ci.yml

name: CI

on:
  push:
    branches: [master, develop]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  tests:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        include:
          - python: '2.7'
            image: python:2.7.18-buster
          - python: '3.5'
            image: python:3.5.10-buster
          - python: '3.6'
            image: python:3.6.15-buster
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
      - name: Test supported Python runtime with 100% coverage
        env:
          PYTHON_IMAGE: ${{ matrix.image }}
        run: |
          docker run --rm \
            -v "$PWD:$PWD" -w "$PWD" \
            "$PYTHON_IMAGE" sh -ec '
              python -m pip install \
                pytest==4.6.11 pytest-cov==2.12.1 coverage==5.5 \
                pep8==1.7.1 mock==3.0.5
              python -m pytest tests formatter2 --cov-report=xml:coverage.xml
            '
      - name: Upload master coverage to Coveralls
        if: matrix.python == '3.6' && github.ref == 'refs/heads/master' && github.event_name != 'pull_request'
        uses: coverallsapp/github-action@8d6379e14d29928660c4ba802d8e85393440b329 # v2.3.8
        with:
          file: coverage.xml
          format: cobertura

  # Dependabot opens against the default branch whenever target-branch is
  # absent, and its security updates ignore target-branch entirely and always
  # use the default branch. Either route lands a commit on master, which
  # re-diverges it from develop. The setting is one line of repository config
  # and nothing announces it when it changes, so assert it here.
  repo-config:
    name: Repository configuration
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          persist-credentials: false
      - name: Dependabot and the default branch both point at develop
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          default_branch="$(gh api "repos/${GITHUB_REPOSITORY}" --jq '.default_branch')"
          if [ "$default_branch" != develop ]; then
            echo "error: the default branch is '${default_branch}', not" \
              "'develop'. Dependabot security updates always open against" \
              "the default branch and cannot be redirected." >&2
            exit 1
          fi

          # The config file is optional: without it Dependabot still runs
          # security updates, and those follow the default branch checked
          # above. Once it exists, every entry has to name develop, because an
          # entry without target-branch falls back to the default branch of
          # the day rather than to develop by name.
          config=.github/dependabot.yml
          if [ ! -f "$config" ]; then
            echo "The default branch points at 'develop' and there is no" \
              "${config}, so only security updates run."
            exit 0
          fi

          entries="$(grep -c 'package-ecosystem:' "$config" || true)"
          targets="$(grep -c 'target-branch: develop' "$config" || true)"
          if [ "$entries" != "$targets" ]; then
            echo "error: ${config} declares ${entries} update(s) but" \
              "${targets} 'target-branch: develop' line(s)." >&2
            exit 1
          fi
          echo "The default branch and ${entries} Dependabot update(s) all" \
            "point at 'develop'."