ci.yaml

name: ci

on:
  pull_request:
  push:
    branches:
      - master

jobs:
  pre-commit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: # for gitlint
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0
      - uses: actions/setup-python@v5
        with:
          python-version: ">=3.7"
          cache: pip
          cache-dependency-path: |
            .github/requirements.txt
            test/requirements*.txt
      - uses: actions/cache@v4
        with:
          path: ~/.cache/pre-commit
          key: pre-commit-${{hashFiles('.pre-commit-config.yaml')}}
      - name: Install dependencies
        run: |
          python3 -m venv venv  # for venv-run
          source venv/bin/activate
          python3 -m pip install -Ur .github/requirements.txt
      - run: venv/bin/gitlint --commits "origin/$GITHUB_BASE_REF..HEAD"
        if: github.event_name == 'pull_request'
      - name: Run pre-commit checks
        run: |
          source venv/bin/activate
          pre-commit run --color=always --all-files --show-diff-on-failure

  lint:
    runs-on: ubuntu-latest

    permissions:
      security-events: write

    steps:
      - name: Repository checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - id: ShellCheck
        name: Differential ShellCheck
        uses: redhat-plumbers-in-action/differential-shellcheck@v5
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

  distcheck:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - dist: alpine
          - dist: centos7
          - dist: debian10
          - dist: debian10
            bsd: true
            network: none
          - dist: fedoradev
          - dist: ubuntu14
    steps:
      - uses: actions/checkout@v4
      - uses: google-github-actions/release-please-action@v4
        with:
          config-file: .github/release-please-config.json
          manifest-file: .github/release-please-manifest.json
        id: release
        if: github.event_name == 'push' && matrix.dist == 'alpine'
      # A "container" workflow config would be cleaner here, but comes with
      # some restrictions/oddities: changes root's $HOME to /github/home
      # without changing the actual home dir that can cause some problems,
      # and does not provide a way to run with --network none.
      # fedoradev unconfined: https://bugzilla.redhat.com/1900021
      - name: Run main build
        run: >-
          docker run
          --rm
          --tty
          --env CI=true
          --env DIST=${{matrix.dist}}
          --env BSD=${{matrix.bsd}}
          --env PYTESTFLAGS="--verbose -p no:cacheprovider"
          --env NETWORK=$NETWORK
          ${NETWORK:+--network $NETWORK}
          $(test $DIST = fedoradev && echo --security-opt seccomp=unconfined)
          --volume $PWD:/usr/src/bash-completion
          --workdir /usr/src/bash-completion
          ghcr.io/scop/bash-completion/test:${{matrix.dist}}
          test/docker/entrypoint.sh
        env:
          DIST: ${{matrix.dist}}
          NETWORK: ${{matrix.network}}
      - uses: actions/upload-artifact@v4
        with:
          path: |
            bash-completion-*.tar.xz
            sha256sums.txt
        if: matrix.dist == 'alpine'
      - name: Upload release assets
        run: |
          set -x
          gh release upload ${{steps.release.outputs.tag_name}} \
            bash-completion-$(cat version.txt).tar.xz sha256sums.txt
        env:
          GH_TOKEN: ${{github.token}}
        if: steps.release.outputs.release_created