# Licensed under the Apache License: http://www.apache.org/licenses/LICENSE-2.0
# For details: https://github.com/nedbat/coveragepy/blob/master/NOTICE.txt

name: "Publish"

on:
  repository_dispatch:
    # Triggered with `make` targets:
    types:
      - publish-testpypi    # `make test_upload`
      - publish-pypi        # `make pypi_upload`

defaults:
  run:
    shell: bash

env:
  # PYVERSIONS: changing the list of versions will change the number of
  # expected distributions.
  EXPECTED: 63

permissions:
  contents: read

concurrency:
  group: "${{ github.workflow }}-${{ github.ref }}"
  cancel-in-progress: true

jobs:
  find-run:
    name: "Find latest kit.yml run"
    runs-on: "ubuntu-latest"
    outputs:
      run-id: ${{ steps.run-id.outputs.run-id }}

    steps:
    - name: "Find latest kit.yml run"
      id: runs
      uses: octokit/request-action@dad4362715b7fb2ddedf9772c8670824af564f0d # v2.4.0
      with:
        route: GET /repos/nedbat/coveragepy/actions/workflows/kit.yml/runs
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: "Record run id" # zizmor: ignore[template-injection]
      id: run-id
      run: |
        # There must be a shorter way to write this...
        [ "${{ fromJson(steps.runs.outputs.data).workflow_runs[0].status}}" = "completed" ] || exit 1
        [ "${{ fromJson(steps.runs.outputs.data).workflow_runs[0].conclusion}}" = "success" ] || exit 1
        echo "run-id=${{ fromJson(steps.runs.outputs.data).workflow_runs[0].id }}" >> "$GITHUB_OUTPUT"

  publish-to-test-pypi:
    name: "Publish to Test PyPI"
    if: ${{ github.event.action == 'publish-testpypi' }}
    permissions:
      id-token: write
      attestations: write
    runs-on: "ubuntu-latest"
    environment:
      name: "testpypi"
    needs:
      - find-run

    steps:
    - name: "Download dists"
      uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
      with:
        repository: "nedbat/coveragepy"
        run-id: ${{ needs.find-run.outputs.run-id }}
        github-token: ${{ secrets.GITHUB_TOKEN }}
        pattern: "dist-*"
        merge-multiple: true
        path: "dist/"

    - name: "What did we get?"
      run: |
        ls -alR
        echo "Number of dists, should be $EXPECTED:"
        ls -1 dist | wc -l
        files=$(ls dist 2>/dev/null | wc -l) && [ "$files" -eq $EXPECTED ] || exit 1

    - name: "Generate attestations"
      uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2 # v2.2.3
      with:
        subject-path: "dist/*"

    - name: "Publish dists to Test PyPI"
      uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4
      with:
        repository-url: https://test.pypi.org/legacy/

  publish-to-pypi:
    name: "Publish to PyPI"
    if: ${{ github.event.action == 'publish-pypi' }}
    permissions:
      id-token: write
      attestations: write
    runs-on: "ubuntu-latest"
    environment:
      name: "pypi"
    needs:
      - find-run

    steps:
    - name: "Download dists"
      uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
      with:
        repository: "nedbat/coveragepy"
        run-id: ${{ needs.find-run.outputs.run-id }}
        github-token: ${{ secrets.GITHUB_TOKEN }}
        pattern: "dist-*"
        merge-multiple: true
        path: "dist/"

    - name: "What did we get?"
      run: |
        ls -alR
        echo "Number of dists, should be $EXPECTED:"
        ls -1 dist | wc -l
        files=$(ls dist 2>/dev/null | wc -l) && [ "$files" -eq $EXPECTED ] || exit 1

    - name: "Generate attestations"
      uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2 # v2.2.3
      with:
        subject-path: "dist/*"

    - name: "Publish dists to PyPI"
      uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4
