test-and-publish.yml

name: Test and Publish

on:
  pull_request:
  push:
    branches:
      - main
      - develop
      - feature-*
  schedule:
    - cron: "0 7 * * *"
  release:
    types:
      - published

jobs:
  docs-check:
    name: Docs Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install uv
        uses: astral-sh/setup-uv@v6
        with:
          version: 0.9.18
          python-version: "3.11"
          enable-cache: true
          cache-suffix: test-and-publish
          cache-dependency-glob: uv.lock
      - name: Synchronize project dependencies
        run: uv sync --group dev
      - name: Build docs with MkDocs
        run: uv run mkdocs build --strict
      - name: Upload docs preview artifact
        if: github.event_name == 'pull_request'
        uses: actions/upload-artifact@v4
        with:
          name: docs-site
          path: site/
          retention-days: 7

  tests:
    name: Tests (Python ${{ matrix.python-version }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
    permissions:
      id-token: write
      contents: read
      packages: write
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
      - name: Install uv
        uses: astral-sh/setup-uv@v6
        with:
          version: 0.9.18
          python-version: ${{ matrix.python-version }}
          enable-cache: true
          cache-suffix: test-and-publish
          cache-dependency-glob: uv.lock
      - name: Run tests with nox
        run: uvx nox --python ${{ matrix.python-version }} --session tests -- -n 5 -m "not live"
      - name: Fetch base branch for diff-cover
        if: github.event_name == 'pull_request'
        run: |
          if git rev-parse --is-shallow-repository | grep -q true; then
            git fetch --no-tags --prune origin ${{ github.base_ref }} --unshallow
          else
            git fetch --no-tags --prune origin ${{ github.base_ref }}
          fi
      - name: Run diff-cover (new code must be >= 90%)
        if: github.event_name == 'pull_request'
        run: >
          uv run diff-cover coverage/py${{ matrix.python-version }}/coverage.xml
          --compare-branch origin/${{ github.base_ref }}
          --fail-under 90
          --format markdown:coverage/py${{ matrix.python-version }}/diff-cover.md
      - name: Check client class function coverage
        run: >
          uv run python scripts/check_class_function_coverage.py
          coverage/py${{ matrix.python-version }}/coverage.json
          --class PdfRestClient
          --class AsyncPdfRestClient
          --class _FilesClient
          --class _AsyncFilesClient
          --fail-under 90
          --markdown-report coverage/py${{ matrix.python-version }}/class-function-coverage.md
      - name: Upload coverage reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: coverage-${{ matrix.python-version }}
          path: coverage/py${{ matrix.python-version }}

  live-tests:
    name: Live Tests (Python 3.11)
    if: github.event_name == 'pull_request' || github.event_name == 'schedule'
    runs-on: ubuntu-latest
    environment: ci-live
    permissions:
      id-token: write
      contents: read
      packages: write
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
      - name: Install uv
        uses: astral-sh/setup-uv@v6
        with:
          version: 0.9.18
          python-version: "3.11"
          enable-cache: true
          cache-suffix: test-and-publish
          cache-dependency-glob: uv.lock
      - name: Run live tests with nox
        run: uvx nox --python 3.11 --session tests -- -n 5 -m live
        env:
          PDFREST_API_KEY: ${{ secrets.PDFREST_API_KEY }}
      - name: Upload live coverage reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: coverage-live-3.11
          path: coverage/py3.11

  examples:
    name: Examples (Python ${{ matrix.python-version }})
    runs-on: ubuntu-latest
    environment: ci-live
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
    permissions:
      id-token: write
      contents: read
      packages: write
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
      - name: Install uv
        uses: astral-sh/setup-uv@v6
        with:
          version: 0.9.18
          python-version: ${{ matrix.python-version }}
          enable-cache: true
          cache-suffix: test-and-publish
          cache-dependency-glob: uv.lock
      - name: Run examples with nox
        run: uvx nox --python ${{ matrix.python-version }} --session examples
        env:
          PDFREST_API_KEY: ${{ secrets.PDFREST_API_KEY }}

  publish:
    name: Publish to PyPI
    needs:
      - docs-check
      - tests
      - examples
    if: github.event_name == 'release' && github.event.action == 'published'
    runs-on: ubuntu-latest
    environment: production
    permissions:
      id-token: write
      contents: read
    env:
      UV_PROJECT_ENVIRONMENT: .venv-release
      UV_TRUSTED_PUBLISHING: always
    steps:
      - uses: actions/checkout@v4
      - name: Install uv
        uses: astral-sh/setup-uv@v6
        with:
          version: 0.9.18
          enable-cache: true
          cache-suffix: pre-commit
          cache-dependency-glob: uv.lock
      - name: Restore venv cache
        uses: actions/cache@v4
        with:
          path: |
            ${{ env.UV_PROJECT_ENVIRONMENT }}
          key: ${{ runner.os }}-uv-release-${{ hashFiles('pyproject.toml') }}
      - name: Synchronize project dependencies
        run: uv sync --group dev
      - name: Build distribution artifacts
        run: uv build --python 3.11
      - name: Publish package to PyPI (Trusted Publishing)
        run: uv publish --trusted-publishing always --keyring-provider disabled