Check Black

# This workflow will test the code base using the LATEST version of black

# IMPORTANT: Black is under development. Hence, minor fommatting changes between
# different version are expected.
# If this test fails, install the latest version of black and then run black.
# Preferably, run black only on the files that you have modified.
# This will faciliate the revision of the proposed changes.

name: Check Black

on:
  # Triggers the workflow on push or pull request events but only for the master branch
  push:
    branches: [ master ]
  pull_request:
    branches: [ master ]

jobs:
  build:

    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
      - name: Set up Python 3.9
        uses: actions/setup-python@v5
        with:
          python-version: 3.9
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install black

      - name: Black version
        run: black --version

      - name: Black check
        working-directory: ${{github.workspace}}
        run: black --check .


Upload Python Package

# This workflows will upload a Python Package using Twine when a release is created
# For more information see: https://help.github.com/en/actions/language-and-framework-guides/using-python-with-github-actions#publishing-to-package-registries

name: Upload Python Package

on:
  release:
    types: [published]

jobs:
  deploy:

    runs-on: ubuntu-latest
    permissions:
      id-token: write

    steps:
    - uses: actions/checkout@v4
    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: '3.x'
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install setuptools wheel numpy cython
    - name: Build
      run: |
        python setup.py sdist
    - name: Publish
      uses: pypa/gh-action-pypi-publish@release/v1


Test pysteps

name: Test pysteps

on:
  # Triggers the workflow on push or pull request events to the master branch
  push:
    branches:
      - master
      - pysteps-v2
  pull_request:
      branches:
        - master
        - pysteps-v2

jobs:
  unit_tests:
    name: Unit Tests (${{ matrix.python-version }}, ${{ matrix.os }})
    runs-on: ${{ matrix.os }}

    strategy:
      fail-fast: false
      matrix:
        os: [ "ubuntu-latest", "macos-latest", "windows-latest" ]
        python-version: ["3.9", "3.11"]
      max-parallel: 6

    defaults:
      run:
        shell: bash -l {0}

    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}

      # need headless opencv on Linux, see https://github.com/conda-forge/opencv-feedstock/issues/401
      - name: Install mamba and create environment for Linux
        if: matrix.os == 'ubuntu-latest'
        uses: mamba-org/setup-micromamba@v1
        with:
          environment-file: ci/ci_test_env.yml
          environment-name: test_environment
          generate-run-shell: false
          create-args: >-
            python=${{ matrix.python-version }}
            libopencv=*=headless*

      - name: Install mamba and create environment (not Linux)
        if: matrix.os != 'ubuntu-latest'
        uses: mamba-org/setup-micromamba@v1
        with:
          environment-file: ci/ci_test_env.yml
          environment-name: test_environment
          generate-run-shell: false
          create-args: python=${{ matrix.python-version }}

      - name: Install pygrib (not win)
        if: matrix.os != 'windows-latest'
        run: mamba install --quiet pygrib

      - name: Install pysteps for MacOS
        if: matrix.os == 'macos-latest'
        working-directory: ${{github.workspace}}
        env:
          CC: gcc-13
          CXX: g++-13
          CXX1X: g++-13
          HOMEBREW_NO_INSTALL_CLEANUP: 1
        run: |
          brew update-reset
          brew update
          gcc-13 --version || brew install gcc@13
          pip install .

      - name: Install pysteps
        if: matrix.os != 'macos-latest'
        working-directory: ${{github.workspace}}
        run: pip install .

      - name: Download pysteps data
        env:
          PYSTEPS_DATA_PATH: ${{github.workspace}}/pysteps_data
        working-directory: ${{github.workspace}}/ci
        run: python fetch_pysteps_data.py

      - name: Check imports
        working-directory: ${{github.workspace}}/pysteps_data
        run: |
          python --version
          python -c "import pysteps; print(pysteps.__file__)"
          python -c "from pysteps import motion"
          python -c "from pysteps.motion import vet"
          python -c "from pysteps.motion import proesmans"

      - name: Run tests and coverage report
        working-directory: ${{github.workspace}}/pysteps_data
        env:
          PYSTEPSRC: ${{github.workspace}}/pysteps_data/pystepsrc
        run: pytest --pyargs pysteps --cov=pysteps --cov-report=xml --cov-report=term -ra

      - name: Upload coverage to Codecov (Linux only)
        if: matrix.os == 'ubuntu-latest'
        uses: codecov/codecov-action@v4
        env:
          OS: ${{ matrix.os }}
          PYTHON: ${{ matrix.python-version }}
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: ${{github.workspace}}/pysteps_data/coverage.xml
          flags: unit_tests
          env_vars: OS,PYTHON
          fail_ci_if_error: true
          verbose: true


DepthAI Demo CI/CD

name: DepthAI Demo CI/CD

on:
  workflow_dispatch:
  push:
    branches:
      - main
    tags:
      - 'v*'
      - '!v*-sdk'
  pull_request:
    branches:
      - main

jobs:
  windows-installer:
    runs-on: windows-latest
    steps:
    # Clones repository without persisting credentials
    # As this local git repository is packed with installer
    - uses: actions/checkout@v2
      with:
        submodules: 'recursive'
        persist-credentials: ''

    - name: Get tag version
      id: tag
      uses: battila7/get-version-action@v2

    - name: Set version (Release)
      if: startsWith(github.ref, 'refs/tags/v') == true
      run: echo '#define MyAppVersion "${{ steps.tag.outputs.version-without-v }}"' > launcher/windows/version.txt

    - name: Set version
      if: startsWith(github.ref, 'refs/tags/v') != true
      run: echo '#define MyAppVersion "1.0-${{ github.sha }}"' > launcher/windows/version.txt

    - name: Build Windows Installer
      run: .\launcher\windows\build.ps1

    - name: Upload Installer artifact
      uses: actions/upload-artifact@v2
      with:
        name: installers
        path: launcher/windows/build/Output/
        retention-days: 5

  release:
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: windows-latest
    needs: windows-installer
    steps:
    - name: Download Windows installer
      uses: actions/download-artifact@v2
      with:
        name: 'installers'
        path: installers

   # Sign Launcher
    - name: Sign Windows Launcher
      run: |
        New-Item -ItemType directory -Path certificate
        Set-Content -Path certificate\certificate.txt -Value '${{ secrets.WINDOWS_CERTIFICATE }}'
        certutil -decode certificate\certificate.txt certificate\certificate.pfx
        & 'C:/Program Files (x86)/Windows Kits/10/bin/10.0.17763.0/x86/signtool.exe' sign /td sha256 /fd sha256 /f certificate\certificate.pfx /p '${{ secrets.WINDOWS_CERTIFICATE_PASS }}' /tr http://timestamp.digicert.com installers/DepthAI_setup.exe
    - name: Get current tag
      id: tag
      uses: battila7/get-version-action@v2
   # Create GitHub release
    - uses: actions/create-release@master
      id: createRelease
      name: Create ${{ steps.tag.outputs.version }} DepthAI Demo release
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      with:
        tag_name: ${{ steps.tag.outputs.version }}
        release_name: DepthAI Demo ${{ steps.tag.outputs.version }}
        body: |
          ## Features

          ## Bugs

          ## Misc

        draft: true

    # Upload release assets
    - name: Upload Windows Installer
      uses: actions/upload-release-asset@v1.0.1
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      with:
        upload_url: ${{ steps.createRelease.outputs.upload_url }}
        asset_path: ${{ github.workspace }}\installers\DepthAI_setup.exe
        asset_name: DepthAI-setup-${{ steps.tag.outputs.version }}.exe
        asset_content_type: application/octet-stream


DepthAI Docker Image

name: DepthAI Docker Image
on:
  workflow_dispatch:
  push:
    branches:
      - main
    tags:
      - 'v*'
      - '!v*-sdk'
  pull_request:
    branches:
      - main

jobs:

  build:
    name: Build and Upload to Docker Hub
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v2

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Login to DockerHub
        uses: docker/login-action@v1
        with:
          username: ${{ secrets.DOCKERHUB_USER }}
          password: ${{ secrets.DOCKERHUB_PASS }}

      - name: Build and push (development)
        if: startsWith(github.ref, 'refs/tags/v') != true
        run: |
          docker buildx build \
            --platform linux/amd64,linux/arm/v7,linux/arm64 \
            --tag luxonis/depthai:${{ github.sha }} \
            --output "type=image,push=true" .

      - name: Get Version
        if: startsWith(github.ref, 'refs/tags/v')
        id: vars
        run: echo ::set-output name=short_ref::${GITHUB_REF#refs/*/}

      - name: Build and push (release)
        if: startsWith(github.ref, 'refs/tags/v')
        run: |
          docker buildx build \
            --platform linux/amd64,linux/arm/v7,linux/arm64 \
            --tag luxonis/depthai:${{ steps.vars.outputs.short_ref }} \
            --tag luxonis/depthai:latest \
            --output "type=image,push=true" .


Upload Python Package

# This workflow will upload a Python Package using Twine when a release is created
# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python#publishing-to-package-registries

# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

name: Upload Python Package

on:
  release:
    tag-name-pattern: 'v(\d+.?)*-sdk'
    types: [published]

permissions:
  contents: read

jobs:
  deploy:

    runs-on: ubuntu-latest

    defaults:
      run:
        working-directory: ./depthai_sdk

    steps:
    - uses: actions/checkout@v3
    - name: Set up Python
      uses: actions/setup-python@v3
      with:
        python-version: '3.x'
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install build
    - name: Build package
      run: python -m build
    - name: Publish package
      uses: pypa/gh-action-pypi-publish@27b31702a0e7fc50959f5ad993c78deac1bdfc29
      with:
        user: __token__
        password: ${{ secrets.PYPI_API_TOKEN }}
        packages_dir: depthai_sdk/dist/

    - name: Repository Dispatch
      uses: peter-evans/repository-dispatch@v2
      with:
        token: ${{ secrets.GITHUB_TOKEN }}
        event-type: robothub-oak-release
        repository: luxonis/robothub-images
        client-payload: '{"ref": "${{ github.ref }}"}'


OS Support

 name: OS Support

 on:
  workflow_dispatch:
  push:
    paths:
      - 'install_requirements.py'
      - '.github/workflows/test_install_requirements.yml'
      - 'requirements.txt'
      - 'requirements-optional.txt'
      - 'depthai_sdk/requirements.txt'

 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   test_linux_fedora:
     runs-on: ubuntu-latest
     strategy:
       matrix:
          container_image: ["fedora:34", "fedora:35", "fedora:36"]
       fail-fast: false
     container:
       image: ${{ matrix.container_image }}
     steps:
       - uses: actions/checkout@v3
       - name: Install sudo
         if: startsWith(matrix.container_image, 'fedora') == true
         run: yum update -y && yum install -y sudo curl
       - name: Install dependencies
         run: |
           ln -snf /usr/share/zoneinfo/UTC /etc/localtime && echo UTC > /etc/timezone
           curl -fL https://docs.luxonis.com/install_dependencies.sh > install_dependencies.sh
           sed '/udevadm control --reload-rules && sudo udevadm trigger/d' install_dependencies.sh > tmp_script.sh
           bash tmp_script.sh
       - name: Install example requirements
         run: |
           python3 install_requirements.py
   test_linux_ubuntu:
     strategy:
       matrix:
          python-version: ["3.7", "3.8", "3.9", "3.10", "3.11"]
          os: ["ubuntu-20.04", "ubuntu-22.04"]
       fail-fast: false
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v3
       - name: Install curl
         run: sudo apt-get update  -qq && sudo apt-get -qq install curl
       - uses: actions/setup-python@v4
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install dependencies
         run: |
           ln -snf /usr/share/zoneinfo/UTC /etc/localtime && echo UTC > /etc/timezone
           curl -fL https://docs.luxonis.com/install_dependencies.sh > install_dependencies.sh
           sed '/udevadm control --reload-rules && sudo udevadm trigger/d' install_dependencies.sh > tmp_script.sh
           bash tmp_script.sh
       - name: Install example requirements
         run: |
           python3 install_requirements.py
   test_macos:
      strategy:
        matrix:
          python-version: ["3.7", "3.8", "3.9", "3.10", "3.11"]
          os: ["macos-11", "macos-12"]
        fail-fast: false
      runs-on: ${{ matrix.os }}
      steps:
       - uses: actions/checkout@v3
       - uses: actions/setup-python@v4
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install dependencies
         run: |
           curl -fL https://docs.luxonis.com/install_dependencies.sh > install_dependencies.sh
           sed '/udevadm control --reload-rules && sudo udevadm trigger/d' install_dependencies.sh > tmp_script.sh
           bash tmp_script.sh
       - name: Install example requirements
         run: |
           python3 install_requirements.py
   test_windows:
      runs-on: windows-latest
      strategy:
        matrix:
          python-version: ["3.7", "3.8", "3.9", "3.10", "3.11"]
        fail-fast: false
      steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-python@v4
        with:
           python-version: ${{ matrix.python-version }}
      - name: Download chocolatey
        shell: pwsh
        run: Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))
      - name: Install pycharm-community dependency
        shell: pwsh
        run: choco install pycharm-community -y
      - name: Install requrirements
        run: |
          python install_requirements.py


Linkcheck

# This is a GitHub workflow defining a set of jobs with a set of steps. ref:
# https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions
#
name: Linkcheck

on:
  pull_request:
    paths:
      - "docs/**"
      - "**/linkcheck.yaml"
  push:
    paths:
      - "docs/**"
      - "**/linkcheck.yaml"
    branches-ignore:
      - "dependabot/**"
      - "pre-commit-ci-update-config"
  workflow_dispatch:

jobs:
  linkcheck:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install deps
        run: pip install -r docs/requirements.txt

      - name: make linkcheck
        run: |
          cd docs
          make linkcheck SPHINXOPTS='--color -W --keep-going'


Publish

# This is a GitHub workflow defining a set of jobs with a set of steps.
# ref: https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions
#
# Publish PyPI and NPM artifacts
#
name: Publish

on:
  pull_request:
    paths-ignore:
      - "docs/**"
      - "contrib/**"
      - "**.md"
      - ".github/workflows/*"
      - "!.github/workflows/publish.yaml"
  push:
    paths-ignore:
      - "docs/**"
      - "contrib/**"
      - "**.md"
      - ".github/workflows/*"
      - "!.github/workflows/publish.yaml"
    branches-ignore:
      - "dependabot/**"
      - "pre-commit-ci-update-config"
    tags:
      - "*"
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-22.04

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - uses: actions/setup-node@v4
        with:
          cache: yarn
          node-version: 20.x
          registry-url: https://registry.npmjs.org
          cache-dependency-path: labextension/yarn.lock

      - name: Update root build packages
        run: |
          pip install --upgrade build pip

      - name: Build dist
        run: |
          pyproject-build
          cd dist && sha256sum * | tee SHA256SUMS

      - name: Check dist sizes
        run: |
          set -eux
          ls -lathr dist
          [[ $(find dist -type f -size +200k) ]] && exit 1 || echo ok

      - name: Javascript package
        run: |
          mkdir jsdist
          cd jsdist
          npm pack ../labextension
          sha256sum * | tee SHA256SUMS

      - name: Upload Python artifact
        uses: actions/upload-artifact@v4
        with:
          name: dist-${{ github.run_attempt }}
          path: dist
          if-no-files-found: error

      - name: Upload Javascript artifact
        uses: actions/upload-artifact@v4
        with:
          name: jsdist-${{ github.run_attempt }}
          path: jsdist
          if-no-files-found: error

  # https://packaging.python.org/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/
  publish-pypi:
    runs-on: ubuntu-22.04
    needs:
      - build

    steps:
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Download artifacts from build
        uses: actions/download-artifact@v4
        with:
          name: dist-${{ github.run_attempt }}
          path: dist

      # The PyPI publishing action will try to publish this checksum file as if
      # it was a Python package if it remains in dist, so we clean it up first.
      - name: Cleanup SHA256SUMS
        run: |
          cat dist/SHA256SUMS
          rm dist/SHA256SUMS

      - name: Publish to PyPI
        if: startsWith(github.ref, 'refs/tags')
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          password: ${{ secrets.PYPI_PASSWORD }}

  # https://docs.github.com/en/actions/language-and-framework-guides/publishing-nodejs-packages#publishing-packages-to-the-npm-registry
  publish-npm:
    runs-on: ubuntu-22.04
    needs:
      - build

    steps:
      # actions/setup-node creates an .npmrc file that references NODE_AUTH_TOKEN
      - uses: actions/setup-node@v4
        with:
          node-version: 18.x
          registry-url: https://registry.npmjs.org

      - name: Download artifacts from build
        uses: actions/download-artifact@v4
        with:
          name: jsdist-${{ github.run_attempt }}
          path: jsdist

      - run: |
          npm publish --dry-run ./jsdist/jupyterhub-jupyter-server-proxy-*.tgz

      - run: |
          npm publish ./jsdist/jupyterhub-jupyter-server-proxy-*.tgz
        if: startsWith(github.ref, 'refs/tags')
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}


Test

# This is a GitHub workflow defining a set of jobs with a set of steps.
# ref: https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions
#
name: Test

on:
  pull_request:
    paths-ignore:
      - "docs/**"
      - "contrib/**"
      - "**.md"
      - ".github/workflows/*"
      - "!.github/workflows/test.yaml"
  push:
    paths-ignore:
      - "docs/**"
      - "contrib/**"
      - "**.md"
      - ".github/workflows/*"
      - "!.github/workflows/test.yaml"
    branches-ignore:
      - "dependabot/**"
      - "pre-commit-ci-update-config"
  schedule:
    # Run at 05:00 on monday and thursday, ref: https://crontab.guru/#0_5_*_*_1,4
    - cron: "0 5 * * 1,4"
  workflow_dispatch:

env:
  # avoid warnings about config paths
  JUPYTER_PLATFORM_DIRS: "1"
  # avoid looking at every version of pip ever released
  PIP_DISABLE_PIP_VERSION_CHECK: "1"

jobs:
  build:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - uses: actions/setup-node@v4
        with:
          cache: yarn
          node-version: 20.x
          registry-url: https://registry.npmjs.org
          cache-dependency-path: labextension/yarn.lock

      - name: Update root build packages
        run: pip install --upgrade build

      - name: Build Python package
        run: pyproject-build

      - name: Upload built artifacts
        uses: actions/upload-artifact@v4
        with:
          name: dist-${{ github.run_attempt }}
          path: ./dist

  test:
    name: ${{ matrix.os }} ${{ matrix.python-version }} ${{ matrix.pip-extras }} ${{ (matrix.pip-install-constraints != '' && '(oldest deps)') || '' }}
    needs: [build]
    timeout-minutes: 30
    runs-on: ${{ matrix.os }}
    defaults:
      run:
        shell: bash # windows default isn't bash

    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-22.04, windows-2022]
        python-version: ["3.8", "3.12"]
        pip-extras: [lab, classic]
        pip-install-constraints: [""]
        exclude:
          # windows should work for all test variations, but a limited selection
          # is run to avoid doubling the amount of test runs
          - os: windows-2022
            python-version: "3.12"
            pip-extras: classic
          - os: windows-2022
            python-version: "3.8"
            pip-extras: lab

          # FIXME: If https://github.com/jupyter/notebook/pull/7305 gets merged
          #        and released, we can test "classic" with python 3.12 as well,
          #        but until then we exclude it from being run as a Python 3.12
          #        test and include it as a Python 3.11 test.
          - os: ubuntu-22.04
            python-version: "3.12"
            pip-extras: classic
        include:
          # this test is manually updated to reflect the lower bounds of
          # versions from dependencies
          - os: ubuntu-22.04
            python-version: "3.8"
            pip-extras: classic
            pip-install-constraints: >-
              jupyter-server==1.24.0
              simpervisor==1.0.0
              tornado==6.1.0
              traitlets==5.1.0

          # Workaround for excluded 3.12 test mentioned in a FIXME above
          - os: ubuntu-22.04
            python-version: "3.11"
            pip-extras: classic

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "${{ matrix.python-version }}"

      - name: Update root build packages
        run: pip install --upgrade pip

      - name: Download built artifacts
        uses: actions/download-artifact@v4
        with:
          name: dist-${{ github.run_attempt }}
          path: ./dist

      - name: Install Python package
        # NOTE: See CONTRIBUTING.md for a local development setup that differs
        #       slightly from this.
        #
        #       Pytest options are set in `pyproject.toml`.
        run: |
          pip install -vv $(ls ./dist/*.whl)\[acceptance,${{ matrix.pip-extras }}\] ${{ matrix.pip-install-constraints }}

      - name: List Python packages
        run: |
          pip freeze
          pip check

      - name: Check server extension for jupyter_server
        run: |
          jupyter server extension list
          jupyter server extension list 2>&1 | grep -iE "jupyter_server_proxy.*OK" -

      - name: Check server extension for notebook v6
        if: contains(matrix.pip-extras, 'classic')
        run: |
          jupyter serverextension list
          jupyter serverextension list 2>&1 | grep -iE "jupyter_server_proxy.*OK" -

      - name: Check frontend extension for notebook v6
        if: contains(matrix.pip-extras, 'classic')
        run: |
          jupyter nbextension list
          PYTHONUNBUFFERED=1 jupyter nbextension list 2>&1 | grep -A1 -iE '.*jupyter_server_proxy.*enabled' | grep -B1 -iE "Validating.*OK"

      - name: Check frontend extension for notebook v7+
        if: ${{ !contains(matrix.pip-extras, 'classic') }}
        run: |
          jupyter notebook extension list
          jupyter notebook extension list 2>&1 | grep -iE 'jupyter_server_proxy.*OK.*'

      - name: Check frontend extension for jupyterlab
        run: |
          jupyter lab extension list
          jupyter lab extension list 2>&1 | grep -iE 'jupyter_server_proxy.*OK.*'

      # we have installed a pre-built wheel and configured code coverage to
      # inspect "jupyter_server_proxy", by re-locating to another directory,
      # there is no confusion about "jupyter_server_proxy" referring to our
      # installed package rather than the local directory
      - name: Run tests
        run: |
          mkdir build
          cd build
          pytest -c ../pyproject.toml ../tests

      - name: Upload test reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: |-
            tests-${{ matrix.os }}-${{ matrix.python-version }}-${{ matrix.pip-extras }}-${{ (matrix.pip-install-constraints != '' && 'oldest-') || '' }}${{ github.run_attempt }}
          path: |
            ./build/pytest
            ./build/coverage
            ./build/robot

      # GitHub action reference: https://github.com/codecov/codecov-action
      - uses: codecov/codecov-action@v4


test-core

name: test-core
on: [push, pull_request]
jobs:
  lint-python:
    name: lint-python
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-python@v4
        with:
          python-version: "3.12"
      - name: Install ruff
        run: |
          pip install .[dev]
      - name: Lint Python
        run: |
          ruff .
  test-asreview-core:
    name: test-asreview-core
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python: ["3.8", "3.12"]
    steps:
      - uses: actions/checkout@v3
        with:
          submodules: recursive
      - uses: actions/setup-python@v4
        with:
          python-version: ${{ matrix.python }}
      - name: Install packages
        run: |
          pip install pytest
          pip install --no-cache-dir .[test]
          pip install --no-cache-dir .
      - name: Run test suite with pytest
        run: |
          pytest tests/


test-webapp

name: test-webapp
on: [push, pull_request]
jobs:
  compile-and-test:
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v3
        with:
          submodules: recursive
      - uses: actions/setup-python@v4
        with:
          python-version: "3.10"
      - uses: actions/setup-node@v3
        with:
          node-version: "20"
          cache: "npm"
          cache-dependency-path: "asreview/webapp/package-lock.json"
      - name: Get Tags
        run: |
          git fetch --prune --unshallow --tags
          git tag
      - name: Compile assets
        run: |
          python setup.py compile_assets
      - name: Install pytest and package
        run: |
          pip install pytest pytest-random-order pytest-xdist
          pip install --no-cache-dir .
      - name: Test flask web app
        run: |
          pytest --random-order -n 6 asreview/webapp/tests


Docker deployment

name: Docker deployment

on:
  push:
    tags:
      - "v*"
  pull_request:
    paths:
      - "Dockerfile"
      - ".github/workflows/docker.yml"

jobs:
  docker:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@v3
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v2
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Build the image for testing
        uses: docker/build-push-action@v4
        with:
          context: .
          load: true
          tags: asreview/asreview:test
      - name: Test the built image
        run: |
          docker run asreview/asreview:test -h

      - name: Docker meta
        id: meta
        if: github.event_name != 'pull_request'
        uses: docker/metadata-action@v4
        with:
          images: ghcr.io/asreview/asreview
      - name: Login to GitHub registry
        if: github.event_name != 'pull_request'
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and, if it is not a pull request, push to Docker Hub
        uses: docker/build-push-action@v4
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}


Docs render check

name: "Docs render check"
on: [push, pull_request]

jobs:
  docs:
    runs-on: macos-latest
    steps:
      - name: Clone repo
        uses: actions/checkout@v3
      - name: Install pandoc
        run: |
          brew install pandoc
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: "3.10"
      - name: Install ASReview with docs dependencies
        run: |
          python -m pip install .[docs]
      - name: Build HTML
        run: |
          python -m sphinx -W --keep-going --color docs/source/ build/html/


test-extensions

name: test-extensions
on: [push, pull_request]
jobs:
  test-asreview-datatools:
    name: test-asreview-datatools
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-python@v4
        with:
          python-version: "3.10"
      - name: Install packages
        run: |
          pip install pytest
          pip install --no-cache-dir .
      - name: Install extension
        run: |
          git clone https://github.com/asreview/asreview-datatools
          cd asreview-datatools
          latestTag=$(git describe --tags `git rev-list --tags --max-count=1`)
          git checkout $latestTag
          pip install .
      - name: Run test on asreview-datatools
        run: |
          pytest asreview-datatools/tests/
  test-asreview-insights:
    name: test-asreview-insights
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-python@v4
        with:
          python-version: "3.10"
      - name: Install packages
        run: |
          pip install pytest
          pip install --no-cache-dir .
      - name: Install extension
        run: |
          git clone https://github.com/asreview/asreview-insights
          cd asreview-insights
          latestTag=$(git describe --tags `git rev-list --tags --max-count=1`)
          git checkout $latestTag
          pip install .
      - name: Run test on asreview-insights
        run: |
          pytest asreview-insights/tests/
  test-asreview-wordcloud:
    name: test-asreview-wordcloud
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-python@v4
        with:
          python-version: "3.10"
      - name: Install packages
        run: |
          pip install pytest
          pip install --no-cache-dir .
      - name: Install extension
        run: |
          git clone https://github.com/asreview/asreview-wordcloud
          cd asreview-wordcloud
          latestTag=$(git describe --tags `git rev-list --tags --max-count=1`)
          git checkout $latestTag
          pip install .
      - name: Run test on asreview-wordcloud
        run: |
          pytest asreview-wordcloud/tests/


Deploy and release

name: Deploy and release

on:
  release:
    types: [published]

permissions:
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: "3.x"
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install setuptools build
      - uses: actions/setup-node@v3
        with:
          node-version: "20"
          cache: "npm"
          cache-dependency-path: "asreview/webapp/package-lock.json"
      - name: Compile assets
        run: |
          python setup.py compile_assets
      - name: Build
        run: |
          python build
      - name: Publish package
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          user: __token__
          password: ${{ secrets.pypi_password }}


name: publish_conda

on:
  workflow_dispatch: # on demand
    branches: [ master ]

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
    - name: Install dependencies
      run: |
        conda config --append channels conda-forge
        conda config --append channels giuliorossetti
    - uses: actions/checkout@v1
    - name: publish-to-conda
      uses: GiulioRossetti/conda-package-publish-action@cdlib_a
      with:
        subdir: 'conda'
        AnacondaToken: ${{ secrets.ANACONDA_TOKEN }}
        platforms: 'all' #
        override: true
        # dry_run: true


CodeQL

# For most projects, this workflow file will not need changing; you simply need
# to commit it to your repository.
#
# You may wish to alter this file to override the set of languages analyzed,
# or to provide custom queries or build logic.
#
# ******** NOTE ********
# We have attempted to detect the languages in your repository. Please check
# the `language` matrix defined below to confirm you have the correct set of
# supported CodeQL languages.
#
name: "CodeQL"

on:
  push:
    branches: [ master ]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [ master ]
  schedule:
    - cron: '28 0 * * 0'

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        language: [ 'python' ]
        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
        # Learn more:
        # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed

    steps:
    - name: Checkout repository
      uses: actions/checkout@v2

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v1
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
        # By default, queries listed here will override any specified in a config file.
        # Prefix the list here with "+" to use these queries and those in the config file.
        # queries: ./path/to/local/query, your-org/your-repo/queries@main

    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
    # If this step fails, then you should remove it and run the build manually (see below)
    #- name: Autobuild
    #  uses: github/codeql-action/autobuild@v1

    # ℹ Command-line programs to run using the OS shell.
    # 📚 https://git.io/JvXDl

    # ✏ If the Autobuild fails above, remove it and uncomment the following three lines
    #    and modify them (or add more) to build your code if your project
    #    uses a compiled language

    #- run: |
    #   make bootstrap
    #   make release

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v1


Conda skeleton from PyPi publish

name: Conda skeleton from PyPi publish

on:
  workflow_dispatch:
    branches: [master]

jobs:
  test:
    runs-on: ubuntu-latest
    name: Conda skeleton publish
    steps:
      - name: Publish conda package from PyPI package
        uses: silvxlabs/conda-skeleton-publish@v2
        with:
          pypi_package: "cdlib"
          python_version: "3.9"
          build_channels: "conda-forge giuliorossetti"
          upload_channel: "giuliorossetti"
          access_token: ${{ secrets.ANACONDA_TOKEN }}
          stable: true


Greetings

name: Greetings

on: [pull_request, issues]

jobs:
  greeting:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/first-interaction@v1
      with:
        repo-token: ${{ secrets.GITHUB_TOKEN }}
        issue-message: 'Thanks for submitting your first issue!'
        pr-message: 'Thanks for submitting your first pull request!'


Python Package using Conda

name: Python Package using Conda

on:
  push:
    branches: [ master ]
  workflow_dispatch:
    branches: [ master ]

jobs:
  build-linux:
    runs-on: ubuntu-latest
    strategy:
      max-parallel: 5

    steps:
    - uses: actions/checkout@v3
    - uses: actions/setup-python@v4
      with:
          python-version: 3.9
    - name: Add conda to system path
      run: |
        # $CONDA is an environment variable pointing to the root of the miniconda directory
        echo $CONDA/bin >> $GITHUB_PATH
    - name: Install conda-forge dependencies
      run: |
        conda config --append channels giuliorossetti
        conda config --append channels conda-forge
        conda config --set channel_priority flexible
        # conda config --set channel_priority false

        conda install python=3.9
        conda install pulp flake8
        conda env update --file environment.yml --name base

    - name: Lint with flake8
      run: |
        # stop the build if there are Python syntax errors or undefined names
        flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
        # exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide
        flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
    - name: Test with pytest
      run: |
        pip install pytest pytest-cov
        pip install coveralls
        pytest


Test and Coverage (Ubuntu)

# This workflow will install Python dependencies, run tests and lint with a variety of Python versions
# For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions

name: Test and Coverage (Ubuntu)

on:
  push:
    branches: [ master ]
  pull_request:
    branches: [ master ]

jobs:
  build:

    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ['3.10']

    steps:
    - uses: actions/checkout@v2
    - uses: conda-incubator/setup-miniconda@v2
      with:
        auto-update-conda: true
        python-version: ${{ matrix.python-version }}

    - name: Install system libraries
      run: |
        sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-key 612DEFB798507F25
        sudo add-apt-repository -y "https://downloads.skewed.de/apt jammy main"
        sudo apt-get install -y python3-pip libcairo2-dev python3-graph-tool

        sudo apt-get install -y libgmp3-dev libmpfr-dev libmpc-dev wget bzip2 build-essential libxcursor-dev libglib2.0-dev

  # sudo apt-get install -y libgmp3-dev
  # sudo apt-get install -y libmpfr-dev
  # sudo apt-get install -y libmpc-dev
  # sudo apt-get install -y graph-tool

    - name: Install pip dependencies
      run: |

        python -m pip install --upgrade pip
        pip install -r requirements.txt
        pip install -r requirements_optional.txt
        pip install .
        python -m pip install flake8 pytest
        pip install shuffle_graph>=2.1.0 similarity-index-of-label-graph>=2.0.1 ASLPAw>=2.1.0
        pip install pytest pytest-cov
        pip install coveralls

    - name: Lint with flake8
      run: |
        # stop the build if there are Python syntax errors or undefined names
        flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
        # exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide
        flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics

    - name: Test with pytest
      run: |
        pytest --cov-config=.coveragerc --cov=./ --cov-report=xml

    - name: codecov
      uses: codecov/codecov-action@v1


Upload Python Package

# This workflow will upload a Python Package using Twine when a release is created
# For more information see: https://help.github.com/en/actions/language-and-framework-guides/using-python-with-github-actions#publishing-to-package-registries

# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

name: Upload Python Package

on:
  release:
    types: [published]
  workflow_dispatch:
      branches: [ master ]

jobs:
  deploy:

    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v2
    - name: Set up Python
      uses: actions/setup-python@v2
      with:
        python-version: '3.x'
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install build

    - name: Build package
      run: python -m build

   # - name: Publish distribution 📦 to Test PyPI
   #   uses: pypa/gh-action-pypi-publish@master
   #   with:
   #     user: __token__
   #     password: ${{ secrets.TEST_PYPI_API_TOKEN }}
   #     repository_url: https://test.pypi.org/legacy/

    - name: Publish distribution 📦 to PyPI
      if: startsWith(github.ref, 'refs/tags')
      uses: pypa/gh-action-pypi-publish@master
      with:
        user: __token__
        password: ${{ secrets.PYPI_API_TOKEN }}


GitSync

name: GitSync

on:
  - push
  - delete

jobs:
  sync:
    runs-on: ubuntu-latest
    name: Git Repo Sync
    steps:
    - uses: actions/checkout@v2
      with:
        fetch-depth: 0
    - uses: vertexproject/git-repo-sync@v0.1.0
      with:
        target-url: https://${{ secrets.SYNC_TARGET_HOST }}/${{ github.repository }}.git
        target-username: ${{ secrets.SYNC_TARGET_USERNAME }}
        target-token: ${{ secrets.SYNC_TARGET_TOKEN }}


build

name: build

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

jobs:
  build:
    if: "!contains(github.event.pull_request.labels.*.name, 'docs-only')"
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        python: ["3.9", "3.10", "3.11", "3.12"]

    steps:
      - uses: compas-dev/compas-actions.build@v4
        with:
          invoke_lint: true
          invoke_test: true
          python: ${{ matrix.python }}


docs

name: docs

on:
  push:
    branches:
      - main
    tags:
      - 'v*'
  pull_request_review:
    types: [submitted]

jobs:
  docs:
    if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'pull_request_review' && github.event.review.state == 'approved')
    runs-on: ubuntu-latest
    steps:
      - uses: compas-dev/compas-actions.docs@v3
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          doc_url: https://compas.dev/compas


ironpython

name: ironpython

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

jobs:
  build:
    name: windows-ironpython
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v2
      - name: "[RPC tests] Set up CPython 3.9"
        uses: actions/setup-python@v2
        with:
          python-version: 3.9
      - name: "[RPC tests] Install CPython dependencies"
        run: |
          python -m pip install --upgrade pip
      - name: "[RPC tests] Install COMPAS on CPython"
        run: |
          pip install --no-cache-dir .
      - name: Install dependencies
        run: |
          choco install ironpython --version=2.7.8.1
          curl -o ironpython-pytest.tar.gz -LJO https://pypi.debian.net/ironpython-pytest/latest
          ipy -X:Frames -m ensurepip
          ipy -X:Frames -m pip install --no-deps ironpython-pytest.tar.gz
      - uses: NuGet/setup-nuget@v1.0.5
      - name: Install dependencies
        run: |
          choco install ironpython --version=2.7.8.1
      - uses: compas-dev/compas-actions.ghpython_components@v2
        with:
          source: src/compas_ghpython/components
          target: src/compas_ghpython/components
      - name: Test import
        run: |
          ipy -m compas
        env:
          IRONPYTHONPATH: ./src
      - name: Run tests
        run: |
          ipy tests/ipy_test_runner.py
        env:
          IRONPYTHONPATH: ./src


verify-pr-checklist

name: verify-pr-checklist
on:
  pull_request:
    types: [assigned, opened, synchronize, reopened, labeled, unlabeled]
    branches:
      - main
      - master

jobs:
  build:
    name: Check Actions
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v1
      - name: Changelog check
        uses: Zomzog/changelog-checker@v1.2.0
        with:
          fileName: CHANGELOG.md
          checkNotification: Simple
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}


Create Release

on:
  push:
    tags:
      - "v*"

name: Create Release

jobs:
  build:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        python: ["3.9", "3.10", "3.11", "3.12"]

    steps:
      - uses: compas-dev/compas-actions.build@v4
        with:
          invoke_lint: true
          invoke_test: true
          python: ${{ matrix.python }}
          check_import: true

  publish:
    needs: build
    runs-on: windows-latest
    steps:
      - uses: compas-dev/compas-actions.publish@v3
        with:
          pypi_token: ${{ secrets.PYPI }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          build_ghpython_components: true
          gh_source: src/compas_ghpython/components
          gh_target: src/compas_ghpython/components/ghuser
          release_name_prefix: COMPAS


CodeQL

name: "CodeQL"

on:
  push:
    branches: [ master ]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [ master ]
  schedule:
    - cron: '18 14 * * 2'

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        language: [ 'python' ]
        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
        # Learn more about CodeQL language support at https://git.io/codeql-language-support

    steps:
    - name: Checkout repository
      uses: actions/checkout@v3

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v2
      with:
        config-file: ./.github/codeql-config.yml
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
        # By default, queries listed here will override any specified in a config file.
        # Prefix the list here with "+" to use these queries and those in the config file.
        # queries: ./path/to/local/query, your-org/your-repo/queries@main

    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
    # If this step fails, then you should remove it and run the build manually (see below)
    - name: Autobuild
      uses: github/codeql-action/autobuild@v2

    # ℹ Command-line programs to run using the OS shell.
    # 📚 https://git.io/JvXDl

    # ✏ If the Autobuild fails above, remove it and uncomment the following three lines
    #    and modify them (or add more) to build your code if your project
    #    uses a compiled language

    #- run: |
    #   make bootstrap
    #   make release

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v2


keylime-container-images

name: keylime-container-images

on:
  push:
    branches:
      - master
    tags:
      - "v*"
  workflow_dispatch:
    branches:
      - master

env:
  REGISTRY: quay.io
  IMAGE_BASE: quay.io/keylime

jobs:
  build-images:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Log in to the Container registry
        uses: docker/login-action@v2
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ secrets.QUAY_USER }}
          password: ${{ secrets.QUAY_TOKEN }}

      - name: Generate docker metadata for keylime_base
        id: meta_base
        uses: docker/metadata-action@v4
        with:
          images: |
            ${{ env.IMAGE_BASE }}/keylime_base
          tags: |
            type=ref,enable=true,priority=600,prefix=,suffix=,event=branch
            type=ref,enable=true,priority=600,prefix=,suffix=,event=tag
            type=sha,prefix=sha-

      - name: Generate docker metadata for keylime_verifier
        id: meta_verifier
        uses: docker/metadata-action@v4
        with:
          images: |
            ${{ env.IMAGE_BASE }}/keylime_verifier
          tags: |
            type=ref,enable=true,priority=600,prefix=,suffix=,event=branch
            type=ref,enable=true,priority=600,prefix=,suffix=,event=tag
            type=sha,prefix=sha-

      - name: Generate docker metadata for keylime_registrar
        id: meta_registrar
        uses: docker/metadata-action@v4
        with:
          images: |
            ${{ env.IMAGE_BASE }}/keylime_registrar
          tags: |
            type=ref,enable=true,priority=600,prefix=,suffix=,event=branch
            type=ref,enable=true,priority=600,prefix=,suffix=,event=tag
            type=sha,prefix=sha-

      - name: Generate docker metadata for keylime_tenant
        id: meta_tenant
        uses: docker/metadata-action@v4
        with:
          images: |
            ${{ env.IMAGE_BASE }}/keylime_tenant
          tags: |
            type=ref,enable=true,priority=600,prefix=,suffix=,event=branch
            type=ref,enable=true,priority=600,prefix=,suffix=,event=tag
            type=sha,prefix=sha-

      - name: Prepare dockerfiles
        run: |
          cd docker/release && ./generate-files.sh "${{ steps.meta_base.outputs.version }}" "${{ env.IMAGE_BASE }}/"

      - name: Build and push base
        id: build_base
        uses: docker/build-push-action@v4
        with:
          context: .
          file: docker/release/base/Dockerfile
          push: true
          tags: ${{ steps.meta_base.outputs.tags }}
          labels: ${{ steps.meta_base.outputs.labels }}

      - name: Build and push registrar
        id: build_registrar
        uses: docker/build-push-action@v4
        with:
          context: .
          file: docker/release/registrar/Dockerfile
          push: true
          tags: ${{ steps.meta_registrar.outputs.tags }}
          labels: ${{ steps.meta_registrar.outputs.labels }}

      - name: Build and push verifier
        id: build_verifier
        uses: docker/build-push-action@v4
        with:
          context: .
          file: docker/release/verifier/Dockerfile
          push: true
          tags: ${{ steps.meta_verifier.outputs.tags }}
          labels: ${{ steps.meta_verifier.outputs.labels }}

      - name: Build and push tenant
        id: build_tenant
        uses: docker/build-push-action@v4
        with:
          context: .
          file: docker/release/tenant/Dockerfile
          push: true
          tags: ${{ steps.meta_tenant.outputs.tags }}
          labels: ${{ steps.meta_tenant.outputs.labels }}


Greetings

name: Greetings

on: [pull_request, issues]

jobs:
  greeting:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/first-interaction@v1
      continue-on-error: true
      with:
        repo-token: ${{ secrets.GITHUB_TOKEN }}
        issue-message: 'Thank you for reporting your first issue. If the issue relates to a change you intend to work on, please ask that someone assign it to you.'
        pr-message: 'Thanks for your PR. Please check the CI jobs to make sure the build passes and fix any failures. If you have any questions, please ask and many thanks for your contribution!'


pypi-release

name: pypi-release

on:
  release:
    types:
      - released

jobs:
  release:
    name: release
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@master
      - name: Set up Python 3.10
        uses: actions/setup-python@v2
        with:
          python-version: "3.10"

      - name: Install pypa/build
        run: >-
          python -m
          pip install
          build
          --user
      - name: Build a binary wheel and a source tarball
        run: >-
          python -m
          build
          --sdist
          --wheel
          --outdir dist/
          .

      - name: Publish a Python distribution to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          user: __token__
          password: ${{ secrets.PYPI_API_TOKEN }}


name: Upload code coverage for a merged PR to codecov.io

on:
  push:
    branches:
    - master

jobs:
  build:
    runs-on: ubuntu-22.04
    name: Submit code coverage from merged PR
    steps:
    - uses: actions/checkout@v3
    - name: Install testing-farm script
      run: pip3 -v install tft-cli
    - name: Run tests on Testing Farm
      run: testing-farm request --context distro=fedora-39 --arch x86_64 --compose Fedora-39 --plan '/e2e-with-revocation' -e UPLOAD_COVERAGE=1 2>&1 | tee tt_output
      env:
        TESTING_FARM_API_TOKEN: ${{ secrets.TESTING_FARM_API_TOKEN }}
    - name: Find PR Packit tests to finish and download coverage.xml file
      run: grep -q 'tests passed' tt_output && sleep 20 && scripts/download_packit_coverage.sh --testing-farm-log tt_output
      env:
        MAX_DURATION: 120
        SLEEP_DELAY: 20
    - name: List downloaded files
      run: ls coverage*
    - name: Upload coverage.unittests.xml report to Codecov with GitHub Action
      uses: codecov/codecov-action@v2
      with:
        files: coverage.unittests.xml
        flags: unittests
    - name: Upload coverage.testsuite.xml report to Codecov with GitHub Action
      uses: codecov/codecov-action@v2
      with:
        files: coverage.testsuite.xml
        flags: testsuite
    - name: Upload coverage.packit.xml report to Codecov with GitHub Action
      uses: codecov/codecov-action@v2
      with:
        files: coverage.packit.xml
        flags: packit-e2e


name: PR code coverage measurement on codecov.io

on: [pull_request]

jobs:
  build:
    runs-on: ubuntu-latest
    continue-on-error: true
    name: Submit code coverage from Packit tests
    defaults:
      run:
        working-directory: scripts
    steps:
    - uses: actions/checkout@v3
    - name: Wait for Packit tests to finish and download coverage.xml file
      run: ./download_packit_coverage.sh
      env:
        MAX_DURATION: 5400
        SLEEP_DELAY: 120
    - name: List downloaded files
      run: ls coverage*
    - name: Upload coverage.unittests.xml report to Codecov with GitHub Action
      uses: codecov/codecov-action@v2
      with:
        files: scripts/coverage.unittests.xml
        flags: unittests
    - name: Upload coverage.testsuite.xml report to Codecov with GitHub Action
      uses: codecov/codecov-action@v2
      with:
        files: scripts/coverage.testsuite.xml
        flags: testsuite
    - name: Upload coverage.packit.xml report to Codecov with GitHub Action
      uses: codecov/codecov-action@v2
      with:
        files: scripts/coverage.packit.xml
        flags: packit-e2e


test

name: test

on:
  pull_request:
    paths:
      - 'keylime/**'
      - 'test/**'
      - 'test-data/**'
  workflow_dispatch:

jobs:
  style-checks:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3
    - uses: actions/setup-python@v3
    - uses: pre-commit/action@v3.0.0
  tpm-tests:
    runs-on: ubuntu-latest
    container:
      image: quay.io/keylime/keylime-ci:latest
      options: --user root --mount type=tmpfs,destination=/var/lib/keylime/,tmpfs-mode=1770
      env:
        KEYLIME_TEST: True
    steps:
    - name: Checkout
      uses: actions/checkout@v2
    - name: Run tests
      run: .ci/test_wrapper.sh
  lint:
    runs-on: ubuntu-latest
    container:
      image: quay.io/keylime/keylime-ci:latest
      options: --user root --mount type=tmpfs,destination=/var/lib/keylime/,tmpfs-mode=1770
      env:
        KEYLIME_TEST: True
    steps:
    - name: Checkout
      uses: actions/checkout@v2
    - name: Install build dependencies
      run: sudo dnf -y install swig
    - name: Install Python dependencies
      run: sudo dnf -y install python3.6 tox python3-pip
    - name: Run lints
      run: tox -vv -e 'pylint,pylint36'
    - name: Run mypy
      run: tox -vv -e 'mypy'
    - name: Run pyright
      run: tox -vv -e 'pyright'


Check markdown partials

name: Check markdown partials
# Checks for invalid markdown partials
on:
  pull_request:
    paths:
    - '**/*.md'

jobs:
  changed-files:
    runs-on: ubuntu-latest
    outputs:
      md: ${{ steps.changes.outputs.md }}
    steps:
    - uses: actions/checkout@v3
      with:
        fetch-depth: 0

    - name: Set up Python
      uses: actions/setup-python@v4
      with:
        python-version: '3.10'

    - name: Output changed files
      id: changes
      run: >-
        echo "::set-output name=md::$(
          git diff --name-only --diff-filter=ACMRT ${{ github.event.pull_request.base.sha }} ${{ github.sha }} |
          grep .md$ |
          xargs
        )"

    - name: Check for invalid partials
      run: |
        echo ${{ steps.changed-files.outputs.md }}
        python .github/workflows/check_partials.py --files='${{ steps.changes.outputs.md }}'


CodeQL

name: "CodeQL"

on:
  push:
    branches: [ master ]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [ master ]

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        language: [ 'python' ]
        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
        # Learn more about CodeQL language support at https://git.io/codeql-language-support

    steps:
    - name: Checkout repository
      uses: actions/checkout@v3

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v2
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
        # By default, queries listed here will override any specified in a config file.
        # Prefix the list here with "+" to use these queries and those in the config file.
        # queries: ./path/to/local/query, your-org/your-repo/queries@main

    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
    # If this step fails, then you should remove it and run the build manually
    - name: Autobuild
      uses: github/codeql-action/autobuild@v2

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v2


Master

name: Master

on:
  push:
    branches:
    - master

jobs:
  test:
    uses: ./.github/workflows/test-all.yml
    with:
      repo: extras

      # Options
      standard: true
    secrets: inherit

  publish-test-results:
    needs:
    - test
    if: success() || failure()
    concurrency:
      group: test-results

    uses: DataDog/integrations-core/.github/workflows/test-results-master.yml@master
    secrets: inherit


PR

name: PR

on:
  pull_request:
    branches:
    - master

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.head_ref }}
  cancel-in-progress: true

jobs:
  test:
    uses: DataDog/integrations-core/.github/workflows/pr-test.yml@master
    with:
      repo: extras
      python-version: "3.11"
    secrets: inherit


Publish test results for PRs

name: Publish test results for PRs

on:
  workflow_run:
    workflows:
    - PR
    types:
    - completed

jobs:
  publish:
    uses: DataDog/integrations-core/.github/workflows/test-results-pr.yml@master
    if: github.event.workflow_run.conclusion != 'skipped'
    permissions:
      checks: write
      pull-requests: write
    secrets: inherit


Test Agent release

name: Test Agent release

on:
  workflow_dispatch:
    inputs:
      test-py3:
        required: false
        description: Run Python 3 tests
        default: true
        type: boolean
      agent-image:
        required: false
        description: Agent 7 image
        default: "datadog/agent:7-rc"
        type: string
      agent-image-windows:
        required: false
        description: Agent 7 image on Windows
        default: "datadog/agent:7-rc-servercore"
        type: string
      test-py2:
        required: false
        description: Run Python 2 tests
        default: true
        type: boolean
      agent-image-py2:
        required: false
        description: Agent 6 image
        default: "datadog/agent:6-rc"
        type: string
      agent-image-windows-py2:
        required: false
        description: Agent 6 image on Windows
        default: "datadog/agent-dev:master-py2-win-servercore"
        type: string

jobs:
  test:
    uses: ./.github/workflows/test-all.yml
    with:
      repo: extras

      # Options
      standard: true
      test-py2: ${{ inputs.test-py2 }}
      test-py3: ${{ inputs.test-py3 }}
      agent-image: "${{ inputs.agent-image }}"
      agent-image-py2: "${{ inputs.agent-image-py2 }}"
      agent-image-windows: "${{ inputs.agent-image-windows }}"
      agent-image-windows-py2: "${{ inputs.agent-image-windows-py2 }}"
    secrets: inherit