workflow.yaml

name: Build

on:
  - push
  - pull_request

env:
  GITHUB_WORKFLOW: true

jobs:
  linting:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install ruff
        uses: astral-sh/ruff-action@v3
        with:
          version: "0.9.6" # updates to ruff must be in sync with the vscode plugin

      - name: Check for ruff issues
        run: ruff check --diff --output-format=github .

      - name: Check format
        run: ruff format --check

  test:
    name: Test and coverage
    needs:
      - linting
    runs-on: ubuntu-24.04

    strategy:
      fail-fast: false
      matrix:
        python-version:
          - "3.9"
          - "3.10"
          - "3.11"
          - "3.12"
          - "3.13"
        django:
          - "4.2"
          - "5.0"
          - "5.1"
        database:
          - sqlite
          - mysql
          - postgres
        exclude:
          - django: "4.2"
            python-version: "3.13"
          - django: "5.0"
            python-version: "3.9"
          - django: "5.0"
            python-version: "3.13"
          - django: "5.1"
            python-version: "3.9"

    services:
      # postgres service
      postgres:
        image: postgres:17-alpine
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: postgres
        ports:
          - 5432:5432
        options: >-
          --health-cmd="pg_isready"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=5

      # mysql service
      mysql:
        image: mysql:9
        env:
          MYSQL_ALLOW_EMPTY_PASSWORD: yes
          MYSQL_DATABASE: test
        ports:
          - 3306:3306
        options: >-
          --health-cmd="mysqladmin ping"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=5

    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}

      - name: Update pip
        run: python -m pip install --upgrade pip

      - name: Install Django 4.2
        if: matrix.django == 4.2
        run: pip install "Django>=4.2,<5.0"
      - name: Install Django 5.0
        if: matrix.django == 5.0
        run: pip install "Django>=5.0,<5.1"
      - name: Install Django 5.1
        if: matrix.django == 5.1
        run: pip install "Django>=5.1,<5.2"
      - name: Install MySQL libs
        if: matrix.database == 'mysql'
        run: pip install mysqlclient>=2.2.7 django-mysql>=4.16.0
      - name: Install postgres libs
        if: matrix.database == 'postgres'
        run: pip install psycopg>=3.2.4

      - name: Install requirements
        run: pip install -r requirements.txt

      - name: Install package
        run: pip install -e .

      - name: Run tests and coverage
        run: coverage run --source=django_scrubber manage.py test
        env:
          DATABASE_ENGINE: ${{ matrix.database }}

      - name: Publish coverage
        if: |
          github.repository == 'RegioHelden/django-scrubber'
          &&
          (
            github.event_name == 'push'
            ||
            (
              github.event_name == 'pull_request'
              &&
              github.head_ref == 'master'
            )
          )
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          COVERALLS_REPO_TOKEN: ${{ secrets.COVERALLS_REPO_TOKEN }}
        run: coveralls

  build:
    name: Build package
    needs:
      - test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: 3.12

      - name: Install pypa/build
        run: python -m pip install build --user

      - name: Build a binary wheel and a source tarball
        run: python3 -m build

      - name: Store artifacts
        uses: actions/upload-artifact@v4
        with:
          name: python-package-distributions
          path: dist/

  publish:
    name: Publish to PyPI
    needs:
      - build
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/p/django-scrubber
    permissions:
      id-token: write # IMPORTANT: mandatory for trusted publishing
    steps:
      - name: Download dists from artifacts
        uses: actions/download-artifact@v4
        with:
          name: python-package-distributions
          path: dist/

      - name: Publish
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
        uses: pypa/gh-action-pypi-publish@release/v1

  github-release:
    name: Sign packages and upload to GitHub releases
    needs:
      - publish
    runs-on: ubuntu-latest

    permissions:
      contents: write # IMPORTANT: mandatory for making GitHub Releases
      id-token: write # IMPORTANT: mandatory for sigstore

    steps:
      - name: Download dists from artifacts
        uses: actions/download-artifact@v4
        with:
          name: python-package-distributions
          path: dist/

      - name: Sign dists
        uses: sigstore/gh-action-sigstore-python@v3.0.0
        with:
          inputs: >-
            ./dist/*.tar.gz
            ./dist/*.whl

      - name: Create GitHub Release
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: gh release create "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --notes ""

      - name: Upload artifact signatures to GitHub release
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: gh release upload "$GITHUB_REF_NAME" dist/** --repo "$GITHUB_REPOSITORY"