pypi.yml

name: codechecker-pypi-package

# Triggers the workflow on 'release' request events.
# The pypi package will be published only on the release event.
on:
  release:
    types: [published]

permissions: read-all

jobs:
  build:
    name: Build pypi package
    runs-on: ubuntu-20.04

    steps:
      - uses: actions/checkout@v2
      - uses: actions/setup-python@v4
        with:
          python-version: '3.8'
      - uses: actions/setup-node@v1
        with:
          node-version: '16.x'

      - name: Install dependencies
        run: |
          sudo apt-get update -q
          sudo apt-get install g++ gcc-multilib

      - name: Get tag version
        if: github.event_name == 'release' && startsWith(github.ref, 'refs/tags')
        id: get_version
        run: |
          echo ::set-output name=VERSION::$(echo ${GITHUB_REF#refs/tags/v} | sed 's/-//')

      # Set package version information in the 'setup.py' file based on the
      # released git tag information.
      - name: Set version in the setup.py file
        if: github.event_name == 'release' && startsWith(github.ref, 'refs/tags')
        run: |
          sed -i "s/version=\".*\"/version=\"${{ steps.get_version.outputs.VERSION }}\"/" setup.py

      - name: Create the pypi package
        run: |
          make dist

      - uses: actions/upload-artifact@master
        with:
          name: pypi-package
          path: |
            dist
            tests/functional/binary_package/

  test:
    name: Install and test pypi package
    runs-on: ${{ matrix.os }}
    needs: build

    strategy:
      matrix:
        os: [ubuntu-20.04, macos-latest, windows-2019]

    steps:
      - uses: actions/setup-python@v4
        with:
          python-version: '3.8'

      - uses: actions/download-artifact@master
        with:
          name: pypi-package
          path: ./

      - name: "Install run-time dependencies (Linux)"
        if: ${{ matrix.os == 'ubuntu-20.04' }}
        run:
          sudo apt-get update && sudo apt-get install g++-13 clang clang-tidy cppcheck
        # https://github.com/facebook/infer/blob/main/docker/1.1.0/Dockerfile
        run:
          INFER_VERSION=v1.2.0; \
          cd /opt && \
          curl -sL \
            https://github.com/facebook/infer/releases/download/${INFER_VERSION}/infer-linux-x86_64-${INFER_VERSION}.tar.xz | \
          tar xJ && \
          rm -f /infer && \
          ln -s ${PWD}/infer-linux-x86_64-$INFER_VERSION /infer

      - name: "Install run-time dependencies (OSX)"
        if: ${{ matrix.os == 'macos-10.15' }}
        run:
          brew install llvm cppcheck g++-13 infer

      - name: "Install run-time dependencies (Windows)"
        if: ${{ matrix.os == 'windows-2019' }}
        shell: powershell
        run: |
          choco install llvm;
          choco install --ignore-package-exit-codes cppcheck;
          echo "C:\Program Files\LLVM\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append

      - name: "Install pypi package"
        shell: bash
        run: |
          pip install wheel pytest
          pip install dist/codechecker-*.tar.gz

      - name: "Test CodeChecker commands"
        run: |
          pytest tests/functional/binary_package/

  # FIXME: This was disabled because it was not working. We have to make sure
  # that the token is appropriate. This automatic publishing is also dangerous,
  # because there is no way to recover a broken release if PyPI is tainted
  # (the filename will be forever locked and reserved even if we nuke a release)
  #
  # To test PyPI functionality, test.pypi.org should be used instead. That
  # could be done with **every** commit (or at least every PR pulled to master).
  # With a random enough release name (e.g., "git describe" with the commit
  # hash suffix) we could deploy to test.pypi.org every time.
  #
  # Real finalised releases should undergo manual testing first, and if
  # everything is in order, the deployment job to live PyPI should be manually
  # triggered.

  # Publish pypi package when a new CodeChecker version is released.
  # publish:
  #   name: Publish pypi package
  #   if: github.event_name == 'release'
  #   runs-on: ubuntu-20.04
  #   needs: test
  #   steps:
  #     - uses: actions/download-artifact@master
  #       with:
  #         name: pypi-package
  #         path: ./
  #
  #     - name: Publish to PyPI
  #       uses: pypa/gh-action-pypi-publish@release/v1
  #       with:
  #         user: __token__
  #         password: ${{ secrets.PYPI_TOKEN }}