main.yml

name: main
on:
  push:
    branches: [main]
    tags: ['*']
  schedule:
  - cron: "0 09 * * *" # Runs 11 AM UTC == 2 AM PDT
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  id-token: write
  contents: write
  pull-requests: write

jobs:
  test-python-versions:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest]
        python-version: ['3.8', '3.9', '3.10', '3.11', '3.12', '3.13']
        include:
        - os: macos-latest
          python-version: '3.13'
        - os: windows-latest
          python-version: '3.13'
    runs-on: ${{ matrix.os }}
    name: test (py${{ matrix.python-version }} ${{ matrix.os }})
    steps:
    - uses: actions/checkout@v6
      with:
        fetch-depth: 0
    - uses: astral-sh/setup-uv@v6
      with:
        version: ">=0.9.0"
    - uses: extractions/setup-just@v3
    # Fail fast if uv.lock has drifted from pyproject.toml.
    - run: uv lock --locked
    - run: just lint
    - run: uv run --python ${{ matrix.python-version }} --group test rsconnect version
    - run: just test ${{ matrix.python-version }}
    - if: github.event_name == 'pull_request' && matrix.python-version == '3.8'
      uses: orgoro/coverage@v3
      with:
        coverageFile: coverage.xml
        token: ${{ secrets.GITHUB_TOKEN }}

  prerelease-test:
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
    - uses: actions/checkout@v6
      with:
        fetch-depth: 0
    - uses: astral-sh/setup-uv@v6
      with:
        version: ">=0.9.0"
    - uses: extractions/setup-just@v3
    - run: just lint
    # --upgrade forces a fresh resolve (ignoring the lock) so prereleases are
    # actually exercised; plain `--prerelease allow` against the lock is a no-op.
    - run: uv run --upgrade --prerelease allow --group test rsconnect version
    - run: uv run --python 3.8 --upgrade --prerelease allow --group test ./scripts/runtests

  distributions:
    needs: test-python-versions
    strategy:
      matrix:
        package_name: ["rsconnect_python", "rsconnect"]
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v6
      with:
        fetch-depth: 0
    - uses: astral-sh/setup-uv@v6
      with:
        version: ">=0.9.0"
    - uses: extractions/setup-just@v3
    - run: uv sync --group test
    - name: assert tag matches pyproject version
      if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
      run: |
        tag="${GITHUB_REF_NAME}"
        ver="$(uv version --short)"
        if [ "$tag" != "$ver" ]; then
          echo "::error::tag '$tag' does not match pyproject version '$ver'"
          exit 1
        fi
    - name: assert tag is on main
      if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
      run: |
        if ! git merge-base --is-ancestor HEAD origin/main; then
          echo "::error::tag '${GITHUB_REF_NAME}' points to a commit that is not on main"
          exit 1
        fi
    - run: just dist
      env:
        PACKAGE_NAME: ${{ matrix.package_name }}
    - name: assert wheel contents
      run: |
        WHL=$(ls dist/*.whl | head -1)
        unzip -l "$WHL" | grep -q 'rsconnect/py.typed' || { echo "::error::py.typed missing from wheel"; exit 1; }
        unzip -l "$WHL" | grep -q 'rsconnect/quickstart/templates/' || { echo "::error::quickstart templates missing from wheel"; exit 1; }
        if unzip -l "$WHL" | grep -qE ' (tests/|conftest\.py)'; then echo "::error::wheel contains test files"; exit 1; fi
    - name: smoke test the built wheel
      run: |
        WHL=$(ls dist/*.whl | head -1)
        uv run --no-project --with "$WHL" rsconnect version
        uv run --no-project --with "$WHL" rsconnect --help
    - name: create github release
      uses: softprops/action-gh-release@v2
      if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags') && matrix.package_name == 'rsconnect_python'
      with:
        files: |
          dist/*.whl
        token: ${{ secrets.GITHUB_TOKEN }}
    - if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
      uses: pypa/gh-action-pypi-publish@release/v1

  docs:
    needs: test-python-versions
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v6
      with:
        fetch-depth: 0
    - uses: astral-sh/setup-uv@v6
      with:
        version: ">=0.9.0"
    - uses: extractions/setup-just@v3
    - name: build docs
      run: just docs
    - uses: actions/upload-artifact@v5
      with:
        name: docs
        path: site/
    - uses: aws-actions/configure-aws-credentials@v4
      id: creds
      with:
        role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
        aws-region: ${{ secrets.AWS_REGION }}
    - if: github.event_name == 'push' && github.ref == 'refs/heads/main'
      run: just sync-latest-docs-to-s3
    - if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
      uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ secrets.DOCS_AWS_ROLE }}
        aws-region: us-east-1
    - if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
      run: just promote-docs-in-s3

  test-connect-versions:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        version:
          - "preview"   # nightly pre-release build of Connect
          - "release"   # special value that always points to the latest Connect release
          - "2025.09.0" # jammy
          - "2025.03.0" # jammy
          - "2024.09.0" # jammy
          - "2024.03.0" # jammy
          - "2023.09.0" # jammy
          - "2023.03.0" # bionic
          - "2022.10.0" # bionic
    name: Integration tests against Connect ${{ matrix.version }}
    env:
      python-version: '3.13'
    steps:
      - uses: actions/checkout@v6
      - uses: astral-sh/setup-uv@v6
        with:
          version: ">=0.9.0"
      # Prepare the environment on the runner BEFORE entering with-connect, so
      # no build/resolve/interpreter-fetch happens over the network mid-test.
      - run: uv sync --python ${{ env.python-version }} --group test
      - run: uv run --no-sync rsconnect version
      - name: Run integration tests
        uses: posit-dev/with-connect@main
        with:
          version: ${{ matrix.version }}
          # License file valid until 2026-12-05
          license: ${{ secrets.CONNECT_LICENSE_FILE }}
          command: |
            uv run --no-sync --group test ./scripts/runtests