ci.yml

name: Run CI

# Run this workflow every time a new commit pushed to your repository
on:
  push:
    branches:
      - master
    tags:
      - '*'
  pull_request:
  schedule:
    - cron: "55 6 * * *"
  workflow_dispatch:

permissions: {}

jobs:
  tests:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python: ['3.12', '3.13', '3.14']
        django: ['5.2']
        mozilla_django_oidc: ['5.0']
        setup_config_enabled: ['no', 'yes']

    name: "Run the test suite (Python ${{ matrix.python }}, Django ${{ matrix.django }},
      mozilla-django-oidc ${{ matrix.mozilla_django_oidc }}, Setup Config: ${{ matrix.setup_config_enabled }}))"

    services:
      postgres:
        image: docker.io/library/postgres:17
        env:
          POSTGRES_HOST_AUTH_METHOD: trust
        ports:
          - 5432:5432
        # needed because the postgres container does not provide a healthcheck
        options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          python-version: ${{ matrix.python }}

      - name: Install dependencies
        run: pip install tox tox-gh-actions

      - name: Run tests
        run: |
          tox -- ${{ matrix.setup_config_enabled != 'yes' && '--ignore tests/setupconfig' || '' }}
        env:
          PYTHON_VERSION: ${{ matrix.python }}
          DJANGO: ${{ matrix.django }}
          MOZILLA_DJANGO_OIDC: ${{ matrix.mozilla_django_oidc }}
          PGUSER: postgres
          PGHOST: localhost
          SETUP_CONFIG_ENABLED: ${{ matrix.setup_config_enabled }}

      - name: Publish coverage report
        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354  # v6.0.1
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          flags: ${{ matrix.setup_config_enabled == 'yes' && 'setupconfig' || 'base' }}

  migrations:
    name: Check for model changes not present in the migrations
    runs-on: ubuntu-latest

    services:
      postgres:
        image: docker.io/library/postgres:17
        env:
          POSTGRES_HOST_AUTH_METHOD: trust
        ports:
          - 5432:5432
        # needed because the postgres container does not provide a healthcheck
        options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          python-version: "3.12"

      - name: Install dependencies
        run: |
          pip install -e .
          pip install psycopg

      - name: Run makemigrations to check for missing migrations
        run: django-admin makemigrations --check --dry-run
        env:
          DJANGO_SETTINGS_MODULE: testapp.settings
          PYTHONPATH: .
          SECRET_KEY: dummy
          PGDATABASE: postgres
          PGUSER: postgres
          PGHOST: localhost

  publish:
    name: Publish package to PyPI
    runs-on: ubuntu-latest
    needs: tests
    environment: release
    permissions:
      id-token: write

    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          python-version: '3.12'

      - name: Build sdist and wheel
        run: |
          pip install build --upgrade
          python -m build

      - name: Publish a Python distribution to PyPI
        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # v1.14.0