test.yml

name: Tests

on:
  push:
    branches: [main]
  # Needed to allow secrets access to forked PRs, consider breaking up workflow
  # by running tests on pull_request, saving artifacts, and then running another
  # workflow on pull_request_target to allow only minimal access to secrets
  # https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
  pull_request_target:
    branches: [main]
  release:
    types: [published]

jobs:
  tests:
    strategy:
      fail-fast: true
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}

    steps:
      - name: Check out repo
        uses: actions/checkout@v3

      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: 3.8
          cache: pip
          cache-dependency-path: pyproject.toml

      - name: Install dependencies
        run: |
          pip install -e .[test]

      - name: Run Tests
        run: pytest --capture=no --cov --cov-report=xml .

      - name: codacy-coverage-reporter
        if: matrix.os == 'ubuntu-latest'
        uses: codacy/codacy-coverage-reporter-action@v1
        with:
          project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
          coverage-reports: coverage.xml

  release:
    runs-on: ubuntu-latest
    needs: tests
    if: github.event_name == 'release' && needs.tests.result == 'success'
    permissions:
      # For PyPI trusted publishing
      id-token: write
    steps:
      - name: Check out repo
        uses: actions/checkout@v3

      - name: Build dist
        run: |
          pip install build
          python -m build

      - name: Publish to PyPi
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          skip-existing: true
          verbose: true