tests.yml

name: Tests

on:
  # https://docs.github.com/en/webhooks-and-events/webhooks/webhook-events-and-payloads#push
  push:
    branches:
      - main
      - feature/**
      - '[0-9].*.x'  # e.g., 4.14.x
      - '[0-9][0-9].*.x'  # e.g., 23.3.x

  # https://docs.github.com/en/webhooks-and-events/webhooks/webhook-events-and-payloads#pull_request
  pull_request:

  # https://docs.github.com/en/webhooks-and-events/webhooks/webhook-events-and-payloads#workflow_dispatch
  workflow_dispatch:

  # no payload
  schedule:
      # https://crontab.guru/#37_18_*_*_*
    - cron: 37 18 * * *

concurrency:
  # Concurrency group that uses the workflow name and PR number if available
  # or commit SHA as a fallback. If a new build is triggered under that
  # concurrency group while a previous build is running it will be canceled.
  # Repeated pushes to a PR will cancel all previous builds, while multiple
  # merges to main will not cancel.
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: true

env:
  # https://conda.github.io/conda-libmamba-solver/user-guide/configuration/#advanced-options
  CONDA_LIBMAMBA_SOLVER_NO_CHANNELS_FROM_INSTALLED: true

jobs:
  # detect whether any code changes are included in this PR
  changes:
    runs-on: ubuntu-latest
    permissions:
      # necessary to detect changes
      # https://github.com/dorny/paths-filter#supported-workflows
      pull-requests: read
    outputs:
      code: ${{ steps.filter.outputs.code }}
    steps:
      - name: Checkout Source
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        # dorny/paths-filter needs git clone for non-PR events
        # https://github.com/dorny/paths-filter#supported-workflows
        if: github.event_name != 'pull_request'

      - name: Filter Changes
        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
        id: filter
        with:
          filters: |
            code:
              - 'conda/**'
              - 'conda_env/**'
              - 'tests/**'
              - '*.py'
              - 'recipe/**'
              - '.github/workflows/tests.yml'

  # windows test suite
  windows:
    # only run test suite if there are code changes
    needs: changes
    if: github.event_name == 'schedule' || needs.changes.outputs.code == 'true'

    runs-on: windows-latest
    strategy:
      fail-fast: false
      matrix:
        # test lower version (w/ defaults) and upper version (w/ defaults and conda-forge)
        python-version: ['3.9', '3.12']
        default-channel: [defaults, conda-forge]
        test-type: [unit, integration]
        test-group: [1, 2, 3]
        exclude:
          - default-channel: conda-forge
            python-version: '3.9'
          - test-type: unit
            test-group: 3
    env:
      ErrorActionPreference: Stop  # powershell exit immediately on error
      PYTEST_MARKER: ${{ matrix.test-type == 'unit' && 'not integration' || 'integration' }}
      PYTEST_SPLITS: ${{ matrix.test-type == 'unit' && '2' || '3' }}
      REQUIREMENTS_TRUSTSTORE: ${{ contains('3.10|3.11|3.12', matrix.python-version) && '--file tests\requirements-truststore.txt' || '' }}
      CONDA_TEST_SOLVERS: ${{ github.event_name == 'pull_request' && 'libmamba' || 'libmamba,classic' }}

    steps:
      - name: Checkout Source
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      - name: Hash + Timestamp
        shell: bash  # use bash to run date command
        run: echo "HASH=${{ runner.os }}-${{ runner.arch }}-Py${{ matrix.python-version }}-${{ matrix.default-channel }}-${{ matrix.test-type }}-${{ matrix.test-group }}-$(date -u "+%Y%m")" >> $GITHUB_ENV

      - name: Cache Conda
        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
        with:
          # Use faster GNU tar for all runners
          enableCrossOsArchive: true
          path: D:\conda_pkgs_dir
          key: cache-${{ env.HASH }}

      - name: Setup Miniconda
        uses: conda-incubator/setup-miniconda@d2e6a045a86077fb6cad6f5adf368e9076ddaa8d # v3.1.0
        with:
          condarc-file: .github\condarc-${{ matrix.default-channel }}
          run-post: false  # skip post cleanup
          pkgs-dirs: D:\conda_pkgs_dir
          installation-dir: D:\conda

      - name: Conda Install
        run: >
          conda install
          --yes
          --file tests\requirements.txt
          --file tests\requirements-${{ runner.os }}.txt
          --file tests\requirements-ci.txt
          --file tests\requirements-s3.txt
          ${{ env.REQUIREMENTS_TRUSTSTORE }}
          python=${{ matrix.python-version }}

      - name: Conda Info
        # view test env info (not base)
        run: python -m conda info --verbose

      - name: Conda Config
        run: conda config --show-sources

      - name: Conda List
        run: conda list --show-channel-urls

      - name: Run Tests
        # Windows is sensitive to long paths, using `--basetemp=${{ runner.temp }} to
        # keep the test directories shorter
        run: >
          python -m pytest
          --cov=conda
          --basetemp=${{ runner.temp }}
          --durations-path=durations\${{ runner.os }}.json
          --group=${{ matrix.test-group }}
          --splits=${{ env.PYTEST_SPLITS }}
          -m "${{ env.PYTEST_MARKER }}"

      - name: Upload Coverage
        uses: codecov/codecov-action@1e68e06f1dbfde0e4cefc87efeba9e4643565303 # v5.1.2
        with:
          flags: ${{ runner.os }},${{ runner.arch }},${{ matrix.python-version }},${{ matrix.test-type }}
          token: ${{ secrets.CODECOV_TOKEN }}  # required

      - name: Upload Test Results
        if: '!cancelled()'
        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
        with:
          name: test-results-${{ env.HASH }}
          include-hidden-files: true
          path: |
            .coverage
            durations\${{ runner.os }}.json
            test-report.xml
          retention-days: 1  # temporary, combined in aggregate below

  # linux test suite
  linux:
    # only run test suite if there are code changes
    needs: changes
    if: github.event_name == 'schedule' || needs.changes.outputs.code == 'true'

    runs-on: ubuntu-latest
    defaults:
      run:
        # https://github.com/conda-incubator/setup-miniconda#use-a-default-shell
        shell: bash -el {0}  # bash exit immediately on error + login shell
    strategy:
      fail-fast: false
      matrix:
        # test all lower versions (w/ defaults) and upper version (w/ defaults and conda-forge)
        python-version: ['3.9', '3.10', '3.11', '3.12']
        default-channel: [defaults, conda-forge]
        test-type: [unit, integration]
        test-group: [1, 2, 3]
        exclude:
          - python-version: '3.9'
            default-channel: conda-forge
          - python-version: '3.10'
            default-channel: conda-forge
          - python-version: '3.11'
            default-channel: conda-forge
          - test-type: unit
            test-group: 3
    env:
      PYTEST_MARKER: ${{ matrix.test-type == 'unit' && 'not integration' || 'integration' }}
      PYTEST_SPLITS: ${{ matrix.test-type == 'unit' && '2' || '3' }}
      REQUIREMENTS_TRUSTSTORE: ${{ contains('3.10|3.11|3.12', matrix.python-version) && '--file tests/requirements-truststore.txt' || '' }}
      CONDA_TEST_SOLVERS: ${{ github.event_name == 'pull_request' && ( matrix.python-version != '3.12' || matrix.default-channel == 'conda-forge' ) && 'libmamba' || 'libmamba,classic' }}

    steps:
      - name: Checkout Source
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      - name: Hash + Timestamp
        run: echo "HASH=${{ runner.os }}-${{ runner.arch }}-Py${{ matrix.python-version }}-${{ matrix.default-channel }}-${{ matrix.test-type }}-${{ matrix.test-group }}-$(date -u "+%Y%m")" >> $GITHUB_ENV

      - name: Cache Conda
        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
        with:
          path: ~/conda_pkgs_dir
          key: cache-${{ env.HASH }}

      - name: Setup Miniconda
        uses: conda-incubator/setup-miniconda@d2e6a045a86077fb6cad6f5adf368e9076ddaa8d # v3.1.0
        with:
          condarc-file: .github/condarc-${{ matrix.default-channel }}
          run-post: false  # skip post cleanup

      - name: Conda Install
        run: >
          conda install
          --yes
          --file tests/requirements.txt
          --file tests/requirements-${{ runner.os }}.txt
          --file tests/requirements-ci.txt
          --file tests/requirements-s3.txt
          ${{ env.REQUIREMENTS_TRUSTSTORE }}
          python=${{ matrix.python-version }}

      - name: Conda Info
        # view test env info (not base)
        run: python -m conda info --verbose

      - name: Conda Config
        run: conda config --show-sources

      - name: Conda List
        run: conda list --show-channel-urls

      - name: Run Tests
        run: >
          python -m pytest
          --cov=conda
          --durations-path=durations/${{ runner.os }}.json
          --group=${{ matrix.test-group }}
          --splits=${{ env.PYTEST_SPLITS }}
          -m "${{ env.PYTEST_MARKER }}"

      - name: Upload Coverage
        uses: codecov/codecov-action@1e68e06f1dbfde0e4cefc87efeba9e4643565303 # v5.1.2
        with:
          flags: ${{ runner.os }},${{ runner.arch }},${{ matrix.python-version }},${{ matrix.test-type }}
          token: ${{ secrets.CODECOV_TOKEN }}  # required

      - name: Upload Test Results
        if: '!cancelled()'
        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
        with:
          name: test-results-${{ env.HASH }}
          include-hidden-files: true
          path: |
            .coverage
            durations/${{ runner.os }}.json
            test-report.xml
          retention-days: 1  # temporary, combined in aggregate below

  # linux benchmarks
  linux-benchmarks:
    # only run test suite if there are code changes
    needs: changes
    if: needs.changes.outputs.code == 'true'

    runs-on: ubuntu-22.04
    defaults:
      run:
        # https://github.com/conda-incubator/setup-miniconda#use-a-default-shell
        shell: bash -el {0}  # bash exit immediately on error + login shell
    strategy:
      fail-fast: false
      matrix:
        python-version: ['3.12']
    env:
      REQUIREMENTS_TRUSTSTORE: ${{ contains('3.10|3.11|3.12', matrix.python-version) && '--file tests/requirements-truststore.txt' || '' }}

    steps:
      - name: Checkout Source
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      - name: Hash + Timestamp
        run: echo "HASH=${{ runner.os }}-${{ runner.arch }}-Py${{ matrix.python-version }}-benchmark-$(date -u "+%Y%m")" >> $GITHUB_ENV

      - name: Cache Conda
        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
        with:
          path: ~/conda_pkgs_dir
          key: cache-${{ env.HASH }}

      - name: Setup Miniconda
        uses: conda-incubator/setup-miniconda@d2e6a045a86077fb6cad6f5adf368e9076ddaa8d # v3.1.0
        with:
          condarc-file: .github/condarc-defaults
          run-post: false  # skip post cleanup

      - name: Conda Install
        run: >
          conda install
          --yes
          --file tests/requirements.txt
          --file tests/requirements-${{ runner.os }}.txt
          --file tests/requirements-ci.txt
          --file tests/requirements-s3.txt
          --file tests/requirements-benchmarks.txt
          ${{ env.REQUIREMENTS_TRUSTSTORE }}
          python=${{ matrix.python-version }}

      - name: Conda Info
        # view test env info (not base)
        run: python -m conda info --verbose

      - name: Conda Config
        run: conda config --show-sources

      - name: Conda List
        run: conda list --show-channel-urls

      - name: Run Benchmarks
        uses: CodSpeedHQ/action@513a19673a831f139e8717bf45ead67e47f00044 # v3.2.0
        with:
          token: ${{ secrets.CODSPEED_TOKEN }}
          run: $CONDA/envs/test/bin/python -m pytest --codspeed

  # linux-qemu test suite
  linux-qemu:
    # only run test suite if there are code changes
    needs: changes
    if: github.event_name == 'schedule' || needs.changes.outputs.code == 'true'

    # Run one single fast test per docker+qemu emulated linux platform to test that
    # test execution is possible there (container+tools+dependencies work). Can be
    # changed / extended to run specific tests in case there are platform related
    # things to test. Running more tests is time consuming due to emulation
    # (factor 2-10x slower).
    runs-on: ubuntu-latest
    defaults:
      run:
        # https://github.com/conda-incubator/setup-miniconda#use-a-default-shell
        shell: bash -el {0}  # bash exit immediately on error + login shell
    strategy:
      fail-fast: false
      matrix:
        python-version: ['3.12']
        image:
          - continuumio/miniconda3:latest
          - condaforge/miniforge3:latest
        platform: [arm64, ppc64le, s390x]
        exclude:
          - image: continuumio/miniconda3:latest
            platform: ppc64le
          - image: condaforge/miniforge3:latest
            platform: s390x

    steps:
      - name: Checkout Source
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      - name: Setup QEMU
        uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0

      - name: Run Tests
        run: >
          docker run
          --rm
          --volume ${PWD}:/opt/conda-src
          --workdir /opt/conda-src
          --platform linux/${{ matrix.platform }}
          ${{ matrix.image }}
          bash -lc
          ". /opt/conda/etc/profile.d/conda.sh
          && set -x
          && conda create
          --name test
          --yes
          --file tests/requirements.txt
          --file tests/requirements-${{ runner.os }}.txt
          --file tests/requirements-ci.txt
          python=${{ matrix.python-version }}
          && conda activate test
          && python -m conda info --verbose
          && conda config --show-sources
          && conda list --show-channel-urls
          && python -m pytest tests/test_api.py::test_DepsModifier_contract"

  # linux memray
  linux-memray:
    # only run test suite if there are code changes
    needs: changes
    if: needs.changes.outputs.code == 'true'

    runs-on: ubuntu-latest
    defaults:
      run:
        # https://github.com/conda-incubator/setup-miniconda#use-a-default-shell
        shell: bash -el {0}  # bash exit immediately on error + login shell
    strategy:
      fail-fast: false
      matrix:
        python-version: ['3.12']

    steps:
      - name: Checkout Source
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      - name: Hash + Timestamp
        run: echo "HASH=${{ runner.os }}-${{ runner.arch }}-Py${{ matrix.python-version }}-memray-$(date -u "+%Y%m")" >> $GITHUB_ENV

      - name: Cache Conda
        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
        with:
          path: ~/conda_pkgs_dir
          key: cache-${{ env.HASH }}

      - name: Setup Miniconda
        uses: conda-incubator/setup-miniconda@d2e6a045a86077fb6cad6f5adf368e9076ddaa8d # v3.1.0
        with:
          condarc-file: .github/condarc-defaults
          run-post: false  # skip post cleanup

      - name: Conda Install
        run: >
          conda install
          --yes
          --file tests/requirements.txt
          --file tests/requirements-${{ runner.os }}.txt
          --file tests/requirements-ci.txt
          --file tests/requirements-s3.txt
          --file tests/requirements-truststore.txt
          python=${{ matrix.python-version }}
          conda-forge::pytest-memray

      - name: Conda Info
        # view test env info (not base)
        run: python -m conda info --verbose

      - name: Conda Config
        run: conda config --show-sources

      - name: Conda List
        run: conda list --show-channel-urls

      - name: Run memray
        run: python -m pytest -k memray --memray

  # macos test suite
  macos:
    # only run test suite if there are code changes
    needs: changes
    if: github.event_name == 'schedule' || needs.changes.outputs.code == 'true'

    runs-on: ${{ (matrix.arch == 'osx-64' && 'macos-13') || 'macos-14' }}
    defaults:
      run:
        # https://github.com/conda-incubator/setup-miniconda#use-a-default-shell
        shell: bash -el {0}  # bash exit immediately on error + login shell
    strategy:
      fail-fast: false
      matrix:
        # test lower version (w/ osx-64 & defaults & unit tests) and upper version (w/ osx-arm64 & conda-forge & integration tests)
        arch: [osx-64, osx-arm64]
        python-version: ['3.9', '3.12']
        default-channel: [defaults, conda-forge]
        test-type: [unit, integration]
        test-group: [1, 2, 3]
        exclude:
          - arch: osx-64
            python-version: '3.12'
          - arch: osx-64
            default-channel: conda-forge
          - arch: osx-64
            test-type: integration
          - arch: osx-arm64
            python-version: '3.9'
          - arch: osx-arm64
            default-channel: defaults
          - arch: osx-arm64
            test-type: unit
          - test-type: unit
            test-group: 3
    env:
      PYTEST_MARKER: ${{ matrix.test-type == 'unit' && 'not integration' || 'integration' }}
      PYTEST_SPLITS: ${{ matrix.test-type == 'unit' && '2' || '3' }}
      REQUIREMENTS_TRUSTSTORE: ${{ contains('3.10|3.11|3.12', matrix.python-version) && '--file tests/requirements-truststore.txt' || '' }}
      CONDA_TEST_SOLVERS: ${{ github.event_name == 'pull_request' && 'libmamba' || 'libmamba,classic' }}

    steps:
      - name: Checkout Source
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      - name: Hash + Timestamp
        run: echo "HASH=${{ runner.os }}-${{ runner.arch }}-Py${{ matrix.python-version }}-${{ matrix.default-channel }}-${{ matrix.test-type }}-${{ matrix.test-group }}-$(date -u "+%Y%m")" >> $GITHUB_ENV

      - name: Cache Conda
        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
        with:
          path: ~/conda_pkgs_dir
          key: cache-${{ env.HASH }}

      - name: Setup Miniconda
        uses: conda-incubator/setup-miniconda@d2e6a045a86077fb6cad6f5adf368e9076ddaa8d # v3.1.0
        with:
          condarc-file: .github/condarc-${{ matrix.default-channel }}
          run-post: false  # skip post cleanup
          # conda not preinstalled in arm64 runners
          miniconda-version: ${{ (matrix.default-channel == 'defaults' && matrix.arch == 'osx-arm64') && 'latest' || null }}
          miniforge-version: ${{ (matrix.default-channel == 'conda-forge' && matrix.arch == 'osx-arm64') && 'latest' || null }}
          architecture: ${{ runner.arch }}

      - name: Conda Install
        run: >
          conda install
          --yes
          --file tests/requirements.txt
          --file tests/requirements-ci.txt
          --file tests/requirements-s3.txt
          ${{ env.REQUIREMENTS_TRUSTSTORE }}
          python=${{ matrix.python-version }}

      - name: Conda Info
        # view test env info (not base)
        run: python -m conda info --verbose

      - name: Conda Config
        run: conda config --show-sources

      - name: Conda List
        run: conda list --show-channel-urls

      - name: Run Tests
        run: >
          python -m pytest
          --cov=conda
          --durations-path=durations/${{ runner.os }}.json
          --group=${{ matrix.test-group }}
          --splits=${{ env.PYTEST_SPLITS }}
          -m "${{ env.PYTEST_MARKER }}"

      - name: Upload Coverage
        uses: codecov/codecov-action@1e68e06f1dbfde0e4cefc87efeba9e4643565303 # v5.1.2
        with:
          flags: ${{ runner.os }},${{ runner.arch }},${{ matrix.python-version }},${{ matrix.test-type }}
          token: ${{ secrets.CODECOV_TOKEN }}  # required

      - name: Upload Test Results
        if: '!cancelled()'
        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
        with:
          name: test-results-${{ env.HASH }}
          include-hidden-files: true
          path: |
            .coverage
            durations/${{ runner.os }}.json
            test-report.xml
          retention-days: 1  # temporary, combined in aggregate below

  # aggregate and upload
  aggregate:
    # only aggregate test suite if there are code changes
    needs: [changes, windows, linux, linux-benchmarks, linux-qemu, macos]
    if: >-
      !cancelled()
      && (
        github.event_name == 'schedule'
        || needs.changes.outputs.code == 'true'
      )

    runs-on: ubuntu-latest
    steps:
      - name: Download Artifacts
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8

      - name: Upload Combined Test Results
        # provides one downloadable archive of all matrix run test results for further analysis
        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
        with:
          name: test-results-${{ github.sha }}-all
          include-hidden-files: true
          path: test-results-*
          retention-days: 7  # for durations.yml workflow

      - name: Test Summary
        uses: test-summary/action@31493c76ec9e7aa675f1585d3ed6f1da69269a86 # v2.4
        with:
          paths: test-results-*/test-report.xml

  # required check
  analyze:
    needs: [windows, linux, linux-qemu, linux-benchmarks, macos, aggregate]
    if: '!cancelled()'

    runs-on: ubuntu-latest
    steps:
      - name: Determine Success
        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
        id: alls-green
        with:
          # permit jobs to be skipped if there are no code changes (see changes job)
          allowed-skips: ${{ toJSON(needs) }}
          jobs: ${{ toJSON(needs) }}

      - name: Checkout our source
        if: always() && github.event_name != 'pull_request' && steps.alls-green.outputs.result == 'failure'
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Report failures
        if: always() && github.event_name != 'pull_request' && steps.alls-green.outputs.result == 'failure'
        uses: JasonEtco/create-an-issue@1b14a70e4d8dc185e5cc76d3bec9eab20257b2c5 # v2.9.2
        env:
          GITHUB_TOKEN: ${{ secrets.AUTO_REPORT_TEST_FAILURE }}
          RUN_ID: ${{ github.run_id }}
          TITLE: Tests failed
        with:
          filename: .github/TEST_FAILURE_REPORT_TEMPLATE.md
          update_existing: false

  # canary builds
  build:
    needs: [analyze]
    # only build canary build if
    # - prior steps succeeded,
    # - this is the main repo, and
    # - we are on the main, feature, or release branch
    if: >-
      !cancelled()
      && !github.event.repository.fork
      && (
        github.ref_name == 'main'
        || startsWith(github.ref_name, 'feature/')
        || endsWith(github.ref_name, '.x')
      )
    strategy:
      matrix:
        include:
          - runner: ubuntu-latest
            subdir: linux-64
          - runner: macos-13
            subdir: osx-64
          - runner: macos-latest
            subdir: osx-arm64
          - runner: windows-latest
            subdir: win-64
    runs-on: ${{ matrix.runner }}
    steps:
      # Clean checkout of specific git ref needed for package metadata version
      # which needs env vars GIT_DESCRIBE_TAG and GIT_BUILD_STR:
      - name: Checkout Source
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: ${{ github.ref }}
          clean: true
          fetch-depth: 0

      # Explicitly use Python 3.11 since each of the OSes has a different default Python
      - name: Setup Python
        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
        with:
          python-version: '3.11'

      - name: Detect Label
        shell: python
        run: |
          import re
          from pathlib import Path
          from os import environ
          from subprocess import check_output

          # unless otherwise specified, commits are uploaded to the dev label
          # e.g., `main` branch commits
          envs = {"ANACONDA_ORG_LABEL": "dev"}

          if "${{ github.ref_name }}".startswith("feature/"):
              # feature branch commits are uploaded to a custom label
              envs["ANACONDA_ORG_LABEL"] = "${{ github.ref_name }}"
          elif re.match(r"\d+(\.\d+)+\.x", "${{ github.ref_name }}"):
              # release branch commits are added to the rc label
              # see https://github.com/conda/infrastructure/issues/760
              _, name = "${{ github.repository }}".split("/")
              envs["ANACONDA_ORG_LABEL"] = f"rc-{name}-${{ github.ref_name }}"

              # if no releases have occurred on this branch yet then `git describe --tag`
              # will misleadingly produce a version number relative to the last release
              # and not relative to the current release branch, if this is the case we need
              # to override the version with a derivative of the branch name

              # override the version if `git describe --tag` does not start with the branch version
              last_release = check_output(["git", "describe", "--tag"], text=True).strip()
              prefix = "${{ github.ref_name }}"[:-1]  # without x suffix
              if not last_release.startswith(prefix):
                  envs["VERSION_OVERRIDE"] = "${{ github.ref_name }}"

          Path(environ["GITHUB_ENV"]).write_text("\n".join(f"{name}={value}" for name, value in envs.items()))

      - name: Create & Upload
        uses: conda/actions/canary-release@6e72e0db87e72f0020e493aeb02f864363bd9258 # v24.11.1
        env:
          # Run conda-build in isolated activation to properly package conda
          _CONDA_BUILD_ISOLATED_ACTIVATION: 1
        with:
          package-name: ${{ github.event.repository.name }}
          subdir: ${{ matrix.subdir }}
          anaconda-org-channel: conda-canary
          anaconda-org-label: ${{ env.ANACONDA_ORG_LABEL }}
          anaconda-org-token: ${{ secrets.ANACONDA_ORG_CONDA_CANARY_TOKEN }}