build.yml

# Secret Variables required in GitHub secrets: TWINE_PASSWORD / TWINE_PASSWORD_TEST

name: build-python-package

on:
  push:
    branches: ["main"]
    tags: ["v*"]
    paths-ignore: ["*.md"]
  pull_request:
    branches: ["main"]
    paths-ignore: ["*.md"]
  workflow_dispatch: # Allows you to run this workflow manually from the Actions tab

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

env:
  TZ: Asia/Shanghai

jobs:
  job-ruff:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-python@v6
        with:
          python-version: "3.13"
      - run: pip install ruff && ruff check ./src

  job-semgrep:
    runs-on: ubuntu-latest
    container:
      image: semgrep/semgrep:latest
    continue-on-error: true
    if: (github.actor != 'dependabot[bot]')
    steps:
      - uses: actions/checkout@v6
      - run: |
          semgrep ci --verbose \
            --config p/ci \
            --config p/security-audit \
            --config p/python \
            --config p/javascript \
            --config p/react \
            --config p/owasp-top-ten

  build-pypi-package:
    runs-on: ubuntu-latest
    steps:
      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
      # sudo python setup.py install clean --all
      - uses: actions/checkout@v6

      - name: pip-install-test
        run: |
          sudo pip3 install -UI pip && sudo pip3 install -UI build setuptools wheel twine pyOpenSSL
          cd src
          sudo python3 -m build
          pip3 install ./dist/*.tar.gz
          aloha info
          pip3 list | sort

      - name: pypi-publish
        env:
          TWINE_PASSWORD: ${{ secrets.TWINE_PASSWORD }}
          TWINE_PASSWORD_TEST: ${{ secrets.TWINE_PASSWORD_TEST }}
        run: |
          env | sort -f && cd src && ls -alh
          sudo python3 -c "import fcntl; fcntl.fcntl(1, fcntl.F_SETFL, 0)"
          sudo python3 -m build
          ls -alh ./dist

          if [ "${GITHUB_REPOSITORY}" = "LabNow-ai/aloha-python" ] && [ "${GITHUB_REF_NAME}" = "main" ] ; then
            URL_REPOSITORY="https://upload.pypi.org/legacy/" ; P=${TWINE_PASSWORD} ;
          else
            URL_REPOSITORY="https://test.pypi.org/legacy/"   ; P=${TWINE_PASSWORD_TEST} ;
          fi
          twine upload dist/* --verbose -u "__token__" -p "${P}" --repository-url "${URL_REPOSITORY}" ;