test.yml

name: Test

on:
  pull_request:
  push:
    branches: ["**"]
  workflow_dispatch:
    inputs:
      publish_to:
        description: Where to publish
        type: choice
        required: true
        default: none
        options:
          - none
          - testpypi
          - pypi

jobs:
  test:
    # We want to run on external PRs, but not on our own internal PRs as they'll be run
    # by the push to the branch. Without this if check, checks are duplicated since
    # internal PRs match both the push and pull_request events.
    if:
      github.event_name == 'push' || github.event.pull_request.head.repo.full_name !=
      github.repository

    runs-on: ${{ matrix.os }}

    defaults:
      run:
        shell: bash -l {0}

    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]

    steps:
      - uses: actions/checkout@v6
      - name: Use Python ${{ matrix.python-version }}
        uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python-version }}

      - name: Test
        run: |
          pip install --upgrade pip
          pip install nox
          nox -s test

      - name: Upload coverage reports to Codecov
        uses: codecov/codecov-action@v6
        with:
          token: ${{ secrets.CODECOV_TOKEN }}

  publish:
    needs: [test]
    runs-on: ubuntu-latest
    if: github.event_name == 'workflow_dispatch' && inputs.publish_to != 'none'
    env:
      REPOSITORY_URL: ${{ inputs.publish_to == 'testpypi' && 'https://test.pypi.org/legacy/' || 'https://upload.pypi.org/legacy/' }}

    permissions:
      id-token: write

    steps:
      - uses: actions/download-artifact@v8
        with:
          pattern: build-*
          merge-multiple: true
          path: ${{ github.workspace }}/dist

      - name: Publish
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          repository-url: ${{ env.REPOSITORY_URL }}
          packages-dir: dist
          skip-existing: true
          print-hash: true
          verify-metadata: false