ci.yml

name: "CI"
on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: true
jobs:
  Lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-python@v4
        with:
          python-version: "3.11"
      - name: Install Linter
        run: |
          python -m pip install --upgrade pip
          pip install ruff black
      - name: Set up Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_wrapper: false          
      - name: Lint Check
        run: |
          make lint
      - name: Check Workflows
        run: |
          bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
          ./actionlint -color

  Analyzer:
    runs-on: ubuntu-latest
    needs: Lint
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-python@v4
        with:
          python-version: "3.11"
      - name: Run Bandit
        run: |
          python -m pip install bandit
          make analyzer-bandit
      - name: Run Semgrep
        run: |
          python -m pip install semgrep
          make analyzer-semgrep

  Docs:
    runs-on: ubuntu-latest
    needs: Lint
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@v3

      - name: Install Custodian
        uses: ./.github/composites/install
        with:
          python-version: "3.11"

      - name: Set up doc cache
        uses: actions/cache@v3
        id: sphinx
        with:
          path: |
            docs/build
            docs/source/aws/resources
            docs/source/gcp/resources
            docs/source/azure/resources
            docs/source/awscc/resources
            docs/source/tencentcloud/resources
          key: sphinx-docs-${{ runner.os }}-3.11-v2-${{ hashFiles('**/poetry.lock') }}

      - name: Build Docs
        shell: bash
        run: |
          make sphinx

      - name: Update Docs Cache
        # basically to prevent the docs cache from going stale as we're not keying
        # on its contents, on merges to main we update the cache to prevent
        # staleness.
        if: ${{ github.event_name == 'push' }}
        uses: actions/cache/save@v3
        with:
          path: |
            docs/build
            docs/source/aws/resources
            docs/source/gcp/resources
            docs/source/azure/resources
            docs/source/awscc/resources
            docs/source/tencentcloud/resources
          key: sphinx-docs-${{ runner.os }}-3.11-v2-${{ hashFiles('**/poetry.lock') }}

      - name: Deploy Docs
        if: ${{ github.event_name == 'push' }}
        uses: ./.github/composites/docs-publish
        with:
          aws-role: ${{ secrets.DOCS_PUBLISH_ROLE }}
          docs-dir: docs/build/html
          bucket-url: s3://cloudcustodian.io/docs

  Docker:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: c7n build and test
        uses: ./.github/composites/docker-build-push
        with:
          name: c7n
          push: false
          platforms: linux/amd64

  Tests:
    runs-on: "${{ matrix.os }}"
    needs: Lint
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        python-version: ["3.11"]
        include:
          - os: ubuntu-latest
            python-version: "3.10"
          - os: ubuntu-latest
            python-version: "3.9"
          - os: ubuntu-latest
            python-version: "3.8"
    steps:
      - uses: actions/checkout@v3

      - name: Set up Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_wrapper: false

      - name: Install Custodian
        uses: ./.github/composites/install
        with:
          python-version: ${{ matrix.python-version }}

      - name: Test
        shell: bash
        env:
          COV_RUN: ${{ contains(matrix.python-version, '3.10') && contains(matrix.os, 'ubuntu') }}
        run: |
          if [[ "$COV_RUN" == "true" ]]
          then
            make test-coverage COVERAGE_TYPE=term
            poetry run coverage xml
          else
            make test
          fi

      - name: Upload Code Coverage
        uses: codecov/codecov-action@v3
        if: contains(matrix.python-version, '3.10') && contains(matrix.os, 'ubuntu')
        with:
          files: ./coverage.xml
          name: codecov

      - name: License Check
        if: contains(matrix.python-version, '3.10') && contains(matrix.os, 'ubuntu')
        run: |
          poetry run python tools/dev/license-check.py