pull-request.yml

name: pull-request
on:
  pull_request:
    branches:
      - develop

jobs:

  tox:
    strategy:
      matrix:
        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]

    runs-on: ubuntu-latest
    if: github.repository == 'NHSDigital/mesh-client'
    steps:
      - name: checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: print branch info
        run: |
          git branch
          echo "GITHUB_HEAD_REF=${GITHUB_HEAD_REF}"
          echo "GITHUB_BASE_REF=${GITHUB_BASE_REF}"
          git log --oneline -n 10

      - name: clean
        run: |
          git clean -fdx
          find . -type f | xargs chmod g+w

      - name: merge into base_branch
        if: ${{ github.event_name == 'pull_request' }}
        run: |
          echo base branch "${{ github.base_ref }}"
          echo "pr branch ${GITHUB_HEAD_REF}"
          git checkout "${{ github.base_ref }}"
          git checkout -b "merging-${{ github.event.number }}"
          git merge --ff-only "${{ github.event.pull_request.head.sha }}"

      - name: setup python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ matrix.python-version }}

      - name: start docker containers
        run: make up

      - name: install dependencies
        run: pip install --prefer-binary tox==4.58.0 tox-gh-actions==3.5.0

      - name: tox
        run: tox

      - name: stop docker containers
        if: success() || failure()
        run: make down


  coverage:
    runs-on: ubuntu-latest
    permissions:
      checks: write
      pull-requests: write
    if: github.repository == 'NHSDigital/mesh-client'
    steps:
      - name: checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: print branch info
        run: |
          git branch
          echo "GITHUB_HEAD_REF=${GITHUB_HEAD_REF}"
          echo "GITHUB_BASE_REF=${GITHUB_BASE_REF}"
          git log --oneline -n 10

      - name: clean
        run: |
          git clean -fdx
          find . -type f | xargs chmod g+w

      - name: secrets-check
        run: make check-secrets

      - name: merge into base_branch
        if: ${{ github.event_name == 'pull_request' }}
        run: |
          echo base branch "${{ github.base_ref }}"
          echo "pr branch ${GITHUB_HEAD_REF}"
          git checkout "${{ github.base_ref }}"
          git checkout -b "merging-${{ github.event.number }}"
          git merge --ff-only "${{ github.event.pull_request.head.sha }}"

      - name: setup python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version-file: 'pyproject.toml'

      - name: setup poetry
        uses: abatilo/actions-poetry@3765cf608f2d4a72178a9fc5b918668e542b89b1 # v4
        with:
          poetry-version: 2.1.3

      - name: add poetry plugins
        run: |
          poetry self add "poetry-dynamic-versioning[plugin]"

      - name: cache virtualenv
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            .venv
          key: ${{ runner.os }}-v3-poetry-py${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('./poetry.lock') }}

      - name: git reset
        run: git reset --hard

      - name: install dependencies
        run: make install-ci

      - name: black
        run: make black-check

      - name: start docker containers
        run: make up

      - name: code coverage
        run: make coverage-ci

      - name: code coverage report
        if: ${{ github.event_name == 'pull_request' }}
        uses: orgoro/coverage@71cf993a407154ad9d8dd027c88a374b0ed002a9 # v3.3
        with:
          coverageFile: reports/coverage.xml
          token: ${{ secrets.GITHUB_TOKEN }}
          thresholdAll: 0.70

      - name: prepare sonar reports
        if: success() || failure()
        run: |
          cat sonar-project.properties
          scripts/sonar_tests.py

      - name: sonar scan
        if: success() || failure()
        uses: SonarSource/sonarqube-scan-action@d209202bc7d53ff1cc128f7f907dac145c9d6ae9 # v8.3.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}


      - name: archive reports
        if: github.actor != 'dependabot[bot]' && (success() || failure())
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        with:
          name: reports
          path: reports/**/*

      - name: publish junit reports
        if: success() || failure()
        uses: mikepenz/action-junit-report@6ef3fdcfcd5f0b5d14df3e659ef19b8c6820f93d # v6.6.1
        with:
          check_name: junit reports
          report_paths: reports/junit/*.xml

      - name: stop docker containers
        if: success() || failure()
        run: make down

  lint:
    runs-on: ubuntu-latest
    if: github.repository == 'NHSDigital/mesh-client'
    steps:
      - name: checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: clean
        run: |
          git clean -fdx

      - name: secrets-check
        run: make check-secrets

      - name: merge into base_branch
        if: ${{ github.event_name == 'pull_request' }}
        run: |
          echo base branch "${{ github.base_ref }}"
          echo "pr branch ${GITHUB_HEAD_REF}"
          git checkout "${{ github.base_ref }}"
          git checkout -b "merging-${{ github.event.number }}"
          git merge --ff-only "${{ github.event.pull_request.head.sha }}"

      - name: setup python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version-file: 'pyproject.toml'

      - name: setup poetry
        uses: abatilo/actions-poetry@3765cf608f2d4a72178a9fc5b918668e542b89b1 # v4
        with:
          poetry-version: 2.1.3

      - name: add poetry plugins
        run: |
          poetry self add "poetry-dynamic-versioning[plugin]"

      - name: cache virtualenv
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            .venv
          key: ${{ runner.os }}-v3-poetry-py${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('./poetry.lock') }}

      - name: git reset
        run: git reset --hard

      - name: install dependencies
        run: make install-ci

      - name: black
        run: make black-check

      - name: ruff
        run: make ruff-ci

      - name: mypy
        run: make mypy

      - name: shellcheck
        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # v2.0.0
        with:
          ignore_paths: .venv build
          ignore_names: git-secrets
        env:
          SHELLCHECK_OPTS: -f gcc -e SC1090,SC1091

      - name: test next version
        run: |
          version="v$(poetry version patch | rev | cut -d' ' -f1 | rev)"
          echo "RELEASE_VERSION=$version" >> $GITHUB_ENV
          echo "${version}"


  publish:
    runs-on: ubuntu-latest
    if: github.repository == 'NHSDigital/mesh-client' && github.actor != 'dependabot[bot]'
    needs:
      - coverage
      - lint
      - tox
    steps:
      - name: checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: print branch info
        run: |
          git branch
          echo "GITHUB_HEAD_REF=${GITHUB_HEAD_REF}"
          echo "GITHUB_BASE_REF=${GITHUB_BASE_REF}"
          git log --oneline -n 10

      - name: clean
        run: |
          git clean -fdx
          find . -type f | xargs chmod g+w

      - name: merge into base_branch
        if: ${{ github.event_name == 'pull_request' }}
        run: |
          echo base branch "${{ github.base_ref }}"
          echo "pr branch ${GITHUB_HEAD_REF}"
          git checkout "${{ github.base_ref }}"
          git checkout -b "merging-${{ github.event.number }}"
          git merge --ff-only "${{ github.event.pull_request.head.sha }}"

      - name: setup python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version-file: 'pyproject.toml'

      - name: setup poetry
        uses: abatilo/actions-poetry@3765cf608f2d4a72178a9fc5b918668e542b89b1 # v4
        with:
          poetry-version: 2.1.3

      - name: add poetry plugins
        run: |
          poetry self add "poetry-dynamic-versioning[plugin]"
          poetry self add poetry-plugin-export

      - name: build dist
        run: |
          RELEASE_VERSION="$(poetry version prepatch | rev | cut -d' ' -f1 | rev  | sed -E 's/0+$//' )$(date '+%Y%m%d%H%M%S')"
          echo "${RELEASE_VERSION}"
          echo "RELEASE_VERSION=${RELEASE_VERSION}" >> $GITHUB_ENV
          if [[ "${RELEASE_VERSION}" == "0.0.0" ]]; then
            echo "${RELEASE_VERSION} = 0.0.0"
            exit 1
          fi
          RELEASE_VERSION="${RELEASE_VERSION}" make dist
          ls -l dist

      - name: test publish
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        with:
          password: ${{ secrets.TEST_PYPI_TOKEN }}
          repository-url: https://test.pypi.org/legacy/

      - name: sleep while waiting for pyPI
        run: sleep 30

      - name: install and test
        run: |
          poetry export --only main -f requirements.txt -o requirements.txt
          python3 -m pip install --only-binary :all: --require-hashes -r requirements.txt
          python3 -m pip install --only-binary :all: --index-url https://test.pypi.org/simple/ "mesh-client==${RELEASE_VERSION}"
          INSTALLED_VERSION="$(python3 -c 'import mesh_client; print(mesh_client.__version__)')"
          if [[ "${INSTALLED_VERSION}" != "${RELEASE_VERSION}" ]]; then
            echo "${INSTALLED_VERSION} != ${RELEASE_VERSION}"
            exit 1
          fi

  slack-notification:
    runs-on: ubuntu-latest
    needs:
      - coverage
      - lint
      - tox
    if: ${{ always() && github.repository == 'NHSDigital/mesh-client' && github.actor == 'dependabot[bot]' && contains(needs.*.result, 'failure') }}
    steps:
      - name: Slack Notification
        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
        with:
          webhook: ${{ secrets.DEPENDABOT_SLACK_WEBHOOK_URL }}
          webhook-type: incoming-webhook
          payload: |
            {
              "blocks": [
                {
                  "type": "header",
                  "text": {
                    "type": "plain_text",
                    "text": ":alarm: DEPENDABOT PR FAILED :alarm:",
                    "emoji": true
                  }
                },
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": "Checks failed for ${{ github.repository }}:${{ github.ref }} in <https://github.com/${{ github.repository }}/pull/${{ github.event.number }}|PR #${{ github.event.number }}>"
                  }
                }
              ]
            }