Triggered by Version Bump merged

name: Triggered by Version Bump merged

#disable all tags and enable all brannches and only version file
on:
  push:
    branches-ignore:
      - update-rc-version
      - update-version
    paths:
      - '!**'
      - "plenum/__version__.json"

jobs:
  release-infos:
    name: release-infos
    runs-on: ubuntu-latest
    outputs:
      isVersionBump: ${{ steps.get-release-info.outputs.isVersionBump }}
      isPreRelease: ${{ steps.get-release-info.outputs.isRC }}
      versionTag: ${{ steps.get-release-info.outputs.versionTag }}
      version: ${{ steps.get-release-info.outputs.version }}
      component: ${{ steps.get-release-info.outputs.component }}
      CACHE_KEY_BUILD: ${{ steps.workflow-setup.outputs.CACHE_KEY_BUILD }}
      UBUNTU_VERSION: ${{ steps.workflow-setup.outputs.UBUNTU_VERSION }}
      # Expose the lowercase version of the GitHub repository name
      # to all subsequent jobs that reference image repositories
      # as the push and pull operations require the URL of the repository
      # to be in lowercase.
      GITHUB_REPOSITORY_NAME: ${{ steps.workflow-setup.outputs.GITHUB_REPOSITORY_NAME }}
      distribution: ${{ steps.workflow-setup.outputs.distribution }}
      publish: ${{ steps.workflow-setup.outputs.publish }}
    steps:
      - name: checkout source code
        uses: actions/checkout@v4
      - name: get-release-info
        id: get-release-info
        uses: hyperledger/indy-shared-gha/.github/actions/get-release-info@v1
        with:
          versionString: "${{ github.event.head_commit.message }}"
      - name: workflow-setup
        id: workflow-setup
        uses: hyperledger/indy-shared-gha/.github/actions/workflow-setup@v1

  createRelease:
    name: Create Release
    needs: [release-infos]
    if: needs.release-infos.outputs.isVersionBump == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Download Plenum deb Artifacts from Github Action Artifacts
        uses: dawidd6/action-download-artifact@v5
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          workflow: releasepr.yaml
          workflow_conclusion: success
          name: plenum-deb
          path: artifacts/plenum-deb
      - name: Download Plenum python Artifacts from Github Action Artifacts
        uses: dawidd6/action-download-artifact@v5
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          workflow: releasepr.yaml
          workflow_conclusion: success
          name: plenum-python
          path: artifacts/plenum-python
      - name: Download Plenum third party dependency Artifacts from Github Action Artifacts
        uses: dawidd6/action-download-artifact@v5
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          workflow: releasepr.yaml
          workflow_conclusion: success
          name: third-party-dependencies
          path: artifacts/third-party-dependencies
      - uses: actions/upload-artifact@v4
        with:
          name: third-party-dependencies
          path: artifacts/third-party-dependencies
          retention-days: 5
      - uses: actions/upload-artifact@v4
        with:
          name: plenum-deb
          path: artifacts/plenum-deb
          retention-days: 5
      - uses: actions/upload-artifact@v4
        with:
          name: plenum-python
          path: artifacts/plenum-python
          retention-days: 5
      - name: Zip Files for Release
        run: |
          zip -r artifacts/plenum-deb.zip artifacts/plenum-deb
          zip -r artifacts/plenum-python.zip artifacts/plenum-python
          zip -r artifacts/third-party-dependencies.zip artifacts/third-party-dependencies
      - name: Generate Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ needs.release-infos.outputs.VERSIONTAG }}
          files: |
            artifacts/**.zip
          generate_release_notes: true
          body: "[${{ needs.release-infos.outputs.VERSIONTAG }}] "
          prerelease: ${{ needs.release-infos.outputs.isPreRelease }}
          target_commitish: ${{ github.event.ref }}
          name: "${{ needs.release-infos.outputs.VERSIONTAG }}"
          token: ${{ secrets.BOT_PR_PAT }}

  publish_artifacts:
    name: Publish Artifacts
    needs: [release-infos, createRelease]
    if: needs.release-infos.outputs.isVersionBump == 'true' && needs.release-infos.outputs.publish == 'true'
    uses: hyperledger/indy-shared-gha/.github/workflows/publish_artifacts.yaml@v1
    with:
      COMPONENT: ${{ needs.release-infos.outputs.component }}
      UBUNTU_VERSION: ${{ needs.release-infos.outputs.UBUNTU_VERSION }}
      distribution: ${{ needs.release-infos.outputs.distribution }}
      moduleName: plenum
    secrets:
      INDY_ARTIFACTORY_REPO_CONFIG: ${{ secrets.INDY_ARTIFACTORY_REPO_CONFIG }}
      PYPI_API_TOKEN: ${{ secrets.PYPI_API_TOKEN }}

  convertPyVersion:
    name: "Convert to python version flavour"
    needs: [release-infos, publish_artifacts]
    uses: hyperledger/indy-shared-gha/.github/workflows/pyVersionConversion.yaml@v1
    with:
      VERSIONTAG: ${{ needs.release-infos.outputs.VERSIONTAG }}

  triggerNodeUpdate:
    runs-on: ubuntu-latest
    needs: [release-infos, publish_artifacts, convertPyVersion]
    steps:
      - name: Repository Dispatch
        uses: peter-evans/repository-dispatch@v3
        with:
          token: ${{ secrets.BOT_PR_PAT }}
          repository: hyperledger/indy-node
          event-type: update-node
          client-payload: '{"pyVersion": "${{ needs.convertPyVersion.outputs.pyVersion }}", "debVersion": "${{ steps.conversion.outputs.debVersion }}", "email":"${{ github.event.pusher.email }}"}'


Triggered by Version Bump Release PR

name: Triggered by Version Bump Release PR

on:
  pull_request:
    paths:
      - '!**'
      - "plenum/__version__.json"

jobs:
  release-infos:
    name: infos
    runs-on: ubuntu-latest
    outputs:
      isVersionBump: ${{ steps.get-release-info.outputs.isVersionBump }}
      isPreRelease: ${{ steps.get-release-info.outputs.isRC }}
      CACHE_KEY_BUILD: ${{ steps.workflow-setup.outputs.CACHE_KEY_BUILD }}
      UBUNTU_VERSION: ${{ steps.workflow-setup.outputs.UBUNTU_VERSION }}
      # Expose the lowercase version of the GitHub repository name
      # to all subsequent jobs that reference image repositories
      # as the push and pull operations require the URL of the repository
      # to be in lowercase.
      GITHUB_REPOSITORY_NAME: ${{ steps.workflow-setup.outputs.GITHUB_REPOSITORY_NAME }}
      distribution: ${{ steps.workflow-setup.outputs.distribution }}
    steps:
      - name: checkout source code
        uses: actions/checkout@v4
      - name: get-release-info
        id: get-release-info
        uses: hyperledger/indy-shared-gha/.github/actions/get-release-info@v1
        with:
          versionString: "${{ github.event.pull_request.body }}"
      - name: workflow-setup
        id: workflow-setup
        uses: hyperledger/indy-shared-gha/.github/actions/workflow-setup@v1

  lint:
    name: Lint
    needs: [release-infos]
    if: needs.release-infos.outputs.isVersionBump == 'true'
    uses: hyperledger/indy-shared-gha/.github/workflows/lint.yaml@v1

  build-docker-image:
    name: Create Builder Image
    needs: [release-infos, lint]
    if: needs.release-infos.outputs.isVersionBump == 'true'
    uses:  hyperledger/indy-shared-gha/.github/workflows/buildimage.yaml@v1
    with:
      CACHE_KEY_BUILD: ${{ needs.release-infos.outputs.CACHE_KEY_BUILD }}
      DOCKER_IMAGE: ghcr.io/${{ needs.release-infos.outputs.GITHUB_REPOSITORY_NAME }}/plenum-build
      UBUNTU_VERSION: ${{ needs.release-infos.outputs.UBUNTU_VERSION }}

  build_packages:
    name: Build Packages
    needs: [release-infos, build-docker-image]
    if: needs.release-infos.outputs.isVersionBump == 'true'
    uses: hyperledger/indy-shared-gha/.github/workflows/buildpackages.yaml@v1
    with:
      DOCKER_IMAGE: ghcr.io/${{ needs.release-infos.outputs.GITHUB_REPOSITORY_NAME }}/plenum-build:${{ needs.release-infos.outputs.UBUNTU_VERSION }}
      UBUNTU_VERSION: ${{ needs.release-infos.outputs.UBUNTU_VERSION }}
      isDev: 'false'
      isRC: '${{ needs.release-infos.outputs.isPreRelease }}'
      moduleName: plenum

  plenum_tests:
    name: Test Plenum
    needs: [release-infos, lint, build_packages]
    if: needs.release-infos.outputs.isVersionBump == 'true'
    uses: ./.github/workflows/reuseable_test.yaml
    with:
      GITHUB_REPOSITORY_NAME: ${{ needs.release-infos.outputs.GITHUB_REPOSITORY_NAME }}
      UBUNTU_VERSION: ${{ needs.release-infos.outputs.UBUNTU_VERSION }}

  statusCheck:
    name: statusCheck
    runs-on: ubuntu-latest
    needs: [plenum_tests]
    steps:
      - run: 'echo "Just a status Check (Always true, when executed) for branch protection rules(blocks merging while test are running and if tests fail)." '


Test Indy Plenum

name: "Test Indy Plenum"

on:
  workflow_call:
    inputs:
      GITHUB_REPOSITORY_NAME:
        required: true
        type: string
      UBUNTU_VERSION:
        required: true
        type: string

jobs:
  indy_plenum_tests:
    name: Sliced Module Tests
    # Reference to workflow-setup job is required to access the GITHUB_REPOSITORY_NAME output.
    runs-on: ubuntu-20.04
    # Fix for scacap/action-surefire-report out of memory error:
    # - https://github.com/ScaCap/action-surefire-report/issues/17
    env:
      NODE_OPTIONS: "--max_old_space_size=4096"
      UBUNTU_VERSION: ${{ inputs.UBUNTU_VERSION }}
    container:
      image: ghcr.io/${{ inputs.GITHUB_REPOSITORY_NAME }}/plenum-build:${{ inputs.UBUNTU_VERSION }}
    strategy:
      matrix:
        module: [plenum]
        # To slice up the tests into smaller chunks add additional sequential
        # numbers here.  The subsequent steps will adjust automatically.
        # ${{ strategy.job-total }} is used to get the total number of slices.
        slice: [1, 2, 3, 4, 5, 6, 7, 8]
      fail-fast: false
    steps:
      - name: Check out code
        uses: actions/checkout@v4

      - name: Cache pip
        uses: actions/cache@v4
        with:
          # pip cache on the plenum-build image is not in the default location.
          # path: ~/.cache/pip
          path: /root/.cache/pip
          key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.txt', '**/setup.py') }}
          restore-keys: |
            ${{ runner.os }}-pip-

      - name: Download plenum deb build
        uses: actions/download-artifact@v4
        with:
          name: plenum-deb

      - name: Install dependencies from deb
        run: |
          apt update
          aptStr=$(dpkg-deb -I indy-plenum_*.deb | grep -P "Depends: " | sed 's~Depends:~~g;s~(~~g;s~)~~g;s~>~~g;s~<~~g' | tr -d " \t\n\r" | tr "," "\n")
          apt install -y ./indy-plenum_*.deb $aptStr libindy
          ln -s /usr/lib/ursa/libursa.so /usr/lib/libursa.so

      - name: Install dependencies
        run: |
          # Explicitly use the existing pip cache location in the plenum-build image.
          pip --cache-dir /root/.cache/pip install .[tests]

      - name: Run Indy Plenum ${{ matrix.module }} test slice ${{ matrix.slice }}/${{ strategy.job-total }}
        id: plenum-test
        run: RUSTPYTHONASYNCIODEBUG=0 python3 runner.py --pytest "python3 -m pytest -l -vv" --dir "${{ matrix.module }}" --output "test-result-plenum-${{ matrix.slice }}.txt" --test-only-slice "${{ matrix.slice }}/${{ strategy.job-total }}"

      - name: Publish Test Report
        if: success() || failure()
        uses: scacap/action-surefire-report@v1
        continue-on-error: true
        with:
          check_name: Indy Plenum ${{ matrix.module }} Test Report for slice ${{ matrix.slice }}/${{ strategy.job-total }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          report_paths: "*-test-results.xml"

      - name: Upload Detailed Test Failure Results
        # The test runner only emits the detailed test results if the tests fail.
        if: (steps.plenum-test.outcome == 'failure') && failure()
        uses: actions/upload-artifact@v4
        with:
          name: detailed-test-result-slice-${{ matrix.slice }}
          path: test-result-plenum-${{ matrix.slice }}.txt
          retention-days: 5

  indy_plenum_module_tests:
    name: Module Tests
    # Reference to workflow-setup job is required to access the GITHUB_REPOSITORY_NAME output.
    runs-on: ubuntu-20.04
    env:
      UBUNTU_VERSION: ${{ inputs.UBUNTU_VERSION }}
    container:
      image: ghcr.io/${{ inputs.GITHUB_REPOSITORY_NAME }}/plenum-build:${{ inputs.UBUNTU_VERSION }}
    strategy:
      matrix:
        module: [common, crypto, ledger, state, storage, stp_core, stp_zmq]
      fail-fast: false
    steps:
      - name: Check out code
        uses: actions/checkout@v4

      - name: Cache pip
        uses: actions/cache@v4
        with:
          # pip cache on the plenum-build image is not in the default location.
          # path: ~/.cache/pip
          path: /root/.cache/pip
          key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.txt', '**/setup.py') }}
          restore-keys: |
            ${{ runner.os }}-pip-

      - name: Download plenum deb build
        uses: actions/download-artifact@v4
        with:
          name: plenum-deb

      - name: Install dependencies from deb
        run: |
          apt update
          aptStr=$(dpkg-deb -I indy-plenum_*.deb | grep -P "Depends: " | sed 's~Depends:~~g;s~(~~g;s~)~~g;s~>~~g;s~<~~g' | tr -d " \t\n\r" | tr "," "\n")
          apt install -y ./indy-plenum_*.deb $aptStr libindy
          ln -s /usr/lib/ursa/libursa.so /usr/lib/libursa.so

      - name: Install dependencies
        run: |
          # Explicitly use the existing pip cache location in the plenum-build image.
          pip --cache-dir /root/.cache/pip install .[tests]

      - name: Run Indy Plenum ${{ matrix.module }} tests
        run: python3 -m pytest -l -vv --junitxml=test-result-plenum-${{ matrix.module }}.xml ${{ matrix.module }}

      - name: Publish Test Report
        uses: scacap/action-surefire-report@v1
        continue-on-error: true
        with:
          check_name: Indy Plenum ${{ matrix.module }} Test Report
          github_token: ${{ secrets.GITHUB_TOKEN }}
          report_paths: test-result-plenum-${{ matrix.module }}.xml


Triggered by set Tag

name: Triggered by set Tag

on:
  push:
    tags:
      - setRelease-v**

jobs:
  taginfos:
    name: get Tag infos
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.get-release-info.outputs.version }}
      versionTag: ${{ steps.get-release-info.outputs.versionTag }}
      prBranch: ${{ steps.get-release-info.outputs.prBranch }}
      BASE: ${{ steps.get-branch.outputs.branch }}
    steps:
      - name: checkout source code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: extract branch
        id: get-branch
        uses: hyperledger/indy-shared-gha/.github/actions/branch-from-tag@v1
        with:
          tag: ${{ github.ref }}
      - name: get-release-info
        id: get-release-info
        uses: hyperledger/indy-shared-gha/.github/actions/get-release-info@v1
        with:
          versionString: "${{ github.ref }}"

  bump_version:
    name: Bump Version Number
    needs: taginfos
    runs-on: ubuntu-20.04
    steps:
      - name: Check out code
        uses: actions/checkout@v4
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.8'
      - name: Install deps for version change
        run: pip install base58 \
                      importlib_metadata==3.10.1 \
                      packaging \
                      python-dateutil \
                      msgpack-python \
                      jsonpickle=3.0.3
      - name: Prepare package and set version
        run: |
          ./bump_version.sh ${{ needs.taginfos.outputs.VERSION }}

      - name: Create Pull Request
        uses: peter-evans/create-pull-request@v6
        with:
          author: ${{ github.actor }} <${{ github.event.pusher.email }}>
          committer: ${{ github.actor }} <${{ github.event.pusher.email }}>
          signoff: true
          commit-message: Update Version number for v${{ needs.taginfos.outputs.version }}
          base: ${{ needs.taginfos.outputs.BASE }}
          branch: ${{ needs.taginfos.outputs.prBranch }}
          title: "[${{ needs.taginfos.outputs.versionTag }}] - Update Version Number for Release"
          body: "[${{ needs.taginfos.outputs.versionTag }}] - Update Version number for Release"
          delete-branch: true
          token: ${{ secrets.BOT_PR_PAT }}


gh-pages

name: gh-pages
on:
  workflow_run:
    workflows: ["ci"]
    branches: [main]
    types:
      - completed
jobs:
  deploy-gh-pages:
    concurrency: ci-${{ github.ref }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r docs/requirements.txt
          pip install ghp-import
      - name: make html
        working-directory: docs
        run: make html
      - name: Deploy Documentation
        run: |
          pip install ghp-import
          ghp-import -n -p -m "Documentation git hash $(git rev-parse --short HEAD)" -f docs/_build/html


ci

name: ci
on:
  push:
    branches:
      - main
      - release/**
    tags:
      - '[0-9]+.[0-9]+.[0-9]+'
      - '[0-9]+.[0-9]+.[0-9]+.dev[0-9]+'
  pull_request: {}

jobs:
  test-demo-app:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version:
          - '3.12'
    steps:
      - uses: actions/checkout@v4
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip
      - name: Install dependencies
        run: |
          pip install --upgrade pip
          pip install -r requirements.txt
      - name: Start Redis
        uses: supercharge/redis-github-action@1.8.0
      - name: Test demo app
        env:
          CELERY_BROKER_URL: redis://0.0.0.0:6379
          DJANGO_SETTINGS_MODULE: config.settings.test_demo_app
        run: pytest --cov=./django_structlog_demo_project --cov-append django_structlog_demo_project
      - uses: codecov/codecov-action@v4
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version:
          - '3.8'
          - '3.9'
          - '3.10'
          - '3.11'
          - '3.12'
    steps:
      - uses: actions/checkout@v4
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install -U setuptools
          python -m pip install tox tox-gh-actions
      - name: Start Redis
        uses: supercharge/redis-github-action@1.8.0
      - name: Test with tox
        run: tox
      - uses: codecov/codecov-action@v4
        with:
          token: ${{ secrets.CODECOV_TOKEN }}

  test-docs:
    needs:
      - test-demo-app
      - test
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version:
          - '3.12'
    steps:
      - uses: actions/checkout@v4
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r docs/requirements.txt
      - name: make html
        working-directory: docs
        run: make html
      - name: make doctest
        working-directory: docs
        run: make doctest

  black:
    needs:
      - test-demo-app
      - test
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version:
          - '3.12'
    steps:
      - uses: actions/checkout@v4
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements/black.txt
      - name: run black
        run: black --check --verbose .

  ruff:
    needs:
      - test-demo-app
      - test
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version:
          - '3.12'
    steps:
      - uses: actions/checkout@v4
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements/ruff.txt
      - name: run ruff
        run: ruff check .

  test-install-base:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version:
          - '3.12'
    steps:
      - uses: actions/checkout@v4
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install -U setuptools
          python -m pip install .
      - name: Import django_structlog modules
        run: |
          python -c "import django_structlog"
          python -c "import django_structlog.apps"
          python -c "import django_structlog.signals"
          python -c "import django_structlog.app_settings"
          python -c "import django_structlog.middlewares.request"

  test-install-celery:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version:
          - '3.12'
    steps:
      - uses: actions/checkout@v4
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install -U setuptools
          python -m pip install .[celery]
      - name: Import django_structlog modules
        run: |
          python -c "import django_structlog"
          python -c "import django_structlog.apps"
          python -c "import django_structlog.signals"
          python -c "import django_structlog.app_settings"
          python -c "import django_structlog.middlewares.request"
      - name: Import django_structlog celery modules
        run: |
          python -c "import django_structlog.celery.receivers"
          python -c "import django_structlog.celery.steps"
          python -c "import django_structlog.celery.signals"

  test-install-commands:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version:
          - '3.12'
    steps:
      - uses: actions/checkout@v4
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install -U setuptools
          python -m pip install .[commands]
      - name: Import django_structlog modules
        run: |
          python -c "import django_structlog"
          python -c "import django_structlog.apps"
          python -c "import django_structlog.signals"
          python -c "import django_structlog.app_settings"
          python -c "import django_structlog.middlewares.request"
      - name: Import django_structlog commands modules
        run: |
          python -c "import django_structlog.commands"

  pypi-deployment:
    needs:
      - test-docs
      - test-install-base
      - test-install-celery
      - test-install-commands
      - black
      - ruff
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install -U -q build
      - name: build sdist
        run: python -m build --sdist
      - name: build wheel
        run: python -m build --wheel
      - name: Publish package
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          user: __token__
          password: ${{ secrets.PYPI_DEPLOYMENT_KEY }}


pre-commit auto-update

name: pre-commit auto-update

on:
  # every monday at 11am utc
  schedule:
    - cron: "0 11 * * 1"
  # on demand
  workflow_dispatch:

jobs:
  auto-update:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: 3.12

      - uses: browniebroke/pre-commit-autoupdate-action@v1.0.0

      - uses: peter-evans/create-pull-request@v6.0.5
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          branch: update/pre-commit-hooks
          title: Update pre-commit hooks
          commit-message: "chore: update pre-commit hooks"
          body: Update versions of pre-commit hooks to latest version.
          #base: ${{ github.head_ref }}


ChangeLog

name: ChangeLog

on:
  workflow_dispatch:
  release:
    types: [published]

jobs:
  build:

    runs-on: ubuntu-latest

    steps:
    - uses: actions/setup-node@v2-beta
      with:
        node-version: '12'
    - uses: actions/checkout@v2
      with:
        fetch-depth: 0

    - name: Checkout Tool
      uses: actions/checkout@v2
      with:
        repository: konakonall/auto-changelog
        path: 'auto-changelog'
    - name: Build Tool
      run: |
        cd auto-changelog
        npm install
        npm link

    - name: Generate ChangeLog
      env: # Or as an environment variable
          TOKEN: ${{ secrets.GITHUB_TOKEN }}
      run: |
        auto-changelog --token $TOKEN
    - name: Cat ChangeLog
      run: cat CHANGELOG.md

    - name: Commit files
      env:
        CI_USER: "gouki0123"
        CI_EMAIL: "gouki0123@gmail.com"
      run: |
        git config --local user.email "$CI_EMAIL"
        git config --local user.name "$CI_USER"
        git add CHANGELOG.md && git commit -m 'Updated CHANGELOG.md' && echo "push=1" >> $GITHUB_ENV || echo "No changes to CHANGELOG.md"

    - name: Push changes
      if: env.push == 1
      env:
        CI_USER: "gouki0123"
        CI_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      run: |
        git push "https://$CI_USER:$CI_TOKEN@github.com/$GITHUB_REPOSITORY.git" HEAD:master


CodeQL

# For most projects, this workflow file will not need changing; you simply need
# to commit it to your repository.
#
# You may wish to alter this file to override the set of languages analyzed,
# or to provide custom queries or build logic.
#
# ******** NOTE ********
# We have attempted to detect the languages in your repository. Please check
# the `language` matrix defined below to confirm you have the correct set of
# supported CodeQL languages.
#
name: "CodeQL"

on:
  push:
    branches: [ master ]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [ master ]
  schedule:
    - cron: '43 2 * * 1'

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        language: [ 'python' ]
        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
        # Learn more about CodeQL language support at https://git.io/codeql-language-support

    steps:
    - name: Checkout repository
      uses: actions/checkout@v2

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v1
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
        # By default, queries listed here will override any specified in a config file.
        # Prefix the list here with "+" to use these queries and those in the config file.
        # queries: ./path/to/local/query, your-org/your-repo/queries@main

    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
    # If this step fails, then you should remove it and run the build manually (see below)
    - name: Autobuild
      uses: github/codeql-action/autobuild@v1

    # ℹ Command-line programs to run using the OS shell.
    # 📚 https://git.io/JvXDl

    # ✏ If the Autobuild fails above, remove it and uncomment the following three lines
    #    and modify them (or add more) to build your code if your project
    #    uses a compiled language

    #- run: |
    #   make bootstrap
    #   make release

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v1


Django CI

name: Django CI

on:
  push:
    branches: [ master ]
  pull_request:
    branches: [ master ]

jobs:
  build:

    runs-on: ubuntu-20.04
    strategy:
      max-parallel: 4
      matrix:
        python-version: [3.8.10]
        node-version: [12.22.9]

    steps:
    - uses: actions/checkout@v2
    - name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@v2
      with:
        python-version: ${{ matrix.python-version }}
    - name: Use Node.js ${{ matrix.node-version }}
      uses: actions/setup-node@v2
      with:
        node-version: ${{ matrix.node-version }}
    - name: Install Dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r requirements.txt
        npm install
    - name : Apply Migrations
      run: |
        python manage.py migrate
    - name: Run Tests
      run: |
        python manage.py test
        npm run flow


PR welcome message

# IMPORTANT NOTE
# In this workflow there should NOT be checkout action - because of security reasons.
# More info:
# https://docs.github.com/en/actions/reference/events-that-trigger-workflows#pull_request_target
# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

name: PR welcome message
on:
  pull_request_target:
    types: opened

jobs:
  pr_comment:
    runs-on: ubuntu-latest
    steps:
      - name: Create comment
        uses: peter-evans/create-or-update-comment@v4
        with:
          issue-number: ${{ github.event.pull_request.number }}
          body: |
            ## **Thank you for contributing to the Leapp project!**
            Please note that every PR needs to comply with the [Leapp Guidelines](https://leapp.readthedocs.io/en/latest/contributing.html#) and must pass all tests in order to be mergeable.
            If you want to request a review or rebuild a package in copr, you can use following commands as a comment:
            - **review please @oamg/developers** to notify leapp developers of the review request
            - **/packit copr-build** to submit a public copr build using packit

            To launch regression testing public members of oamg organization can leave the following comment:
            - **/rerun** to schedule basic regression tests using this pr build and leapp-repository\*master\* as artifacts
            - **/rerun 42** to schedule basic regression tests using this pr build and leapp-repository\*PR42\* as artifacts
            - **/rerun-sst** to schedule sst tests using this pr build and leapp-repository\*master\* as artifacts
            - **/rerun-sst 42** to schedule sst tests using this pr build and leapp-repository\*PR42\* as artifacts

            Please [open ticket](https://url.corp.redhat.com/oamg-ci-issue) in case you experience technical problem with the CI. (RH internal only)

            **Note:** In case there are problems with tests not being triggered automatically on new PR/commit or pending for a long time, please consider rerunning the CI by commenting **leapp-ci build** (might require several comments). If the problem persists, contact leapp-infra.


reuse-copr-build@TF

name: reuse-copr-build@TF

on:
  workflow_call:
    secrets:
      FEDORA_COPR_LOGIN:
        required: true
      FEDORA_COPR_TOKEN:
        required: true
    outputs:
      artifacts:
        description: "A string with test artifacts to install in tft test env"
        value: ${{ jobs.reusable_workflow_copr_build_job.outputs.artifacts }}

jobs:
  reusable_workflow_copr_build_job:
    # This job only runs for '/rerun' pull request comments by owner, member, or collaborator of the repo/organization.
    name: Build copr builds for tft tests
    runs-on: ubuntu-22.04
    outputs:
      artifacts: ${{ steps.gen_artifacts.outputs.artifacts }}
    if: |
      github.event.issue.pull_request
      && startsWith(github.event.comment.body, '/rerun')
      && contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association)
    steps:
      - name: Update repository
        id: repo_update
        run: sudo apt-get update

      - name: Install necessary deps
        id: deps_install
        run: sudo apt-get install -y libkrb5-dev

      - name: Get dependent leapp-repository pr number from rerun comment
        uses: actions-ecosystem/action-regex-match@v2
        id: leapp_repository_pr_regex_match
        with:
          text: ${{ github.event.comment.body }}
          regex: '^/(rerun|rerun-sst)\s+([0-9]+)\s*$'

      - name: Get pull request number
        id: pr_nr
        run: |
          PR_URL="${{ github.event.comment.issue_url }}"
          echo "::set-output name=pr_nr::${PR_URL##*/}"

      - name: Checkout
        # TODO: The correct way to checkout would be to use simmilar approach as in get_commit_by_timestamp function of
        #       the github gluetool module (i.e. do not use HEAD but the last commit before comment).
        id: checkout
        uses: actions/checkout@v4
        with:
          ref: "refs/pull/${{ steps.pr_nr.outputs.pr_nr }}/head"

      - name: Get ref and sha
        id: ref_sha
        run: |
          echo "::set-output name=sha::$(git rev-parse --short HEAD)"
          echo "::set-output name=ref::refs/pull/${{ steps.pr_nr.outputs.pr_nr }}/head"

      - name: Get latest leapp-repository master copr build id
        id: get_latest_lpr_copr_build_id
        if: ${{ steps.leapp_repository_pr_regex_match.outputs.match == '' }}
        run: |
          cat << EOF > copr_fedora.conf
          [copr-cli]
          login = ${{ secrets.FEDORA_COPR_LOGIN }}
          username = oamgbot
          token = ${{ secrets.FEDORA_COPR_TOKEN }}
          copr_url = https://copr.fedorainfracloud.org
          # expiration date: 2030-07-04
          EOF

          pip install copr-cli
          REGEX='leapp-repository.*master.*' COPR_REPO='@oamg/leapp' _COPR_CONFIG=copr_fedora.conf python ${{ github.workspace }}/utils/get_latest_copr_build > latest_lpr
          COPR_ID=$(cat latest_lpr)
          echo "::set-output name=copr_id::${COPR_ID##*/}"

      - name: Trigger copr build
        id: copr_build
        env:
          COPR_CONFIG: "copr_fedora.conf"
          COPR_REPO: "@oamg/leapp"
        run: |
          cat << EOF > copr_fedora.conf
          [copr-cli]
          login = ${{ secrets.FEDORA_COPR_LOGIN }}
          username = oamgbot
          token = ${{ secrets.FEDORA_COPR_TOKEN }}
          copr_url = https://copr.fedorainfracloud.org
          # expiration date: 2030-07-04
          EOF

          pip install copr-cli
          PR=${{ steps.pr_nr.outputs.pr_nr }} COPR_REPO="$COPR_REPO" COPR_CONFIG=$COPR_CONFIG make copr_build | tee copr.log

          COPR_URL=$(grep -Po 'https://copr.fedorainfracloud.org/coprs/build/\d+' copr.log)
          echo "::set-output name=copr_url::${COPR_URL}"
          echo "::set-output name=copr_id::${COPR_URL##*/}"

      - name: Add comment with copr build url
        # TODO: Create comment when copr build fails.
        id: link_copr
        uses: actions/github-script@v7
        with:
          script: |
            github.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: 'Copr build succeeded: ${{ steps.copr_build.outputs.copr_url }}'
            })

      - name: If leapp_repository_pr was specified in the comment - trigger copr build
        id: leapp_repository_pr
        if: ${{ steps.leapp_repository_pr_regex_match.outputs.match != '' }}
        run: |
          echo "::set-output name=leapp_repository_pr::${{ steps.leapp_repository_pr_regex_match.outputs.group2 }}"

      - name: Checkout leapp-repository
        id: checkout_leapp_repository
        if: ${{ steps.leapp_repository_pr_regex_match.outputs.match != '' }}
        uses: actions/checkout@v4
        with:
          repository: "oamg/leapp-repository"
          ref: "refs/pull/${{ steps.leapp_repository_pr.outputs.leapp_repository_pr }}/head"

      - name: Get ref and sha for leapp-repository
        id: ref_sha_leapp_repository
        if: ${{ steps.leapp_repository_pr_regex_match.outputs.match != '' }}
        run: |
          echo "::set-output name=sha::$(git rev-parse --short HEAD)"
          echo "::set-output name=ref::refs/pull/${{ steps.leapp_repository_pr.outputs.leapp_repository_pr }}/head"

      - name: Trigger copr build for leapp-repository
        id: copr_build_leapp_repository
        if: ${{ steps.leapp_repository_pr_regex_match.outputs.match != '' }}
        env:
          COPR_CONFIG: "copr_fedora.conf"
          COPR_REPO: "@oamg/leapp"
        run: |
          cat << EOF > copr_fedora.conf
          [copr-cli]
          login = ${{ secrets.FEDORA_COPR_LOGIN }}
          username = oamgbot
          token = ${{ secrets.FEDORA_COPR_TOKEN }}
          copr_url = https://copr.fedorainfracloud.org
          # expiration date: 2030-07-04
          EOF

          pip install copr-cli
          PR=${{ steps.leapp_repository_pr.outputs.leapp_repository_pr }} COPR_REPO="$COPR_REPO" COPR_CONFIG=$COPR_CONFIG make copr_build | tee copr.log

          COPR_URL=$(grep -Po 'https://copr.fedorainfracloud.org/coprs/build/\d+' copr.log)
          echo "::set-output name=copr_url::${COPR_URL}"
          echo "::set-output name=copr_id::${COPR_URL##*/}"

      - name: Add comment with copr build url for leapp-repository
        # TODO: Create comment when copr build fails.
        id: link_copr_leapp_repository
        if: ${{ steps.leapp_repository_pr_regex_match.outputs.match != '' }}
        uses: actions/github-script@v7
        with:
          script: |
            github.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: 'Copr build succeeded: ${{ steps.copr_build_leapp_repository.outputs.copr_url }}'
            })

      - name: Generate artifacts output
        id: gen_artifacts
        env:
          ARTIFACTS: ${{ format('{0};{1}', steps.leapp_repository_pr_regex_match.outputs.match != '' && steps.copr_build_leapp_repository.outputs.copr_id || steps.get_latest_lpr_copr_build_id.outputs.copr_id, steps.copr_build.outputs.copr_id) }}
        run: |
          echo "::set-output name=artifacts::${{ env.ARTIFACTS }}"


name: reuse-tests-7to8@TF

on:
  workflow_call:
    secrets:
      TF_ENDPOINT:
        required: True
      TF_API_KEY:
        required: True
    inputs:
      copr_artifacts:
        required: True
        type: string
      tmt_plan_regex:
        type: string
        default: "^(?!.*upgrade_plugin)(?!.*tier[2-3].*)(?!.*rhsm)(?!.*c2r)(?!.*sap)(?!.*8to9)"
      environment_settings:
        type: string
        default: '{"provisioning": {"post_install_script": "#!/bin/sh\nsudo sed -i s/.*ssh-rsa/ssh-rsa/ /root/.ssh/authorized_keys"}}'
      arch:
        type: string
        default: 'x86_64'
      pull_request_status_name:
        type: string
        default: '7to8'
      copr:
        type: string
        default: 'epel-7-x86_64'
      tmt_context:
        type: string
        default: 'distro=rhel-7.9'
      compose:
        type: string
        default: 'RHEL-7.9-ZStream'
      variables:
        type: string
        default: ''
      update_pull_request_status:
        type: string
        default: 'true'

jobs:
  reusable_workflow_job:
    name: Schedule regression tests on Testing Farm
    runs-on: ubuntu-22.04
    steps:
      - name: Schedule regression testing for 7to8
        id: run_test_7to8
        uses: sclorg/testing-farm-as-github-action@v1.2.10
        with:
          # required
          api_url: ${{ secrets.TF_ENDPOINT }}
          api_key: ${{ secrets.TF_API_KEY }}
          git_url: 'https://gitlab.cee.redhat.com/oamg/tmt-plans'
          github_token: ${{ secrets.GITHUB_TOKEN }}
          # optional
          tf_scope: 'private'
          create_issue_comment: 'true'
          update_pull_request_status: ${{ inputs.update_pull_request_status }}
          tmt_plan_regex: ${{ inputs.tmt_plan_regex }}
          compose: ${{ inputs.compose }}
          arch: ${{ inputs.arch }}
          copr: ${{ inputs.copr }}
          copr_artifacts: ${{ inputs.copr_artifacts }}
          debug: ${{ secrets.ACTIONS_STEP_DEBUG }}
          tmt_context: ${{ inputs.tmt_context }}
          pull_request_status_name: ${{ inputs.pull_request_status_name }}
          environment_settings: ${{ inputs.environment_settings }}
          variables: ${{ inputs.variables }}


name: reuse-tests-8to9@TF

on:
  workflow_call:
    secrets:
      TF_ENDPOINT:
        required: True
      TF_API_KEY:
        required: True
    inputs:
      copr_artifacts:
        required: True
        type: string
      tmt_plan_regex:
        type: string
        default: "^(?!.*upgrade_plugin)(?!.*tier[2-3].*)(?!.*rhsm)(?!.*c2r)(?!.*sap)(?!.*7to8)"
      environment_settings:
        type: string
        default: '{"provisioning": {"post_install_script": "#!/bin/sh\nsudo sed -i s/.*ssh-rsa/ssh-rsa/ /root/.ssh/authorized_keys"}}'
      arch:
        type: string
        default: 'x86_64'
      pull_request_status_name:
        type: string
        default: '8to9'
      copr:
        type: string
        default: 'epel-8-x86_64'
      tmt_context:
        type: string
        default: 'distro=rhel-8.6'
      compose:
        type: string
        default: 'RHEL-8.6.0-Nightly'
      variables:
        type: string
        default: 'TARGET_RELEASE=9.0;TARGET_KERNEL=el9;RHSM_REPOS=rhel-8-for-x86_64-appstream-rpms,rhel-8-for-x86_64-baseos-rpms'
      update_pull_request_status:
        type: string
        default: 'true'

jobs:
  reusable_workflow_job:
    # This job only runs for '/rerun' pull request comments by owner, member, or collaborator of the repo/organization.
    name: Schedule regression tests on Testing Farm
    runs-on: ubuntu-22.04
    steps:
      - name: Schedule regression testing for 8to9
        id: run_test_8to9
        uses: sclorg/testing-farm-as-github-action@v1.2.10
        with:
          # required
          api_url: ${{ secrets.TF_ENDPOINT }}
          api_key: ${{ secrets.TF_API_KEY }}
          git_url: 'https://gitlab.cee.redhat.com/oamg/tmt-plans'
          github_token: ${{ secrets.GITHUB_TOKEN }}
          # optional
          tf_scope: 'private'
          create_issue_comment: 'true'
          update_pull_request_status: ${{ inputs.update_pull_request_status }}
          tmt_plan_regex: ${{ inputs.tmt_plan_regex }}
          compose: ${{ inputs.compose }}
          arch: ${{ inputs.arch }}
          copr: ${{ inputs.copr }}
          copr_artifacts: ${{ inputs.copr_artifacts }}
          debug: ${{ secrets.ACTIONS_STEP_DEBUG }}
          tmt_context: ${{ inputs.tmt_context }}
          pull_request_status_name: ${{ inputs.pull_request_status_name }}
          environment_settings: ${{ inputs.environment_settings }}
          variables: ${{ inputs.variables }}


tmt@TF

name: tmt@TF

on:
  issue_comment:
    types:
      - created

jobs:
  call_workflow_copr_build:
    uses: ./.github/workflows/reuse-copr-build.yml
    secrets: inherit

  call_workflow_tests_79to88_integration:
    needs: call_workflow_copr_build
    uses: ./.github/workflows/reuse-tests-7to8.yml
    secrets: inherit
    with:
      copr_artifacts: ${{ needs.call_workflow_copr_build.outputs.artifacts }}
      tmt_plan_regex: "^(?!.*upgrade_plugin)(?!.*tier[2-3].*)(?!.*rhsm)(?!.*c2r)(?!.*sap)(?!.*8to9)(?!.*max_sst)"
      pull_request_status_name: "7.9to8.8"
      variables: 'SOURCE_RELEASE=7.9;TARGET_RELEASE=8.8;LEAPPDATA_BRANCH=upstream'
    if: |
      github.event.issue.pull_request
      && ! startsWith(github.event.comment.body, '/rerun-sst')
      && contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association)

  call_workflow_tests_79to86_integration:
    needs: call_workflow_copr_build
    uses: ./.github/workflows/reuse-tests-7to8.yml
    secrets: inherit
    with:
      copr_artifacts: ${{ needs.call_workflow_copr_build.outputs.artifacts }}
      tmt_plan_regex: "^(?!.*upgrade_plugin)(?!.*tier[2-3].*)(?!.*rhsm)(?!.*c2r)(?!.*sap)(?!.*8to9)(?!.*max_sst)"
      variables: 'SOURCE_RELEASE=7.9;TARGET_RELEASE=8.6;LEAPPDATA_BRANCH=upstream'
      pull_request_status_name: "7.9to8.6"
    if: |
      github.event.issue.pull_request
      && ! startsWith(github.event.comment.body, '/rerun-sst')
      && contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association)

  call_workflow_tests_79to88_sst:
    needs: call_workflow_copr_build
    uses: ./.github/workflows/reuse-tests-7to8.yml
    secrets: inherit
    with:
      copr_artifacts: ${{ needs.call_workflow_copr_build.outputs.artifacts }}
      tmt_plan_regex: "^(?!.*tier[2-3].*)(.*max_sst.*)"
      pull_request_status_name: "7.9to8.8-sst"
      update_pull_request_status: 'false'
      variables: 'SOURCE_RELEASE=7.9;TARGET_RELEASE=8.8;LEAPPDATA_BRANCH=upstream'
    if: |
      github.event.issue.pull_request
      && startsWith(github.event.comment.body, '/rerun-sst')
      && contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association)

  call_workflow_tests_7to8_aws:
    needs: call_workflow_copr_build
    uses: ./.github/workflows/reuse-tests-7to8.yml
    secrets: inherit
    with:
      copr_artifacts: ${{ needs.call_workflow_copr_build.outputs.artifacts }}
      tmt_plan_regex: "^(?!.*upgrade_plugin)(?!.*tier[2-3].*)(?!.*rhsm)(?!.*c2r)(?!.*sap)(?!.*8to9)(.*e2e)"
      compose: "RHEL-7.9-rhui"
      environment_settings: '{"provisioning": {"post_install_script": "#!/bin/sh\nsudo sed -i s/.*ssh-rsa/ssh-rsa/ /root/.ssh/authorized_keys; echo 42; yum-config-manager --enable rhel-7-server-rhui-optional-rpms"}}'
      pull_request_status_name: "7to8-aws-e2e"
      variables: 'SOURCE_RELEASE=7.9;TARGET_RELEASE=8.6;RHUI=aws;LEAPPDATA_BRANCH=upstream'
    if: |
      github.event.issue.pull_request
      && ! startsWith(github.event.comment.body, '/rerun-sst')
      && contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association)

  call_workflow_tests_86to90_integration:
    needs: call_workflow_copr_build
    uses: ./.github/workflows/reuse-tests-8to9.yml
    secrets: inherit
    with:
      copr_artifacts: ${{ needs.call_workflow_copr_build.outputs.artifacts }}
      tmt_plan_regex: "^(?!.*upgrade_plugin)(?!.*tier[2-3].*)(?!.*rhsm)(?!.*c2r)(?!.*sap)(?!.*7to8)(?!.*max_sst)"
      variables: 'SOURCE_RELEASE=8.6;TARGET_RELEASE=9.0;RHSM_REPOS=rhel-8-for-x86_64-appstream-eus-rpms,rhel-8-for-x86_64-baseos-eus-rpms;LEAPPDATA_BRANCH=upstream'
      pull_request_status_name: "8.6to9.0"
    if: |
      github.event.issue.pull_request
      && ! startsWith(github.event.comment.body, '/rerun-sst')
      && contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association)

  call_workflow_tests_88to92_integration:
    needs: call_workflow_copr_build
    uses: ./.github/workflows/reuse-tests-8to9.yml
    secrets: inherit
    with:
      copr_artifacts: ${{ needs.call_workflow_copr_build.outputs.artifacts }}
      tmt_plan_regex: "^(?!.*upgrade_plugin)(?!.*tier[2-3].*)(?!.*rhsm)(?!.*c2r)(?!.*sap)(?!.*7to8)(?!.*max_sst)"
      variables: 'SOURCE_RELEASE=8.8;TARGET_RELEASE=9.2;LEAPP_DEVEL_TARGET_RELEASE=9.2;RHSM_REPOS=rhel-8-for-x86_64-appstream-beta-rpms,rhel-8-for-x86_64-baseos-beta-rpms;LEAPPDATA_BRANCH=upstream'
      compose: "RHEL-8.8.0-Nightly"
      pull_request_status_name: "8.8to9.2"
      tmt_context: "distro=rhel-8.8"
    if: |
      github.event.issue.pull_request
      && ! startsWith(github.event.comment.body, '/rerun-sst')
      && contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association)

  call_workflow_tests_86to90_sst:
    needs: call_workflow_copr_build
    uses: ./.github/workflows/reuse-tests-8to9.yml
    secrets: inherit
    with:
      copr_artifacts: ${{ needs.call_workflow_copr_build.outputs.artifacts }}
      tmt_plan_regex: "^(?!.*tier[2-3].*)(.*max_sst.*)"
      variables: 'SOURCE_RELEASE=8.6;TARGET_RELEASE=9.0;RHSM_REPOS=rhel-8-for-x86_64-appstream-eus-rpms,rhel-8-for-x86_64-baseos-eus-rpms;LEAPPDATA_BRANCH=upstream'
      pull_request_status_name: "8.6to9.0-sst"
      update_pull_request_status: 'false'
    if: |
      github.event.issue.pull_request
      && startsWith(github.event.comment.body, '/rerun-sst')
      && contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association)

  call_workflow_tests_86to90_aws:
    needs: call_workflow_copr_build
    uses: ./.github/workflows/reuse-tests-8to9.yml
    secrets: inherit
    with:
      copr_artifacts: ${{ needs.call_workflow_copr_build.outputs.artifacts }}
      tmt_plan_regex: "^(?!.*upgrade_plugin)(?!.*tier[2-3].*)(?!.*rhsm)(?!.*c2r)(?!.*sap)(?!.*7to8)(.*e2e)"
      compose: "RHEL-8.6-rhui"
      environment_settings: '{"provisioning": {"post_install_script": "#!/bin/sh\nsudo sed -i s/.*ssh-rsa/ssh-rsa/ /root/.ssh/authorized_keys"}}'
      pull_request_status_name: "8to9-aws-e2e"
      variables: 'SOURCE_RELEASE=8.6;TARGET_RELEASE=9.0;RHSM_REPOS=rhel-8-for-x86_64-appstream-eus-rpms,rhel-8-for-x86_64-baseos-eus-rpms;RHUI=aws;LEAPPDATA_BRANCH=upstream'
    if: |
      github.event.issue.pull_request
      && ! startsWith(github.event.comment.body, '/rerun-sst')
      && contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association)


Unit Tests

name: Unit Tests
on:
  push:
    branches:
      - master
  pull_request:
    branches:
      - master

jobs:
  test:
    name: Run unit tests in containers
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        scenarios:
          - name: Run unit tests with python3.9 on el8
            python: python3.9
            container: ubi8
          - name: Run unit tests with python 3.6 on el8
            python: python3.6
            container: ubi8
          - name: Run unit tests with python2.7 on el7
            python: python2.7
            container: ubi7

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: '0'
      - name: Set master to origin/master
        if: github.ref != 'refs/heads/master'
        run: |
          git branch -f master origin/master
      - name: ${{matrix.scenarios.name}}
        run: script -e -c /bin/bash -c 'TERM=xterm podman build --security-opt=seccomp=unconfined -t leapp-tests -f res/container-tests/Containerfile.${{matrix.scenarios.container}} res/container-tests && PYTHON_VENV=${{matrix.scenarios.python}} REPOSITORIES=${{matrix.scenarios.repos}} podman run --security-opt=seccomp=unconfined --rm -ti -v ${PWD}:/payload --env=PYTHON_VENV --env=REPOSITORIES leapp-tests'


Release build

name: Release build

on:
  push:
    tags:
      - v**
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest
    environment: release
    permissions:
      contents: read
      packages: write
    steps:
    - name: Docker metadata
      id: metadata
      uses: docker/metadata-action@v5
      with:
        images: |
          registry.cn-hongkong.aliyuncs.com/oj-image/backend
        tags: |
          type=semver,pattern={{version}}
          type=semver,pattern={{major}}.{{minor}}
          type=semver,pattern={{major}},enable=${{ !startsWith(github.ref, 'refs/tags/v0.') }}

    - name: Set up QEMU
      uses: docker/setup-qemu-action@v3

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Login to GitHub Container Registry
      uses: docker/login-action@v3
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Login to Aliyun Container Registry
      uses: docker/login-action@v3
      with:
        registry: registry.cn-hongkong.aliyuncs.com
        username: ${{ secrets.ALIYUN_ACR_USERNAME }}
        password: ${{ secrets.ALIYUN_ACR_PASSWORD }}

    - name: Build and push
      uses: docker/build-push-action@v5
      with:
        push: true
        platforms: linux/amd64,linux/arm64
        tags: ${{ steps.metadata.outputs.tags }}
        annotations: ${{ steps.metadata.outputs.annotations }}


doc

name: doc

on:
  push:
    branches: [master]
  workflow_dispatch:

permissions:
  contents: read
  pages: write
  id-token: write

concurrency:
  group: "pages"
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set up Python 3.11
      uses: actions/setup-python@v5
      with:
        python-version: '3.11'

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install ".[doc]"

    - name: Build sphinx documentation
      run: |
        make html
        # notify github this isn't a jekyll site
        touch build/sphinx/html/.nojekyll

    - name: Upload artifact
      uses: actions/upload-pages-artifact@v3
      with:
        path: build/sphinx/html

  deploy:
    if: github.repository == 'pkgcore/pkgcheck'
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    runs-on: ubuntu-latest
    needs: build

    steps:
      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@v4


release

name: release

on:
  push:
    branches: [deploy]
    tags: [v*]
  workflow_dispatch:

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    environment: release

    permissions:
      id-token: write # Used to authenticate to PyPI via OIDC

      contents: write # Used to authenticate github release publish

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set up Python 3.11
      uses: actions/setup-python@v5
      with:
        python-version: "3.11"

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install build ".[test,doc]"

    - name: Test with pytest
      env:
        PY_COLORS: 1 # forcibly enable pytest colors
      run: pytest

    - name: Build sdist
      run: |
        git clean -fxd
        make man
        make sdist

    - name: Build wheel
      run: make wheel

    - name: Output dist file info
      run: |
        sha512sum dist/*
        tar -ztf dist/*.tar.gz | sort

    - uses: actions/upload-artifact@v4
      with:
        name: results
        path: dist/*

    - name: publish
      uses: pypa/gh-action-pypi-publish@release/v1
      if: startsWith(github.ref, 'refs/tags/')

    - name: Create GitHub release
      uses: softprops/action-gh-release@v1
      if: startsWith(github.ref, 'refs/tags/')
      with:
        files: dist/*.tar.gz
        fail_on_unmatched_files: true
        draft: true

  build-and-push-docker-image:
    if: startsWith(github.ref, 'refs/tags/')
    needs: ["build-and-deploy"]
    runs-on: ubuntu-latest
    environment: release

    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Scrape build info
        run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/v}" >> $GITHUB_ENV

      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/pkgcore/pkgcheck
          tags: |
            type=semver,pattern={{version}}
            type=sha

      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            PKGCHECK_VERSION=${{ env.RELEASE_VERSION }}


test

name: test

on:
  push:
    branches-ignore: [deploy]
  pull_request:
    branches: [master]

jobs:
  test:
    runs-on: ${{ matrix.os }}
    continue-on-error: ${{ matrix.experimental }}
    strategy:
      matrix:
        os: [ubuntu-latest]
        python-version: ['3.10', '3.11', '3.12']
        deps: [newest-deps]
        experimental: [false]
        include:
          - os: ubuntu-latest
            python-version: '3.11'
            deps: minimal-deps
            experimental: false
          - os: macos-latest
            python-version: '3.11'
            deps: newest-deps
            experimental: true
      fail-fast: false

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    # experimental targets generally lack lxml wheels
    - name: Install libxml2 and libxslt development packages
      if: ${{ matrix.experimental }}
      run: sudo apt install libxml2-dev libxslt-dev python3-dev

    # macos needs newer bash
    - name: Install macos deps
      if: ${{ matrix.os == 'macos-latest' }}
      run: |
        brew install bash gnu-sed
        # enable gnu-sed usage as "sed"
        echo "/usr/local/opt/gnu-sed/libexec/gnubin" >> $GITHUB_PATH

    - name: Install non-python deps
      if: ${{ matrix.os == 'ubuntu-latest' }}
      run: |
        sudo apt install cpanminus
        # dep for perl checks
        sudo cpanm --quiet --notest Gentoo::PerlMod::Version

    - name: Pin dependencies to minimal versions
      if: ${{ matrix.deps == 'minimal-deps' }}
      run: sed -e '/^requires-python/!s/~=/==/' -i pyproject.toml

    - name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@v5
      with:
        python-version: ${{ matrix.python-version }}
        cache: 'pip'
        cache-dependency-path: pyproject.toml

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install ".[test]" pytest-github-actions-annotate-failures

    - name: Test with pytest
      env:
        PY_COLORS: 1 # forcibly enable pytest colors
      run: pytest --cov --cov-report=term --cov-report=xml -v

    - name: Submit code coverage to codecov
      if: ${{ matrix.os == 'ubuntu-latest' }}
      uses: codecov/codecov-action@v3
      with:
        files: ./coverage.xml

  lint:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set up Python 3
      uses: actions/setup-python@v5
      with:
        python-version: '3.x'

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install . pylint

    - name: Run linting tools
      run: pylint --exit-zero src/pkgcheck

  format:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
    - uses: psf/black@stable


Checking CITATION.cff

name: Checking CITATION.cff

on:
  push:
    paths:
      - "CITATION.cff"
  pull_request:
    paths:
      - "CITATION.cff"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  cffconvert:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: citation-file-format/cffconvert-github-action@2.0.0
        with:
          args: --validate


Check PR change log

name: Check PR change log

on:
  # So it cannot be skipped.
  pull_request_target:
    types: [opened, synchronize, labeled, unlabeled]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  changelog_checker:
    name: Check if towncrier change log entry is correct
    runs-on: ubuntu-latest
    steps:
    - uses: scientific-python/action-towncrier-changelog@1d7332022f76e36fe8ce2d716b851f3f98063c62  # v1.0.0
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        BOT_USERNAME: gilesbot


Check PR milestone

name: Check PR milestone

on:
  # So it cannot be skipped.
  pull_request_target:
    types: [opened, synchronize, milestoned, demilestoned]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  # https://stackoverflow.com/questions/69434370/how-can-i-get-the-latest-pr-data-specifically-milestones-when-running-yaml-jobs
  milestone_checker:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/github-script@v7
      if: github.repository == 'astropy/astropy'
      with:
        github-token: ${{ secrets.GITHUB_TOKEN }}
        script: |
          const { data } = await github.request("GET /repos/{owner}/{repo}/pulls/{pr}", {
              owner: context.repo.owner,
              repo: context.repo.repo,
              pr: context.payload.pull_request.number
            });
            if (data.milestone) {
              core.info(`This pull request has a milestone set: ${data.milestone.title}`);
            } else {
              core.setFailed(`A maintainer needs to set the milestone for this pull request.`);
            }


Benchmark

### Inspired from https://github.com/scikit-image/scikit-image/blob/main/.github/workflows/benchmarks.yml

name: Benchmark

on:
  pull_request:
    types: [labeled, synchronize]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  benchmark:
    if: github.repository == 'astropy/astropy' && contains(github.event.pull_request.labels.*.name, 'benchmark')
    name: "Compare asv with astropy main"
    runs-on: ubuntu-latest
    env:
      CCACHE_BASEDIR: "${{ github.workspace }}"
      CCACHE_DIR: "${{ github.workspace }}/.ccache"
      CCACHE_COMPRESS: true
      CCACHE_COMPRESSLEVEL: 6
      CCACHE_MAXSIZE: 400M

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/setup-python@v5
        name: Install Python
        with:
          python-version: "3.11"

      - name: Setup some dependencies
        shell: bash -l {0}
        run: |
          sudo apt-get update -y && sudo apt-get install -y ccache
          # Make gcc/gxx symlinks first in path
          sudo /usr/sbin/update-ccache-symlinks
          echo "/usr/lib/ccache" >> $GITHUB_PATH

      - name: "Prepare ccache"
        id: prepare-ccache
        shell: bash -l {0}
        run: |
          echo "key=benchmark-$RUNNER_OS" >> $GITHUB_OUTPUT
          echo "timestamp=$(date +%Y%m%d-%H%M%S)" >> $GITHUB_OUTPUT
          ccache -p
          ccache -z

      - name: "Restore ccache"
        uses: actions/cache@v4
        with:
          path: .ccache
          key: ccache-${{ secrets.CACHE_VERSION }}-${{ steps.prepare-ccache.outputs.key }}-${{ steps.prepare-ccache.outputs.timestamp }}
          restore-keys: |
            ccache-${{ secrets.CACHE_VERSION }}-${{ steps.prepare-ccache.outputs.key }}-

      - name: Run benchmarks
        shell: bash -l {0}
        id: benchmark
        env:
          OPENBLAS_NUM_THREADS: 1
          MKL_NUM_THREADS: 1
          OMP_NUM_THREADS: 1
          ASV_FACTOR: 1.3
          ASV_SKIP_SLOW: 1
        run: |
          set -x
          python -m pip install asv virtualenv packaging

          git clone -b main https://github.com/astropy/astropy-benchmarks.git --single-branch

          # ID this runner
          python -m asv machine --yes --conf asv.ci.conf.json

          echo "Baseline:  ${{ github.event.pull_request.base.sha }} (${{ github.event.pull_request.base.label }})"
          echo "Contender: ${GITHUB_SHA} (${{ github.event.pull_request.head.label }})"

          # Run benchmarks for current commit against base
          ASV_OPTIONS="--split --show-stderr --factor $ASV_FACTOR --conf asv.ci.conf.json"
          python -m asv continuous $ASV_OPTIONS ${{ github.event.pull_request.base.sha }} ${GITHUB_SHA} \
              | sed "/Traceback \|failed$\|PERFORMANCE DECREASED/ s/^/::error::/" \
              | tee benchmarks.log

          # Error out the action
          if grep -q "Traceback \|failed\|PERFORMANCE DECREASED" benchmarks.log ; then
              exit 1
          fi

      - name: "Check ccache performance"
        shell: bash -l {0}
        run: ccache -s
        if: always()

      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: asv-benchmark-results
          path: |
            results/
            benchmarks.log


Daily cron

name: Daily cron

on:
  workflow_dispatch:
  schedule:
    # run every day at 3am UTC
    - cron: '0 3 * * *'
  pull_request:
    # We also want this workflow triggered if the 'Extra CI' label is added
    # or present when PR is updated
    types:
      - synchronize
      - labeled
  push:
    # We want this workflow to always run on release branches as well as
    # all tags since we want to be really sure we don't introduce
    # regressions on the release branches, and it's also important to run
    # this on pre-release and release tags.
    branches:
    - 'v*'
    tags:
    - '*'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  ARCH_ON_CI: "normal"
  IS_CRON: "true"

permissions:
  contents: read

jobs:
  tests:
    runs-on: ${{ matrix.os }}
    if: (github.repository == 'astropy/astropy' && (github.event_name == 'schedule' || github.event_name == 'push' || github.event_name == 'workflow_dispatch' || contains(github.event.pull_request.labels.*.name, 'Extra CI')))
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: Bundling with pyinstaller
            os: ubuntu-latest
            python: '3.10'
            toxenv: pyinstaller

          - name: Python 3.12 with all optional dependencies and pre-releases
            os: ubuntu-latest
            python: '3.12'
            toxenv: py312-test-alldeps-predeps
            toxargs: -v
            toxposargs: --remote-data=any

    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      with:
        fetch-depth: 0

    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: ${{ matrix.python }}

    - name: Install language-pack-de and tzdata
      if: ${{ matrix.os == 'ubuntu-latest' }}
      run: |
        sudo apt-get update
        sudo apt-get install language-pack-de tzdata

    - name: Install Python dependencies
      run: python -m pip install --upgrade tox

    - name: Run tests
      run: tox ${{ matrix.toxargs}} -e ${{ matrix.toxenv}} -- ${{ matrix.toxposargs}}


Weekly cron

name: Weekly cron

on:
  workflow_dispatch:
  schedule:
    # run every Monday at 6am UTC
    - cron: '0 6 * * 1'
  pull_request:
    # We also want this workflow triggered if the 'Extra CI' label is added
    # or present when PR is updated
    types:
      - synchronize
      - labeled
  push:
    # We want this workflow to always run on release branches as well as
    # all tags since we want to be really sure we don't introduce
    # regressions on the release branches, and it's also important to run
    # this on pre-release and release tags.
    branches:
    - 'v*'
    tags:
    - '*'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  IS_CRON: 'true'

jobs:
  tests:
    runs-on: ${{ matrix.os }}
    if: (github.repository == 'astropy/astropy' && (github.event_name == 'schedule' || github.event_name == 'push' || github.event_name == 'workflow_dispatch' || contains(github.event.pull_request.labels.*.name, 'Extra CI')))
    env:
      ARCH_ON_CI: "normal"
    strategy:
      fail-fast: false
      matrix:
        include:

          # We check numpy-dev also in a job that only runs from cron, so that
          # we can spot issues sooner. We do not use remote data here, since
          # that gives too many false positives due to URL timeouts. We also
          # install all dependencies via pip here so we pick up the latest
          # releases.
          - name: Python 3.10 with dev version of key dependencies
            os: ubuntu-latest
            python: '3.10'
            toxenv: py310-test-devdeps

          # https://github.com/astropy/astropy/issues/15701
          - name: Python 3.11 with dev version of key dependencies without scipy
            os: ubuntu-latest
            python: '3.11'
            toxenv: py311-test-devdeps-noscipy

          - name: Python 3.12 with dev version of infrastructure dependencies
            os: ubuntu-latest
            python: '3.12'
            toxenv: py312-test-devinfra

          - name: Python 3.12 on macOS (x86_64) with all optional dependencies
            os: macos-13
            python: '3.12'
            toxenv: py312-test-alldeps

          - name: Documentation link check
            os: ubuntu-latest
            python: '3.x'
            toxenv: linkcheck
            toxposargs: --color

    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      with:
        fetch-depth: 0
    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: ${{ matrix.python }}
    - name: Install language-pack-de and tzdata
      if: ${{ matrix.os == 'ubuntu-latest' }}
      run: |
        sudo apt-get update
        sudo apt-get install language-pack-de tzdata
    - name: Install graphviz
      if: ${{ matrix.toxenv == 'linkcheck' }}
      run: sudo apt-get install graphviz
    - name: Install Python dependencies
      run: python -m pip install --upgrade tox
    - name: Run tests
      run: tox ${{ matrix.toxargs}} -e ${{ matrix.toxenv}} -- ${{ matrix.toxposargs}}

  tests_more_architectures:

    # The following architectures are emulated and are therefore slow, so
    # we include them just in the weekly cron. These also serve as a test
    # of using system libraries and using pytest directly.

    runs-on: ubuntu-latest
    name: Python 3.12
    if: (github.repository == 'astropy/astropy' && (github.event_name == 'schedule' || github.event_name == 'push' || github.event_name == 'workflow_dispatch' || contains(github.event.pull_request.labels.*.name, 'Extra CI')))
    env:
      ARCH_ON_CI: ${{ matrix.arch }}

    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: aarch64
          - arch: s390x
          - arch: ppc64le
          - arch: armv7

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: uraimo/run-on-arch-action@v2
        name: Run tests
        id: build
        with:
          arch: ${{ matrix.arch }}
          distro: ubuntu_rolling

          shell: /bin/bash
          env: |
            ARCH_ON_CI: ${{ env.ARCH_ON_CI }}
            IS_CRON: ${{ env.IS_CRON }}

          install: |
            apt-get update -q -y
            apt-get install -q -y gnupg2
            # Add test-support repository for wcslib8
            echo "deb http://ppa.launchpadcontent.net/astropy/test-support/ubuntu lunar main" > /etc/apt/sources.list.d/test-support.list
            gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv CC75F07B3EF41EFC
            gpg --export --armor CC75F07B3EF41EFC | tee /etc/apt/trusted.gpg.d/test-support.asc
            apt-get update -q -y
            apt-get install -q -y --no-install-recommends \
                                  git \
                                  g++ \
                                  pkg-config \
                                  python3 \
                                  python3-erfa \
                                  python3-extension-helpers \
                                  python3-jinja2 \
                                  python3-numpy \
                                  python3-pytest-astropy \
                                  python3-setuptools-scm \
                                  python3-yaml \
                                  python3-venv \
                                  python3-wheel \
                                  wcslib-dev

          run: |
            uname -a
            echo "LONG_BIT="$(getconf LONG_BIT)
            python3 -m venv --system-site-packages tests
            source tests/bin/activate
            # cython and pyerfa versions in ubuntu repos are too old currently
            pip install -U cython
            pip install -U --no-build-isolation pyerfa
            ASTROPY_USE_SYSTEM_ALL=1 pip3 install -v --no-build-isolation -e .[test]
            pip3 list
            python3 -m pytest -m "not hypothesis"


CI

name: CI

on:
  push:
    branches:
    - main
    - 'v*'
    tags:
    - '*'
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  ARCH_ON_CI: "normal"
  IS_CRON: "false"

jobs:
  initial_checks:
    name: Mandatory checks before CI
    runs-on: ubuntu-latest
    steps:
    - name: Check base branch
      uses: actions/github-script@v7
      if: github.event_name == 'pull_request'
      with:
        script: |
          const skip_label = 'skip-basebranch-check';
          const { default_branch: allowed_basebranch } = context.payload.repository;
          const pr = context.payload.pull_request;
          if (pr.user.login === 'meeseeksmachine') {
            core.info(`Base branch check is skipped since this is auto-backport by ${pr.user.login}`);
            return;
          }
          if (pr.labels.find(lbl => lbl.name === skip_label)) {
            core.info(`Base branch check is skipped due to the presence of ${skip_label} label`);
            return;
          }
          if (pr.base.ref !== allowed_basebranch) {
            core.setFailed(`PR opened against ${pr.base.ref}, not ${allowed_basebranch}`);
          } else {
            core.info(`PR opened correctly against ${allowed_basebranch}`);
          }

  tests:
    needs: [initial_checks]
    uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@v1
    secrets:
      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
    with:
      setenv: |
        ARCH_ON_CI: "normal"
        IS_CRON: "false"
      submodules: false
      coverage: ''
      libraries: |
        apt:
          - language-pack-fr
          - tzdata
      envs: |
        # NOTE: this coverage test is needed for tests and code that
        #       run only with minimal dependencies.
        - name: Python 3.12 with minimal dependencies and full coverage
          linux: py312-test-cov
          coverage: codecov

        - name: Python 3.11 in Parallel with all optional dependencies
          linux: py311-test-alldeps-fitsio
          libraries:
            apt:
              - language-pack-fr
              - tzdata
              - libcfitsio-dev
          toxargs: -v --develop
          posargs: -n=4 --run-slow

        - name: Python 3.10 with oldest supported version of all dependencies
          linux: py310-test-oldestdeps-alldeps-cov-clocale
          posargs: --remote-data=astropy
          coverage: codecov

        - name: Python 3.11 with all optional dependencies (Windows)
          windows: py311-test-alldeps
          posargs: --durations=50

        - name: Python 3.11 with all optional dependencies (MacOS X)
          macos: py311-test-alldeps
          posargs: --durations=50 --run-slow
          runs-on: macos-latest

        - name: Python 3.10 Double test (Run tests twice)
          linux: py310-test-double

  allowed_failures:
    needs: [initial_checks]
    uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@v1
    with:
      setenv: |
        ARCH_ON_CI: "normal"
        IS_CRON: "false"
      submodules: false
      coverage: ''
      libraries: |
        apt:
          - language-pack-de
          - tzdata
      envs: |
        - name: (Allowed Failure) Python 3.12 with remote data and dev version of key dependencies
          linux: py312-test-devdeps
          posargs: --remote-data=any --verbose


CodeQL

# For most projects, this workflow file will not need changing; you simply need
# to commit it to your repository.
#
# You may wish to alter this file to override the set of languages analyzed,
# or to provide custom queries or build logic.
#
# ******** NOTE ********
# We have attempted to detect the languages in your repository. Please check
# the `language` matrix defined below to confirm you have the correct set of
# supported CodeQL languages.
#
name: "CodeQL"

on:
  schedule:
    # run every Wednesday at 6am UTC
    - cron: '0 6 * * 3'

permissions:
  contents: read

jobs:
  analyze:
    permissions:
      actions: read  # for github/codeql-action/init to get workflow details
      contents: read  # for actions/checkout to fetch code
      security-events: write  # for github/codeql-action/autobuild to send a status report
    name: Analyze
    runs-on: ubuntu-latest

    strategy:
      fail-fast: false
      matrix:
        language: ['cpp', 'python']
        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
        # Learn more:
        # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4
      with:
        fetch-depth: 0

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v3
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
        # By default, queries listed here will override any specified in a config file.
        # Prefix the list here with "+" to use these queries and those in the config file.
        # queries: ./path/to/local/query, your-org/your-repo/queries@main

    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
    # If this step fails, then you should remove it and run the build manually (see below)
    - name: Autobuild
      if: matrix.language != 'cpp'
      uses: github/codeql-action/autobuild@v3

    # ℹ Command-line programs to run using the OS shell.
    # 📚 https://git.io/JvXDl

    # ✏ If the Autobuild fails above, remove it and uncomment the following three lines
    #    and modify them (or add more) to build your code if your project
    #    uses a compiled language

    - name: Set up Python
      uses: actions/setup-python@v5
      if: matrix.language == 'cpp'
      with:
        python-version: '3.10'

    - name: Manual build
      if: matrix.language == 'cpp'
      run: |
       pip install -U pip setuptools_scm wheel
       pip install extension-helpers cython numpy pyerfa
       python setup.py build_ext --inplace

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v3


When Opened

name: "When Opened"

on:
  issues:
    types:
    - opened
  pull_request_target:
    types:
    - opened

jobs:
  triage:
    runs-on: ubuntu-latest
    steps:
    - name: Label PR
      uses: actions/labeler@v5
      if: github.event_name == 'pull_request_target' && github.event.pull_request.user.login != 'meeseeksmachine'
      with:
        repo-token: "${{ secrets.GITHUB_TOKEN }}"
    - name: 'Reviewer Checklist'
      uses: actions/github-script@v7
      if: github.event_name == 'pull_request_target'
      with:
        github-token: ${{ secrets.GITHUB_TOKEN }}
        script: |
          await github.rest.issues.createComment({
            issue_number: context.issue.number,
            owner: context.repo.owner,
            repo: context.repo.repo,
            body: `Thank you for your contribution to Astropy! 🌌 This checklist is meant to remind the package maintainers who will review this pull request of some common things to look for.

            - [ ] Do the proposed changes actually accomplish desired goals?
            - [ ] Do the proposed changes follow the [Astropy coding guidelines](https://docs.astropy.org/en/latest/development/codeguide.html)?
            - [ ] Are tests added/updated as required? If so, do they follow the [Astropy testing guidelines](https://docs.astropy.org/en/latest/development/testguide.html)?
            - [ ] Are docs added/updated as required? If so, do they follow the [Astropy documentation guidelines](https://docs.astropy.org/en/latest/development/docguide.html#astropy-documentation-rules-and-guidelines)?
            - [ ] Is rebase and/or squash necessary? If so, please provide the author with appropriate instructions. Also see instructions for [rebase](https://docs.astropy.org/en/latest/development/workflow/development_workflow.html#rebase-if-necessary) and [squash](https://docs.astropy.org/en/latest/development/workflow/development_workflow.html#squash-if-necessary).
            - [ ] Did the CI pass? If no, are the failures related? If you need to run daily and weekly cron jobs as part of the PR, please apply the "Extra CI" label. Codestyle issues can be fixed by the [bot](https://docs.astropy.org/en/latest/development/workflow/development_workflow.html#pre-commit).
            - [ ] Is a change log needed? If yes, did the change log check pass? If no, add the "no-changelog-entry-needed" label. If this is a manual backport, use the "skip-changelog-checks" label unless special changelog handling is necessary.
            - [ ] Is this a big PR that makes a "What's new?" entry worthwhile and if so, is (1) a "what's new" entry included in this PR and (2) the "whatsnew-needed" label applied?
            - [ ] At the time of adding the milestone, if the milestone set requires a backport to release branch(es), apply the appropriate "backport-X.Y.x" label(s) *before* merge.`
          })
    - name: Greet new contributors
      uses: actions/first-interaction@v1
      with:
        repo-token: "${{ secrets.GITHUB_TOKEN }}"
        issue-message: >
            Welcome to Astropy 👋 and thank you for your first issue!

            A project member will respond to you as soon as possible; in
            the meantime, please double-check the [guidelines for submitting
            issues](https://github.com/astropy/astropy/blob/main/CONTRIBUTING.md#reporting-issues)
            and make sure you've provided the requested details.

            GitHub issues in the Astropy repository are used to track bug
            reports and feature requests; If your issue poses a question about
            how to use Astropy, please instead raise your question in the
            [Astropy Discourse user
            forum](https://community.openastronomy.org/c/astropy/8) and close
            this issue.

            If you feel that this issue has not been responded to in a timely
            manner, please send a message directly to the [development
            mailing list](http://groups.google.com/group/astropy-dev).  If
            the issue is urgent or sensitive in nature (e.g., a security
            vulnerability) please send an e-mail directly to the private e-mail
            feedback@astropy.org.
        pr-message: >
            Welcome to Astropy 👋 and congratulations on your first pull
            request! 🎉

            A project member will respond to you as soon as possible; in the
            meantime, please have a look over the [Checklist for Contributed
            Code](https://github.com/astropy/astropy/blob/main/CONTRIBUTING.md#checklist-for-contributed-code)
            and make sure you've addressed as many of the questions there as
            possible.

            If you feel that this pull request has not been responded to in a
            timely manner, please send a message directly to the
            [development mailing
            list](http://groups.google.com/group/astropy-dev).  If the issue is
            urgent or sensitive in nature (e.g., a security vulnerability)
            please send an e-mail directly to the private e-mail
            feedback@astropy.org.
    - name: 'Comment Draft PR'
      uses: actions/github-script@v7
      if: github.event.pull_request.draft == true
      with:
        github-token: ${{ secrets.GITHUB_TOKEN }}
        script: |
          await github.rest.issues.createComment({
            issue_number: context.issue.number,
            owner: context.repo.owner,
            repo: context.repo.repo,
            body: '👋 Thank you for your draft pull request! Do you know that you can use `[ci skip]` or `[skip ci]` in your commit messages to skip running continuous integration tests until you are ready?'
          })
    # Special action for a special day. Until next year!
    #- name: Special comment
    #  uses: pllim/action-special_pr_comment@main
    #  with:
    #    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}


Wheel building

name: Wheel building

on:
  schedule:
    # run every day at 4am UTC
    - cron: '0 4 * * *'
  workflow_dispatch:
  push:
  pull_request:

permissions:
  contents: read

jobs:

  test_wheel_building:
    # This ensures that a couple of targets work fine in pull requests and pushes
    permissions:
      contents: none
    uses: OpenAstronomy/github-actions-workflows/.github/workflows/publish.yml@v1
    if: (github.event_name == 'push' || github.event_name == 'pull_request')
    with:
      upload_to_pypi: false
      upload_to_anaconda: false
      test_extras: test
      test_command: pytest -p no:warnings --astropy-header -m "not hypothesis" -k "not test_data_out_of_range and not test_set_locale and not TestQuantityTyping" --pyargs astropy
      targets: |
        - cp310-manylinux_x86_64

  build_and_publish:
    # This does the actual wheel building and publishing as part of the cron job
    # or if triggered manually via the workflow dispatch, or for a tag.
    permissions:
      contents: none
    uses: OpenAstronomy/github-actions-workflows/.github/workflows/publish.yml@v1
    if: (github.repository == 'astropy/astropy' && ( startsWith(github.ref, 'refs/tags/v') || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || contains(github.event.pull_request.labels.*.name, 'Build all wheels')))
    with:

      # We upload to PyPI for all tags starting with v but not ones ending in .dev
      upload_to_pypi: ${{ startsWith(github.ref, 'refs/tags/v') && !endsWith(github.ref, '.dev') && (github.event_name == 'push') }}
      upload_to_anaconda: ${{ (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') }}
      anaconda_user: astropy
      anaconda_package: astropy
      anaconda_keep_n_latest: 10

      # For nightly wheels as well as when building with the 'Build all wheels' label, we disable
      # the build isolation and explicitly install the latest developer version of numpy as well as
      # the latest stable versions of all other build-time dependencies.
      env: |
        CIBW_BEFORE_BUILD: '${{ ((github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || contains(github.event.pull_request.labels.*.name, 'Build all wheels')) && 'pip install --pre --extra-index-url https://pypi.anaconda.org/scientific-python-nightly-wheels/simple setuptools setuptools_scm cython numpy>=0.0.dev0 extension-helpers') || '' }}'
        CIBW_BUILD_FRONTEND: '${{ ((github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || contains(github.event.pull_request.labels.*.name, 'Build all wheels')) && 'pip; args: --no-build-isolation') || 'build' }}'

      test_extras: test
      # FIXME: we exclude the test_data_out_of_range test since it
      # currently fails, see https://github.com/astropy/astropy/issues/10409
      # We also exclude test_set_locale as it sometimes relies on the correct locale
      # packages being installed, which it isn't always.
      test_command: pytest -p no:warnings --astropy-header -m "not hypothesis" -k "not test_data_out_of_range and not test_set_locale and not TestQuantityTyping" --pyargs astropy
      targets: |
        # Linux wheels

        - cp310-manylinux_x86_64
        - cp311-manylinux_x86_64
        - cp312-manylinux_x86_64

        # Note that following wheels are not currently tested:

        - cp310-manylinux_aarch64
        - cp311-manylinux_aarch64
        - cp312-manylinux_aarch64

        - cp310-musllinux_x86_64
        - cp311-musllinux_x86_64
        - cp312-musllinux_x86_64

        # MacOS X wheels - as noted in https://github.com/astropy/astropy/pull/12379 we deliberately
        # do not build universal2 wheels.

        - cp310*macosx_x86_64
        - cp311*macosx_x86_64
        - cp312*macosx_x86_64

        - cp310*macosx_arm64
        - cp311*macosx_arm64
        - cp312*macosx_arm64

        # Windows wheels

        - cp310*win32
        - cp311*win32
        - cp312*win32

        - cp310*win_amd64
        - cp311*win_amd64
        - cp312*win_amd64

    secrets:
      pypi_token: ${{ secrets.pypi_token }}
      anaconda_token: ${{ secrets.anaconda_token }}


Astropy stalebot

name: Astropy stalebot

on:
  schedule:
    # * is a special character in YAML so you have to quote this string
    # run every day at 5:30 am UTC
    - cron: '30 5 * * *'
  workflow_dispatch:

jobs:
  stalebot:
    runs-on: ubuntu-latest
    if: github.repository == 'astropy/astropy'
    steps:
      - uses: pllim/action-astropy-stalebot@main
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          STALEBOT_MAX_ISSUES: -1
          STALEBOT_MAX_PRS: -1
          STALEBOT_SLEEP: 10


# Regularly update the minimum version of astropy-iers-data in pyproject.toml,
# to ensure that if users update astropy, astropy-iers-data will also get
# updated to a recent version.

name: Auto-update astropy-iers-data minimum version

on:
  schedule:
    - cron: '0 0 2 * *'  # Monthly
  workflow_dispatch:

permissions:
  contents: read

jobs:

  update-astropy-iers-data-pin:
    permissions:
      contents: write  # for peter-evans/create-pull-request to create branch
      pull-requests: write  # for peter-evans/create-pull-request to create a PR
    name: Auto-update astropy-iers-data minimum version
    runs-on: ubuntu-latest
    if: github.repository == 'astropy/astropy'
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: 3.x
    - name: Install dependencies
      run: pip install requests
    - name: Run update script
      run: python .github/workflows/update_astropy_iers_data_pin.py
    - name: Commit changes
      run: |
        git config user.name github-actions
        git config user.email github-actions@github.com
        git add pyproject.toml
        if ! git diff --cached --exit-code; then
          git commit -m "Update minimum required version of astropy-iers-data"
        fi
    - name: Create Pull Request
      uses: peter-evans/create-pull-request@v6
      with:
        branch: update-astropy-iers-data-pin
        branch-suffix: timestamp
        delete-branch: true
        labels: no-changelog-entry-needed, utils.iers
        title: Update minimum required version of astropy-iers-data
        body: |
          This is an automated update of the minimum version of astropy-iers-data package.

          :pray: Please apply backport labels to any active backport branches for v6.0.x or later. :pray:

          :warning: Please close and re-open this pull request to trigger the CI. :warning:


build

name: build

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

  workflow_dispatch:

jobs:

  build:
    name: build
    runs-on: ${{ matrix.os }}

    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
        python-version: ['3.8', '3.9', '3.10', '3.11', '3.12']
        architecture: ['x64']

    steps:
      - uses: actions/checkout@v3

      - name: setup
        uses: actions/setup-python@v4
        with:
          python-version: ${{ matrix.python-version }}
          architecture: ${{ matrix.architecture }}

      - name: deps
        run: python -m pip install -U pip wheel setuptools build

      - name: build
        run: |
          python -m build


release

name: release

on:
  workflow_dispatch:

jobs:

  sdist:
    name: Package source
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v3

      - name: setup
        uses: actions/setup-python@v4
        with:
          python-version: '3.12'
          architecture: x64

      - name: deps
        run: python -m pip install -U pip wheel setuptools

      - name: sdist
        run: python setup.py sdist -d package

      - name: upload
        uses: actions/upload-artifact@v3
        with:
          name: package
          path: package/*.tar.gz

  wheels:
    name: Build wheels on ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-20.04, windows-2019, macos-11]

    env:
      CIBW_ARCHS_MACOS: x86_64 arm64

    steps:
      - uses: actions/checkout@v3

      - name: setup
        uses: actions/setup-python@v4
        with:
          python-version: '3.12'
          architecture: x64

      - name: deps
        run: python -m pip install cibuildwheel==2.16.2

      - name: wheels
        run: python -m cibuildwheel --output-dir package

      - name: upload
        uses: actions/upload-artifact@v3
        with:
          name: package
          path: package/*.whl


tests

name: tests

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

  workflow_dispatch:

jobs:
  tests:
    name: tests
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v3

      - name: build
        run: docker build . -f tests/Containerfile -t tests

      - name: test
        run: docker run --rm -t tests


basemap-data-hires

name: basemap-data-hires

env:
  PKGDIR: "packages/basemap_data_hires"
  PIP_DEFAULT_TIMEOUT: 10
  PIP_DISABLE_PIP_VERSION_CHECK: 1
  PIP_PREFER_BINARY: 1
  PIP_RETRIES: 0
  PYTHONUNBUFFERED: "1"
  PYTHONWARNINGS: "ignore:DEPRECATION"

on:
  push:
    paths:
      - ".github/workflows/basemap-data-hires.yml"
      - "packages/basemap_data_hires/**"
  pull_request:
    paths:
      - ".github/workflows/basemap-data-hires.yml"
      - "packages/basemap_data_hires/**"
  workflow_dispatch:

jobs:

  checkout:
    runs-on: ubuntu-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@v4
      -
        name: Upload checkout
        uses: actions/upload-artifact@v4
        with:
          name: checkout
          path: .

  build:
    strategy:
      matrix:
        python-version:
          ["2.7"]
      max-parallel: 1
    needs: checkout
    runs-on: ubuntu-latest
    container: "pylegacy/python:${{ matrix.python-version }}-debian-10"
    steps:
      -
        name: Download checkout
        uses: actions/download-artifact@v4
        with:
          name: checkout
          path: .
      -
        name: Build sdist and wheel
        run: |
          cd ${{ env.PKGDIR }}
          python setup.py sdist
          pip wheel -w dist --no-deps dist/*.zip
      -
        name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: artifacts-build
          path: ${{ env.PKGDIR }}/dist

  test:
    strategy:
      matrix:
        python-version:
          ["2.6", "2.7", "3.2", "3.3", "3.4", "3.5", "3.6", "3.7", "3.8",
           "3.9", "3.10", "3.11", "3.12"]
      max-parallel: 3
      fail-fast: false
    needs: build
    runs-on: ubuntu-latest
    container: "pylegacy/python:${{ matrix.python-version }}-debian-10"
    steps:
      -
        name: Download checkout
        uses: actions/download-artifact@v4
        with:
          name: checkout
          path: .
      -
        name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: artifacts-build
          path: ${{ env.PKGDIR }}/dist
      -
        name: Install package
        run: |
          pip install ${{ env.PKGDIR }}/dist/*.whl
      -
        name: Test package
        run: |
          python -c "from mpl_toolkits import basemap_data; print(basemap_data)"

  upload:
    strategy:
      matrix:
        python-version:
          ["2.7"]
      max-parallel: 1
    if: startsWith(github.event.ref, 'refs/tags/v')
    needs: test
    runs-on: ubuntu-latest
    container: "pylegacy/python:${{ matrix.python-version }}-debian-10"
    environment: PyPI
    steps:
      -
        name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: artifacts-build
          path: ${{ env.PKGDIR }}/dist
      -
        name: Install upload requirements
        run: |
          pip install twine
      -
        name: Check distributables
        run: |
          python -m twine check                                               \
              ${{ env.PKGDIR }}/dist/*.zip                                    \
              ${{ env.PKGDIR }}/dist/*.whl
      -
        name: Upload distributables
        env:
          TWINE_USERNAME: __token__
          TWINE_PASSWORD: "${{ secrets.PYPI_TOKEN }}"
          TWINE_REPOSITORY_URL: "${{ secrets.PYPI_REPOSITORY_URL }}"
        run: |
          python -m twine upload --skip-existing                              \
              ${{ env.PKGDIR }}/dist/*.zip                                    \
              ${{ env.PKGDIR }}/dist/*.whl