{#- OZI 0.1
# ozi/templates/github_workflows/checkpoint.yml.j2
# Part of the OZI Project, under the Apache License v2.0 with LLVM Exceptions.
# See LICENSE.txt for license information.
# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
-#}
{%- for python_version in [spec.python.support.security, spec.python.support.bugfix2, spec.python.support.bugfix1] %}
  checkpoint-{{ python_version|wheel_repr|replace('py', 'cp') }}-ubuntu-latest:
    name: checkpoint (Python {{ python_version }} on ubuntu-latest)
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
    permissions:
        id-token: write
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            files.pythonhosted.org:443
            github.com:443
            oziproject.dev:443
            pypi.org:443
            registry.npmjs.org:443
            objects.githubusercontent.com:443
            fulcio.sigstore.dev:443
            rekor.sigstore.dev:443
            tuf-repo-cdn.sigstore.dev:443

      - uses: OZI-Project/checkpoint@{{ spec.python.ci.checkpoint.version }}
        with:
          python-version: "{{ python_version }}"
{% endfor -%}

  checkpoint:
    runs-on: ubuntu-latest
    needs: [{%- for python_version in [spec.python.support.security, spec.python.support.bugfix2, spec.python.support.bugfix1] %}checkpoint-{{ python_version|wheel_repr|replace('py', 'cp') }}-ubuntu-latest, {%- endfor %}]
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
        with:
          disable-sudo: true
          egress-policy: block
