ci.yml

name: CI

on:
  - push
  - pull_request

env:
  PYTHON_VERSION: "3.10"
  IMAGE_NAME: defelo/pycrypcli
  GHCR_NAME: defelo/pycrypcli

jobs:
  codestyle:
    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository }}
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          submodules: recursive

      - name: Set up Python ${{ env.PYTHON_VERSION }}
        uses: actions/setup-python@v3
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Setup poetry
        run: |
          pip install poetry poethepoet
          poetry install -n --no-root

      - name: Check code formatting with black
        run: poe black --diff --check

  mypy:
    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository }}
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v2.3.4
        with:
          submodules: recursive

      - name: Set up Python ${{ env.PYTHON_VERSION }}
        uses: actions/setup-python@v2
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Setup poetry
        run: |
          pip install poetry poethepoet
          poetry install -n --no-root

      - name: Check typing with mypy
        run: poe mypy

  linter:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          submodules: recursive

      - name: Set up Python ${{ env.PYTHON_VERSION }}
        uses: actions/setup-python@v3
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Setup poetry
        run: |
          pip install poetry poethepoet
          poetry install -n --no-root

      - name: Check code style with wemake-python-styleguide
        run: poe flake8

#      - name: Lint with wemake-python-styleguide
#        uses: wemake-services/wemake-python-styleguide@0.16.0
#        with:
#          reporter: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && 'github-pr-review' || 'terminal' }}
#        env:
#          GITHUB_TOKEN: ${{ secrets.github_token }}

  build:
    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository }}
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          persist-credentials: false
          submodules: recursive
          fetch-depth: 0

      - name: Check Version
        run: |
          if [[ $GITHUB_REF = refs/tags/v* ]]; then
            tag=${GITHUB_REF#refs/tags/v}
            version=$(grep '^version =' pyproject.toml | cut -d'"' -f2)
            if [[ "$tag" != "$version" ]]; then
              echo "::error::Tag $tag does not match version $version"
              exit 1
            fi
          fi

      - name: Set up Python ${{ env.PYTHON_VERSION }}
        uses: actions/setup-python@v3
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Setup poetry
        run: |
          pip install poetry
          poetry install -n --no-root

      - name: Build python package
        run: poetry build

      - name: Upload dist
        uses: actions/upload-artifact@v2
        with:
          name: build
          path: dist

  docker_build:
    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository }}
    runs-on: ubuntu-latest
    strategy:
      matrix:
        platform: [ "linux/amd64", "linux/arm/v7", "linux/arm64/v8" ]  #, "linux/s390x", "linux/ppc64le"

    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          persist-credentials: false
          submodules: recursive
          fetch-depth: 0

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v1.2.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v1.6.0

      - name: Cache Docker layers
        uses: actions/cache@v2.1.7
        with:
          path: /tmp/.buildx-cache
          key: ${{ runner.os }}-buildx-${{ matrix.platform }}-${{ github.sha }}
          restore-keys: ${{ runner.os }}-buildx-${{ matrix.platform }}-

      - name: Create Version
        id: version
        run: |
          set -x
          
          name=$IMAGE_NAME
          ghcr_name=$GHCR_NAME
          
          tag=${GITHUB_REF#refs/tags/v}
          branch=${GITHUB_REF#refs/heads/}
          pull=${GITHUB_REF#refs/pull/}
          pull=${pull%/merge}
          platform=${{ matrix.platform }}
          
          hub=0
          
          if [[ $GITHUB_REF = refs/tags/v* ]]; then
            tags="v$tag latest"
            hub=1
          elif [[ $GITHUB_REF = refs/heads/* ]]; then
            tags="$branch"
            if [[ $branch == develop ]]; then
              hub=1
            fi
          elif [[ $GITHUB_REF = refs/pull/* ]]; then
            tags="pr-$pull"
          fi
          tags="$(echo $tags | tr / -)"
          
          hub=0
          
          out=""
          for t in $tags; do
            [[ $hub == "1" ]] && out="$out,$name:$t-$(echo $platform | tr / -)"
            out="$out,ghcr.io/$ghcr_name:$t-$(echo $platform | tr / -)"
            if [[ $platform == linux/amd64 ]]; then
              [[ $hub == "1" ]] && out="$out,$name:$t"
              out="$out,ghcr.io/$ghcr_name:$t"
            fi
          done
          
          echo ::set-output name=tags::${out:1}

      - name: Build
        uses: docker/build-push-action@v2.10.0
        with:
          push: false
          load: true
          tags: ${{ steps.version.outputs.tags }}
          platforms: ${{ matrix.platform }}
          file: Dockerfile
          context: .
          cache-from: type=local,src=/tmp/.buildx-cache
          cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max

      - name: Move cache
        run: |
          rm -rf /tmp/.buildx-cache
          mv /tmp/.buildx-cache-new /tmp/.buildx-cache

      - name: Build Docker Image Archive
        id: archive
        env:
          TAGS: ${{ steps.version.outputs.tags }}
        run: |
          set -ex
          platform=${{ matrix.platform }}
          name=docker_$(echo $IMAGE_NAME | tr / _)_$(echo $platform | tr / -).tar.gz
          echo ::set-output name=name::${name}
          docker save $(echo $TAGS | tr , ' ') | gzip > $name

      - name: Upload Docker Image Archive
        uses: actions/upload-artifact@v2.3.1
        with:
          name: ${{ steps.archive.outputs.name }}
          path: ${{ steps.archive.outputs.name }}
          retention-days: 1

  pypi:
    runs-on: ubuntu-latest
    needs: [ codestyle, mypy, linter, build, docker_build ]
    if: ${{ startsWith(github.ref, 'refs/tags/v') }}
    environment: pypi

    steps:
      - name: Download dist
        uses: actions/download-artifact@v2
        with:
          name: build
          path: dist

      - name: Install Twine
        run: pip install twine

      - name: Upload package to PyPi
        run: python -m twine upload -u __token__ -p ${{ secrets.PYPI_TOKEN }} dist/*

  docker_push_ghcr:
    if: ${{ github.event_name != 'pull_request' && github.actor != 'dependabot[bot]' }}
    needs: [ codestyle, mypy, linter, build, docker_build ]
    runs-on: ubuntu-latest

    steps:
      - name: Download Docker Image Archive
        uses: actions/download-artifact@v2.1.0

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v1.14.1
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.github_token }}

      - name: Push Docker Image
        run: |
          set -ex

          for file in docker*/*.tar.gz; do
            [[ "$file" == *_linux-amd64.tar.gz ]] && continue
            echo Loading $file
            docker load -qi $file | cut -d' ' -f3 | grep '^ghcr.io/' | xargs -L1 docker push
          done
          
          for file in docker*/*_linux-amd64.tar.gz; do
            echo Loading $file
            docker load -qi $file | cut -d' ' -f3 | grep '^ghcr.io/' | xargs -L1 docker push
          done

      - name: Clear
        if: always()
        run: rm -f ${HOME}/.docker/config.json

      - name: Prune old Docker Images
        env:
          TOKEN: ${{ secrets.CR_PAT }}
          USER: "defelo"
          NAME: "pycrypcli"
        run: |
          set -ex

          AUTH="Authorization: Bearer ${TOKEN}"
          URL="https://github.com/${USER}/packages/container/${NAME}/versions"

          for version in $(curl -H "${AUTH}" "${URL}" | jq -c '.[] | select(.metadata.container.tags==[])'); do
              id=$(echo "${version}" | jq -r .id)
              name=$(echo "${version}" | jq -r .name)
              echo pruning $id $name
              curl -X DELETE -H "${AUTH}" "${URL}/${id}"
          done