# Licensed under the Apache License: http://www.apache.org/licenses/LICENSE-2.0
# For details: https://github.com/coveragepy/coveragepy/blob/main/NOTICE.txt

name: "Publish"

on:
  repository_dispatch:
    # Triggered with `make` targets:
    types:
      - publish-testpypi    # `make test_upload`
      - publish-pypi        # `make pypi_upload`

defaults:
  run:
    shell: bash

env:
  # PYVERSIONS: changing the list of versions will change the number of
  # expected distributions. This must match the same number in kit.yml.
  EXPECTED: 106

permissions:
  contents: read

concurrency:
  group: "${{ github.workflow }}-${{ github.ref }}"
  cancel-in-progress: true

jobs:
  find-run:
    name: "Find latest kit.yml run"
    runs-on: ubuntu-latest
    outputs:
      run-id: ${{ steps.run-id.outputs.run-id }}

    steps:
      - name: "Find latest kit.yml run"
        id: runs
        uses: octokit/request-action@b91aabaa861c777dcdb14e2387e30eddf04619ae # v3.0.0
        with:
          route: GET /repos/coveragepy/coveragepy/actions/workflows/kit.yml/runs
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: "Record run id"
        id: run-id
        env:
          RUN_STATUS: ${{ fromJson(steps.runs.outputs.data).workflow_runs[0].status }}
          RUN_CONCLUSION: ${{ fromJson(steps.runs.outputs.data).workflow_runs[0].conclusion }}
          RUN_ID: ${{ fromJson(steps.runs.outputs.data).workflow_runs[0].id }}
        run: |
          # There must be a shorter way to write this...
          [ "$RUN_STATUS" = "completed" ] || exit 1
          [ "$RUN_CONCLUSION" = "success" ] || exit 1
          echo "run-id=$RUN_ID" >> "$GITHUB_OUTPUT"

  publish-to-test-pypi:
    name: "Publish to Test PyPI"
    if: ${{ github.event.action == 'publish-testpypi' }}
    permissions:
      id-token: write       # needed for actions/attest-build-provenance
      attestations: write   # needed for actions/attest-build-provenance
    runs-on: ubuntu-latest
    environment:
      name: "testpypi"
      deployment: false
    needs:
      - find-run

    steps:
      - name: "Download dists"
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          repository: "coveragepy/coveragepy"
          run-id: ${{ needs.find-run.outputs.run-id }}
          github-token: ${{ secrets.GITHUB_TOKEN }}
          pattern: "dist-*"
          merge-multiple: true
          path: "dist/"

      - name: "What did we get?"
        run: |
          ls -alR
          echo "Number of dists, should be $EXPECTED:"
          find dist/* | wc -l
          files=$(find dist/* 2>/dev/null | wc -l) && [ "$files" -eq "$EXPECTED" ] || exit 1

      - name: "Generate attestations"
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
        with:
          subject-path: "dist/*"

      - name: "Publish dists to Test PyPI"
        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
        with:
          repository-url: https://test.pypi.org/legacy/

  publish-to-pypi:
    name: "Publish to PyPI"
    if: ${{ github.event.action == 'publish-pypi' }}
    permissions:
      id-token: write       # needed for actions/attest-build-provenance
      attestations: write   # needed for actions/attest-build-provenance
    runs-on: ubuntu-latest
    environment:
      name: "pypi"
      deployment: false
    needs:
      - find-run

    steps:
      - name: "Download dists"
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          repository: "coveragepy/coveragepy"
          run-id: ${{ needs.find-run.outputs.run-id }}
          github-token: ${{ secrets.GITHUB_TOKEN }}
          pattern: "dist-*"
          merge-multiple: true
          path: "dist/"

      - name: "What did we get?"
        run: |
          ls -alR
          echo "Number of dists, should be $EXPECTED:"
          find dist/* | wc -l
          files=$(find dist/* 2>/dev/null | wc -l) && [ "$files" -eq "$EXPECTED" ] || exit 1

      - name: "Generate attestations"
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
        with:
          subject-path: "dist/*"

      - name: "Publish dists to PyPI"
        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
