{#- OZI 0.9
# ozi/templates/github_workflows/checkpoint.yml.j2
# SPDX-License-Identifier: Unlicense
-#}
{%- set endpoints %}
        allowed-endpoints: >
            files.pythonhosted.org:443
            github.com:443
            api.github.com:443
            oziproject.dev:443
            pypi.org:443
            registry.npmjs.org:443
            objects.githubusercontent.com:443
            fulcio.sigstore.dev:443
            rekor.sigstore.dev:443
            tuf-repo-cdn.sigstore.dev:443
            oauth2.sigstore.dev:443
{% endset %}
{%- set python_version=spec.python.support.security2 %}
  checkpoint-{{ python_version|wheel_repr|replace('py', 'cp') }}-ubuntu-latest:
    name: checkpoint (Python {{ python_version }} on ubuntu-latest)
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
    permissions:
        id-token: write
    steps:
{%- if project.github_harden_runner %}
{% include "github_workflows/harden_runner.yml.j2" %}
{{ endpoints }}
{%- endif %}

      - uses: OZI-Project/checkpoint@{{ spec.python.ci.checkpoint.version }}
        with:
          python-version: "{{ python_version }}"

{%- set python_version=spec.python.support.security1 %}
  checkpoint-{{ python_version|wheel_repr|replace('py', 'cp') }}-ubuntu-latest:
    name: checkpoint (Python {{ python_version }} on ubuntu-latest)
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
    permissions:
        id-token: write
    steps:
{%- if project.github_harden_runner %}
{% include "github_workflows/harden_runner.yml.j2" %}
{{ endpoints }}
{%- endif %}

      - uses: OZI-Project/checkpoint@{{ spec.python.ci.checkpoint.version }}
        with:
          python-version: "{{ python_version }}"

{%- set python_version=spec.python.support.bugfix %}
  checkpoint-{{ python_version|wheel_repr|replace('py', 'cp') }}-ubuntu-latest:
    name: checkpoint (Python {{ python_version }} on ubuntu-latest)
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
    permissions:
        id-token: write
    steps:
{%- if project.github_harden_runner %}
{% include "github_workflows/harden_runner.yml.j2" %}
{{ endpoints }}
{%- endif %}

      - uses: OZI-Project/checkpoint@{{ spec.python.ci.checkpoint.version }}
        with:
          python-version: "{{ python_version }}"

{%- set python_version=spec.python.support.security1 %}
  checkpoint-{{ python_version|wheel_repr|replace('py', 'cp') }}-ubuntu-latest:
    name: checkpoint (Python {{ python_version }} on ubuntu-latest)
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
    permissions:
        id-token: write
    steps:
{%- if project.github_harden_runner %}
{% include "github_workflows/harden_runner.yml.j2" %}
{{ endpoints }}
{%- endif %}

      - uses: OZI-Project/checkpoint@{{ spec.python.ci.checkpoint.version }}
        with:
          python-version: "{{ python_version }}"

{%- set python_version=spec.python.support.bugfix %}
  checkpoint-{{ python_version|wheel_repr|replace('py', 'cp') }}-ubuntu-latest:
    name: checkpoint (Python {{ python_version }} on ubuntu-latest)
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
    permissions:
        id-token: write
    steps:
{%- if project.github_harden_runner %}
{% include "github_workflows/harden_runner.yml.j2" %}
{{ endpoints }}
{%- endif %}

      - uses: OZI-Project/checkpoint@{{ spec.python.ci.checkpoint.version }}
        with:
          python-version: "{{ python_version }}"

  checkpoint:
    runs-on: ubuntu-latest
    needs: [{%- for python_version in [spec.python.support.security2, spec.python.support.security1, spec.python.support.bugfix] %}checkpoint-{{ python_version|wheel_repr|replace('py', 'cp') }}-ubuntu-latest, {%- endfor %}]
{%- if project.github_harden_runner %}
    steps:
{% include "github_workflows/harden_runner.yml.j2" %}
{%- endif %}
