name: CI

on: [push, pull_request]

permissions: "read-all"

defaults:
  run:
    shell: bash

jobs:
  package:
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: "Checkout repository"
        uses: "actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3"

      - name: "Setup Python"
        uses: "actions/setup-python@57ded4d7d5e986d7296eab16560982c6dd7c923b"
        with:
          python-version: "3.x"
          cache: "pip"

      - name: "Check packages"
        run: |
          python -m pip install -U pip setuptools wheel build twine rstcheck
          python -m build
          rstcheck CHANGES.rst
          python -m twine check dist/*

  test:
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.7", "3.8", "3.9", "3.10", "3.11", "3.12-dev"]
        os:
          - macos-11
          - windows-latest
          - ubuntu-20.04  # OpenSSL 1.1.1
          - ubuntu-22.04  # OpenSSL 3.0
        nox-session: ['']
        include:
          - experimental: false
          - python-version: "pypy-3.7"
            os: ubuntu-latest
            experimental: false
            nox-session: test-pypy
          - python-version: "pypy-3.8"
            os: ubuntu-latest
            experimental: false
            nox-session: test-pypy
          - python-version: "3.x"
            os: ubuntu-latest
            experimental: false
            nox-session: test_brotlipy
          # Test CPython with a broken hostname_checks_common_name (the fix is in 3.9.3)
          - python-version: "3.9.2"
            os: ubuntu-20.04  # CPython 3.9.2 is not available for ubuntu-22.04.
            experimental: false
            nox-session: test-3.9
          - python-version: "3.12-dev"
            experimental: true
        exclude:
          # Ubuntu 22.04 comes with OpenSSL 3.0, so only CPython 3.9+ is compatible with it
          # https://github.com/python/cpython/issues/83001
          - python-version: "3.7"
            os: ubuntu-22.04
          - python-version: "3.8"
            os: ubuntu-22.04
          # Testing with non-final CPython on macOS is too slow for CI.
          - python-version: "3.12-dev"
            os: macos-11

    runs-on: ${{ matrix.os }}
    name: ${{ fromJson('{"macos-11":"macOS","windows-latest":"Windows","ubuntu-latest":"Ubuntu","ubuntu-20.04":"Ubuntu 20.04 (OpenSSL 1.1.1)","ubuntu-22.04":"Ubuntu 22.04 (OpenSSL 3.0)"}')[matrix.os] }} ${{ matrix.python-version }} ${{ matrix.nox-session}}
    continue-on-error: ${{ matrix.experimental }}
    timeout-minutes: 30
    steps:
      - name: "Checkout repository"
        uses: "actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3"

      - name: "Setup Python ${{ matrix.python-version }}"
        uses: "actions/setup-python@57ded4d7d5e986d7296eab16560982c6dd7c923b"
        with:
          python-version: ${{ matrix.python-version }}

      - name: "Install dependencies"
        run: python -m pip install --upgrade pip setuptools nox

      - name: "Run tests"
        run: ./ci/run_tests.sh
        env:
          PYTHON_VERSION: ${{ matrix.python-version }}
          NOX_SESSION: ${{ matrix.nox-session }}

      - name: "Upload artifact"
        uses: "actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce"
        with:
          name: coverage-data
          path: ".coverage.*"
          if-no-files-found: error


  coverage:
    if: always()
    runs-on: "ubuntu-latest"
    needs: test
    steps:
      - name: "Checkout repository"
        uses: "actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3"

      - name: "Setup Python"
        uses: "actions/setup-python@57ded4d7d5e986d7296eab16560982c6dd7c923b"
        with:
          python-version: "3.x"

      - name: "Install coverage"
        run: "python -m pip install --upgrade coverage"

      - name: "Download artifact"
        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
        with:
          name: coverage-data

      - name: "Combine & check coverage"
        run: |
          python -m coverage combine
          python -m coverage html --skip-covered --skip-empty
          python -m coverage report --ignore-errors --show-missing --fail-under=100

      - if: ${{ failure() }}
        name: "Upload report if check failed"
        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce
        with:
          name: coverage-report
          path: htmlcov