workflow.yaml

name: Deployment

on:
  push:
    branches:
      - main
    tags:
      - "*"
  pull_request:
    branches:
      - main

jobs:
  test:
    name: Run tests
    strategy:
      matrix:
        os: [ubuntu-latest, macos-14]

    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Nix
        uses: cachix/install-nix-action@v30
        with:
          nix_path: nixpkgs=channel:nixpkgs-24.05-darwin

      - name: Generate cache key
        run: |
          nixpkgs_hash=$(egrep -o 'archive/[0-9a-f]{40}\.tar\.gz' shell.nix | cut -d'/' -f2 | cut -d'.' -f1)
          echo "CACHE_KEY=${{ runner.os }}-$nixpkgs_hash" >> $GITHUB_ENV

      - name: Cache Nix store
        uses: actions/cache@v4
        id: nix-cache
        with:
          key: nix-${{ env.CACHE_KEY }}
          path: /tmp/nix-cache

      - name: Import Nix store cache
        if: steps.nix-cache.outputs.cache-hit == 'true'
        run: |
          nix-store --import < /tmp/nix-cache

      - name: Cache Python venv
        uses: actions/cache@v4
        with:
          key: python-${{ env.CACHE_KEY }}-${{ hashFiles('poetry.lock') }}
          path: .venv

      - name: Assert tag name matches version
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
        run: |
          nix-shell --pure --run "poetry version --short > version.txt"
          version=$(cat version.txt)
          tag_name=${{ github.ref_name }}
          if [ "$version" != "$tag_name" ]; then
            echo "Tag name mismatch: $version != $tag_name"
            exit 1
          fi

      - name: Run tests
        run: |
          nix-shell --pure --run "run-tests term"

      - name: Build distribution
        run: |
          nix-shell --pure --run "poetry build"

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: dist-${{ runner.os }}
          path: dist/

      - name: Export Nix store cache
        if: steps.nix-cache.outputs.cache-hit != 'true'
        run: |
          nix-store --export $(find /nix/store -maxdepth 1 -name '*-*') > /tmp/nix-cache

  publish-pypi:
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
    name: Publish to PyPI
    needs: test
    runs-on: ubuntu-latest

    environment:
      name: pypi
      url: https://pypi.org/p/starlette-compress
    permissions:
      id-token: write
      contents: read

    steps:
      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          name: dist-${{ runner.os }}
          path: dist/

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1

  publish-gh:
    name: Publish to GitHub Release
    needs: publish-pypi
    runs-on: ubuntu-latest

    permissions:
      id-token: write
      contents: write

    steps:
      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          name: dist-${{ runner.os }}
          path: dist/

      - name: Sign with Sigstore
        uses: sigstore/gh-action-sigstore-python@v2.1.1
        with:
          inputs: >-
            ./dist/*.tar.gz
            ./dist/*.whl

      - name: Create GitHub Release
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: >-
          gh release create
          '${{ github.ref_name }}'
          --repo '${{ github.repository }}'
          --notes ""

      - name: Upload signed artifacts
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: >-
          gh release upload
          '${{ github.ref_name }}' dist/**
          --repo '${{ github.repository }}'