(matrix.os, 'windows')"
      with:
        name: coverage-python-${{ matrix.python-version }}
        path: coverage/coverage.*
        if-no-files-found: error

  lint-github-actions:
    name: Lint GitHub Actions
    permissions:
      security-events: write
    uses: zizmorcore/workflow/.github/workflows/reusable-zizmor.yml@3bb5e95068d0f44b6d2f3f7e91379bed1d2f96a8

  check:
    name: Check
    if: always()
    needs: [build, lint, test]
    runs-on: ubuntu-latest
    steps:
    - name: Decide whether the needed jobs succeeded or failed
      uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe  # v1.2.2
      with:
        jobs: ${{ toJSON(needs) }}
    - uses: actions/checkout@v5
      with:
        persist-credentials: false
    - uses: actions/setup-python@v6
      with:
        python-version: ${{ env.PYTHON_LATEST }}
    - name: Install Coverage.py
      run: |
        set -xe
        python -m pip install --upgrade coverage[toml]
    - name: Download coverage data for all test runs
      uses: actions/download-artifact@v6
      with:
        pattern: coverage-*
        path: coverage
        merge-multiple: true
    - name: Combine coverage data and create report
      run: |
        coverage combine
        coverage xml
    - name: Upload coverage report
      uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7  # v5.5.1
      with:
        files: coverage.xml
        fail_ci_if_error: true
        token: ${{ secrets.CODECOV_TOKEN }}

  create-github-release:
    name: Create GitHub release
    needs: [build, lint, check]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
    - name: Checkout
      uses: actions/checkout@v5
      with:
        fetch-depth: 0
        persist-credentials: false
    - name: Install Python
      uses: actions/setup-python@v6
    - name: Install towncrier
      run: pip install towncrier==24.8.0
    - name: Install pandoc
      run: |
        sudo apt-get install -y pandoc
    - name: Install pytest-asyncio
      run: pip install .
    - name: Compile Release Notes Draft
      if: ${{ !contains(github.ref, 'refs/tags/') }}
      run: towncrier build --draft --version "${version}" > release-notes.rst
      env:
        version: ${{ needs.build.outputs.version }}
    - name: Extract release notes from Git tag
      if: github.event_name == 'push' && contains(github.ref, 'refs/tags/')
      run: |
        set -e
        git fetch --tags --force  # see https://github.com/actions/checkout/issues/290
        git for-each-ref "${GITHUB_REF}" --format='%(contents)' > release-notes.rst
        # Strip signature from signed tags
        sed -i -e "/-----BEGIN PGP SIGNATURE-----/,/-----END PGP SIGNATURE-----\n/d" \
          -e "/-----BEGIN SSH SIGNATURE-----/,/-----END SSH SIGNATURE-----\n/d" release-notes.rst
    - name: Convert Release Notes to Markdown
      run: |
        pandoc --wrap=preserve -o release-notes.md release-notes.rst
    - name: Upload artifacts
      uses: actions/upload-artifact@v5
      with:
        name: release-notes.md
        path: release-notes.md
    - name: Download distributions
      uses: actions/download-artifact@v6
      with:
        name: dist
        path: dist
    - name: Create GitHub Release
      if: github.event_name == 'push' && contains(github.ref, 'refs/tags/')
      uses: ncipollo/release-action@b7eabc95ff50cbeeedec83973935c8f306dfcd0b  # v1.20.0
      with:
        name: pytest-asyncio ${{ needs.build.outputs.version }}
        artifacts: dist/*
        bodyFile: release-notes.md
        prerelease: ${{ needs.build.outputs.prerelease }}
        token: ${{ secrets.GITHUB_TOKEN }}
        allowUpdates: true
        draft: true
        skipIfReleaseExists: true

  publish-test-pypi:
    name: Publish packages to test.pypi.org
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    needs: [build, lint, check, create-github-release]
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    steps:
    - name: Download distributions
      uses: actions/download-artifact@v6
      with:
        name: dist
        path: dist
    - name: Upload to test.pypi.org
      uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e  # v1.13.0
      with:
        repository-url: https://test.pypi.org/legacy/

  publish-pypi:
    name: Publish packages to pypi.org
    environment: release
    if: github.event_name == 'push' && contains(github.ref, 'refs/tags/')
    needs: [build, lint, check, create-github-release]
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    steps:
    - name: Download distributions
      uses: actions/download-artifact@v6
      with:
        name: dist
        path: dist
    - name: Collected dists
      run: |
        tree dist
    - name: PyPI upload
      uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e  # v1.13.0