build.yml

name: Build

on:
  workflow_dispatch:
  push:
    branches:
      - main
  pull_request:


permissions:
  contents: read

jobs:
  build:
    permissions:
      contents: read  # for actions/checkout to fetch code
      pull-requests: read  # for SonarSource/sonarcloud-github-action to determine which PR to decorate
    name: Build
    strategy:
      matrix:
        python-version: [ "3.9", "3.10", "3.11", "3.12" ]
        os: [ ubuntu-latest, macos-latest, windows-latest ]
    runs-on: ${{ matrix.os }}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis

      - name: Setup Python ${{ matrix.python-version }}
        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
        with:
          python-version: ${{ matrix.python-version }}

      - name: Setup Poetry
        uses: abatilo/actions-poetry@0dd19c9498c3dc8728967849d0d2eae428a8a3d8 # v4

      - name: Setup environment
        run: poetry install

      - name: Run Tests
        run: poetry run pytest --cov klimalogger --cov-report xml --cov-report term --junitxml=junit.xml tests

      - name: Build
        run: poetry build

      - name: SonarCloud Scan
        if: matrix.python-version == '3.10' && matrix.os == 'ubuntu-latest'
        uses: SonarSource/sonarqube-scan-action@v4.2.1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}