ci.yaml

name: CI

on:
  push:
  pull_request_target:
    types: [labeled]

env:
  POETRY_VERSION: "1.5.1"

jobs:
  prepare:
    name: "Prepare"
    runs-on: "ubuntu-22.04"
    outputs:
      sdk-test-credentials: "${{ steps.secrets.outputs.SDK_TEST_CREDENTIALS }}"

    permissions:
      id-token: "write"

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: "Authenticate to Google Cloud"
        id: "gcp-auth"
        uses: "google-github-actions/auth@v1"
        with:
          token_format: "access_token"
          workload_identity_provider: "${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}"
          service_account: "${{ secrets.SERVICE_ACCOUNT }}"

      - name: "Get secrets"
        id: "secrets"
        uses: "google-github-actions/get-secretmanager-secrets@v1"
        with:
          secrets: |-
            SDK_TEST_CREDENTIALS:projects/${{ secrets.GCP_PROJECT_NAME }}/secrets/SDK_TEST_CREDENTIALS

  ci:
    name: CI ${{ matrix.os }} / Python ${{ matrix.python-version }}
    runs-on: ${{ matrix.os }}
    if: github.event_name == 'push' || contains(github.event.pull_request.labels.*.name, 'pr approved')
    needs: "prepare"
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-20.04]
        python-version: ["3.8", "3.9", "3.10", "3.11"]
    env:
      PYTHONDONTWRITEBYTECODE: 1

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup python ${{ matrix.python-version }}
        uses: actions/setup-python@v4
        with:
          python-version: ${{ matrix.python-version }}

      - name: Setup poetry ${{ env.POETRY_VERSION }}
        run: |
          curl -sSl https://install.python-poetry.org | python - --version ${{ env.POETRY_VERSION }}
          ln -s ${POETRY_HOME}/bin/poetry /usr/local/bin/poetry
          echo "$HOME/.poetry/bin" >> $GITHUB_PATH

      - name: Set up poetry cache
        uses: actions/cache@v3
        with:
          path: /home/runner/.cache/pypoetry/virtualenvs
          key: venv-${{ matrix.os }}-${{ matrix.python-version }}-${{ hashFiles('**/poetry.lock') }}
          restore-keys: venv-${{ matrix.os }}-${{ matrix.python-version }}-

      - name: Install dependencies
        run: |
          poetry install --sync --no-root

      - name: Lint
        run: |
          ./bin/lint.sh

      - name: Create config
        env:
          SDK_TEST_CREDENTIALS: ${{ needs.prepare.outputs.sdk-test-credentials }}
        run: |
          echo "USERNAME = \"$(jq -r .username <<< ${SDK_TEST_CREDENTIALS})\"" > tests/config.py
          echo "PASSWORD = \"$(jq -r .password <<< ${SDK_TEST_CREDENTIALS})\"" >> tests/config.py

      - name: Test
        run: |
          ./bin/test.sh

  release-package:
    name: "Release package"
    runs-on: "ubuntu-22.04"
    needs: ["prepare", "ci"]
    env:
      PYTHON_VERSION: "3.11"
    if: contains('refs/heads/master refs/heads/main', github.ref)

    permissions:
      contents: "write"
      id-token: "write"

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: "Setup python ${{ env.PYTHON_VERSION }}"
        uses: "actions/setup-python@v4"
        with:
          python-version: "${{ env.PYTHON_VERSION }}"
          cache: "pip"

      - name: "Setup poetry ${{ env.POETRY_VERSION }}"
        run: |
          curl -sSL https://install.python-poetry.org | POETRY_HOME="$HOME/.poetry" python - --version ${{ env.POETRY_VERSION }} --force
          echo "$HOME/.poetry/bin" >> $GITHUB_PATH

      - name: Should publish package
        id: should-publish-package
        run: |
          npm install -g semver

          ALL_GIT_TAGS=$(git tag)
          ALL_RELEASES=$(semver ${ALL_GIT_TAGS})
          LAST_RELEASE=$(semver ${ALL_GIT_TAGS} | tail -n1)

          # Current version set in pyproject.toml file
          CURRENT_VERSION=$(semver $(poetry version -s))

          if [[ $ALL_RELEASES == *"${CURRENT_VERSION}"* ]]; then
              echo "::warning::Package version in pyproject.toml not bumped, will not publish new package"
              echo "publish=0" >> $GITHUB_OUTPUT
          else
              echo "::info::Package will be released. Last release version: ${LAST_RELEASE}, current version: ${CURRENT_VERSION}"
              echo "publish=1" >> $GITHUB_OUTPUT
          fi

      - name: Get version
        id: get-version
        run: |
          echo "version=$(poetry version -s)" >> $GITHUB_OUTPUT
        if: steps.should-publish-package.outputs.publish == 1

      - name: "Build final package"
        run: |
          poetry build
        if: steps.should-publish-package.outputs.publish == 1

      - name: "Publish package to PyPI"
        uses: pypa/gh-action-pypi-publish@release/v1
        if: steps.should-publish-package.outputs.publish == 1

      - name: "Create release"
        uses: softprops/action-gh-release@v1
        with:
          tag_name: v${{ steps.get-version.outputs.version }}
          generate_release_notes: true
        if: steps.should-publish-package.outputs.publish == 1