ci.yml

---
name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

env:
  FORCE_COLOR: "1" # Make tools pretty.
  PIP_DISABLE_PIP_VERSION_CHECK: 1
  PIP_NO_PYTHON_VERSION_WARNING: 1
  SETUPTOOLS_SCM_PRETEND_VERSION: "1.0" # avoid warnings about shallow checkout

permissions: {}

jobs:
  tests:
    name: Tests on ${{ matrix.python-version }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version:
          - "3.9"
          - "3.10"
          - "3.11"
          - "3.12"
          - "3.13"
          - "pypy-3.9"
          - "pypy-3.10"

    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
          persist-credentials: false
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          allow-prereleases: true
          cache: pip
      - run: python -Im pip install tox

      - name: Determine Python version for tox
        env:
          V: ${{ matrix.python-version }}
        run: |
          if [[ "$V" = pypy-* ]]; then
            V=$(echo $V | tr -d .-)
          else
            V=py$(echo $V | tr -d .)
          fi

          echo TOX_PYTHON=$V >>$GITHUB_ENV

      - run: python -Im tox run -f $TOX_PYTHON

  system-package:
    runs-on: ubuntu-latest
    name: Install and test with system package of Argon2

    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: actions/setup-python@v5
        with:
          python-version-file: .python-version-default
          cache: pip

      - name: Install dependencies
        run: |
          sudo apt-get install libargon2-0 libargon2-0-dev
          # Ensure we cannot use our own Argon2 by accident.
          rm -rf extras
      - run: python -Im pip install tox
      - run: python -Im tox run -e system-argon2

  package:
    name: Build & verify package
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
          persist-credentials: false
      - uses: hynek/build-and-inspect-python-package@v2
        id: baipp

      - uses: actions/setup-python@v5
        with:
          cache: pip
          python-version: "3.x"  # use the one that baipp used

      # Smoke-check the wheel against argon2-cffi.
      - run: python -Im pip install $DIST/*.whl
        env:
          DIST: ${{ steps.baipp.outputs.dist }}
      - run: python -Im pip install --no-deps git+https://github.com/hynek/argon2-cffi.git
      - run: python -Im argon2 -n 1 -t 1 -m 8 -p 1

  install-dev:
    name: Verify dev env
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]

    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
          persist-credentials: false
      - uses: actions/setup-python@v5
        with:
          cache: pip
          python-version-file: .python-version-default
      - run: python -Im pip install -e .[dev]

      - name: Import package
        run: python -c 'from _argon2_cffi_bindings import ffi, lib; print(lib.ARGON2_VERSION_NUMBER)'
      - run: otool -L src/_argon2_cffi_bindings/_ffi.abi3.so
        if: startsWith(matrix.os , 'macos')
      - run: ldd src/_argon2_cffi_bindings/_ffi.abi3.so
        if: startsWith(matrix.os , 'ubuntu')

  cog-check:
    name: Ensure cogified files are up-to-date
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
          persist-credentials: false
      - uses: actions/setup-python@v5
        with:
          cache: pip
          python-version: "3.x"

      - run: python -Im pip install tox

      - run: python -Im tox run -e cog-check

  required-checks-pass:
    name: Ensure everything required is passing for branch protection
    if: always()

    needs:
      - tests
      - install-dev
      - package
      - system-package
      - cog-check

    runs-on: ubuntu-latest

    steps:
      - name: Decide whether the needed jobs succeeded or failed
        uses: re-actors/alls-green@release/v1
        with:
          jobs: ${{ toJSON(needs) }}