name: Python Package

on:
  push:
    branches:
     - main
    tags:
      - '*'

  merge_group:
  pull_request:
    branches:
      - main

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        os:
          - 'macos-12'
          - 'windows-latest'

    runs-on: ${{ matrix.os }}
    name: Wheel for ${{ matrix.os }}

    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          fetch-depth: 0
          submodules: 'recursive'

      - name: Add powerpc-unknown-linux-gnu
        run: rustup target add --toolchain stable powerpc-unknown-linux-gnu
      - uses: Swatinem/rust-cache@v2
      
      - name: Build wheels
        run: pipx run cibuildwheel==2.14.1 --output-dir dist
        env:
          CIBW_BUILD: 'cp38-*'
          CIBW_SKIP: '*-win32 *-manylinux_i686'

      - name: Check if there are changes
        run: git diff --exit-code

      - name: Store the packages
        uses: actions/upload-artifact@v3
        with:
          name: python-package-distributions
          path: dist

  linux-build:
    runs-on: ubuntu-latest
    container: ghcr.io/pyca/cryptography-manylinux2014:x86_64
    name: Wheel for Linux
    env:
      RUSTUP_HOME: /root/.rustup

    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          fetch-depth: 0
          submodules: 'recursive'

      - name: Avoid issues with Git's solution for CVE-2022-24765 breaking setuptools-scm
        run: git config --global --add safe.directory $(pwd)

      - name: Add powerpc-unknown-linux-gnu
        run: rustup target add --toolchain stable powerpc-unknown-linux-gnu

      - uses: Swatinem/rust-cache@v2

      - run: /opt/python/cp38-cp38/bin/python -m venv .venv
     
      - name: Update pip
        run: .venv/bin/python -m pip install --upgrade pip

      - name: Install Python packages
        run: .venv/bin/python -m pip install --upgrade build auditwheel

      - name: build wheel
        run: .venv/bin/python -m build

      - name: multilinux stuff
        run: |
          .venv/bin/python -m auditwheel repair --plat manylinux2014_x86_64 dist/*-linux_x86_64.whl -w dist
          rm dist/*-linux_x86_64.whl

      - name: Check if there are changes
        run: git diff --exit-code

      - name: Store the packages
        uses: actions/upload-artifact@v3
        with:
          name: python-package-distributions
          path: dist

  test:
    needs:
      - build
      - linux-build
      
    runs-on: ${{ matrix.os.image }}
    name: ${{ matrix.os.name }} - Test Python ${{ matrix.python }}
    strategy:
      fail-fast: false
      matrix:
        os:
          - {name: 'macOS', image: 'macos-latest', wheel: 'macosx_*'}
          - {name: 'Windows', image: 'windows-latest', wheel: 'win_amd64'}
          - {name: 'Linux', image: 'ubuntu-latest', wheel: 'manylinux_2_17_x86_64.manylinux2014_x86_64'}
        python:
          - '3.8'
          - '3.9'
          - '3.10'
          - '3.11'
          - '3.12'

    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: ${{ matrix.python }}

      - name: Download all the dists
        uses: actions/download-artifact@v3
        with:
          name: python-package-distributions
          path: dist/
            
      - name: Install Python packages
        run: python -m pip install --upgrade pip pytest

      - name: install built wheel
        run: python -m pip install dist/*-${{ matrix.os.wheel }}.whl
        shell: bash

      - name: test
        run: python -m pytest
        working-directory: test

  pypi:
    runs-on: 'ubuntu-latest'
    needs:
      - test

    steps:
      - name: Download all the dists
        uses: actions/download-artifact@v3
        with:
          name: python-package-distributions
          path: dist/

      - name: Publish 📦 to TestPyPI
        if: ${{ github.ref == 'refs/heads/main' }}
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          password: ${{ secrets.testpypi_password }}
          repository-url: https://test.pypi.org/legacy/
      
      - name: Publish 📦 to PyPI
        if: ${{ startsWith(github.ref, 'refs/tags/') }}
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          password: ${{ secrets.pypi_password }}
