ci.yml

name: CI

on:
  workflow_dispatch: {}
  push:
    branches:
      - master
      - beta
      - sdk-release/**
      - feature/**
    tags:
      - v[0-9]+.[0-9]+.[0-9]+*
  pull_request:
    branches:
      - master
      - beta
      - sdk-release/**
      - feature/**

jobs:
  lint:
    name: Static Checks
    runs-on: ubuntu-latest
    steps:
      - uses: extractions/setup-just@v2
      - uses: actions/checkout@v3
      - name: Set up Python 3
        uses: actions/setup-python@v4
        with:
          python-version: "3.10"
      - name: check examples w/ mypy (against python@3.10)
        run: just typecheck-examples
      # skip deps on all these since mypy installed everything
      - name: check linting
        run: just --no-deps lint
      - name: check formatting
        run: just --no-deps format-check
      # pyright depends on node, which it handles and installs for itself as needed
      # we _could_ run setup-node to make it available for it if we're having reliability problems
      - name: check types (all Python versions)
        run: |
          set -eox

          for minor in {6..12}; do
            just --no-deps typecheck $minor
          done

  build:
    name: Build
    runs-on: ubuntu-latest
    steps:
      - uses: extractions/setup-just@v2
      - uses: actions/checkout@v3

      - name: Set up Python 3
        uses: actions/setup-python@v4
        with:
          python-version: "3.10"

      - name: Build and check package
        run: |
          just build

      - name: "Upload Artifact"
        uses: actions/upload-artifact@v3
        with:
          name: dist
          path: dist/

  test:
    # Specific ubuntu version to support python 3.6 testing
    # see https://github.com/actions/setup-python/issues/544#issuecomment-1332535877 for details
    # move to ubuntu-latest when we drop 3.6
    runs-on: ubuntu-20.04
    strategy:
      fail-fast: false
      matrix:
        python_version:
          - "3.6"
          - "3.7"
          - "3.8"
          - "3.9"
          - "3.10"
          - "3.11"
          - "3.12"
          - "pypy-3.7"
          - "pypy-3.8"
          - "pypy-3.9"
          - "pypy-3.10"
    name: Test (${{ matrix.python_version }})
    steps:
      - uses: extractions/setup-just@v2
      - uses: actions/checkout@v3
      - name: Set up Python ${{ matrix.python_version }}
        uses: actions/setup-python@v4
        with:
          python-version: ${{ matrix.python_version }}
      - uses: stripe/openapi/actions/stripe-mock@master

      - name: "run tests"
        run: just test

  publish:
    name: Publish
    if: >-
      ((github.event_name == 'workflow_dispatch') || (github.event_name == 'push')) &&
      startsWith(github.ref, 'refs/tags/v') &&
      endsWith(github.actor, '-stripe')
    needs: [build, test, lint]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Download all workflow run artifacts
        uses: actions/download-artifact@v3
        with:
          name: dist
          path: dist
      - name: Set up Python 3
        uses: actions/setup-python@v4
        with:
          python-version: "3.10"

      - name: Configure GPG Key
        run: |
          set -ex
          echo $GPG_SIGNING_PRIVKEY | base64 --decode | gpg --import --batch --yes --pinentry-mode loopback --passphrase "$GPG_SIGNING_PASSPHRASE"
        env:
          GPG_SIGNING_PRIVKEY: ${{ secrets.GPG_SIGNING_PRIVKEY }}
          GPG_SIGNING_PASSPHRASE: ${{ secrets.GPG_SIGNING_PASSPHRASE }}
      - name: Install tools
        run: just install-build-deps
      - name: Publish packages to PyPI
        # could probably move this into a just recipe too?
        run: |
          set -ex
          source .venv/bin/activate
          export VERSION=$(cat VERSION)
          gpg --detach-sign --local-user $GPG_SIGNING_KEYID  --pinentry-mode loopback --passphrase $GPG_SIGNING_PASSPHRASE -a dist/stripe-$VERSION.tar.gz
          gpg --detach-sign --local-user $GPG_SIGNING_KEYID  --pinentry-mode loopback --passphrase $GPG_SIGNING_PASSPHRASE -a dist/stripe-$VERSION-py2.py3-none-any.whl

          python -m twine upload --verbose dist/stripe-$VERSION.tar.gz  dist/stripe-$VERSION-py2.py3-none-any.whl dist/stripe-$VERSION.tar.gz.asc dist/stripe-$VERSION-py2.py3-none-any.whl.asc
        env:
          GPG_SIGNING_KEYID: ${{ secrets.GPG_SIGNING_KEYID }}
          TWINE_USERNAME: ${{ secrets.TWINE_USERNAME }}
          TWINE_PASSWORD: ${{ secrets.TWINE_PASSWORD }}
          GPG_SIGNING_PASSPHRASE: ${{ secrets.GPG_SIGNING_PASSPHRASE }}
      - uses: stripe/openapi/actions/notify-release@master
        if: always()
        with:
          bot_token: ${{ secrets.SLACK_BOT_TOKEN }}