argon2-cffi-bindings/.github/workflows/ci.yml

---
name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

env:
  FORCE_COLOR: "1" # Make tools pretty.
  PIP_DISABLE_PIP_VERSION_CHECK: 1
  PIP_NO_PYTHON_VERSION_WARNING: 1
  SETUPTOOLS_SCM_PRETEND_VERSION: "1.0" # avoid warnings about shallow checkout

permissions: {}

jobs:
  tests:
    name: Tests on ${{ matrix.python-version }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version:
          - "3.9"
          - "3.10"
          - "3.11"
          - "3.12"
          - "3.13"
          - "3.14"
          - "3.14t"
          - "pypy-3.9"
          - "pypy-3.10"
          - "pypy-3.11"
    env:
      PYTHON: ${{ matrix.python-version }}

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
          persist-credentials: false
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: ${{ matrix.python-version }}
          allow-prereleases: true
          cache: pip
      - run: python -Im pip install tox
      - run: python -Im tox run -e $PYTHON

  system-package:
    runs-on: ubuntu-latest
    name: Install and test with system package of Argon2

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version-file: .python-version-default
          cache: pip

      - name: Install dependencies
        run: |
          sudo apt-get install libargon2-1 libargon2-dev
          # Ensure we cannot use our own Argon2 by accident.
          rm -rf extras          
      - run: python -Im pip install tox
      - run: python -Im tox run -e system-argon2

  package:
    name: Build & verify package
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
          persist-credentials: false
      - uses: hynek/build-and-inspect-python-package@efb823f52190ad02594531168b7a2d5790e66516 # v2.14.0
        id: baipp

      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          cache: pip
          python-version: "3.x"  # use the one that baipp used

      # Smoke-check the wheel against argon2-cffi.
      - run: python -Im pip install $DIST/*.whl
        env:
          DIST: ${{ steps.baipp.outputs.dist }}
      - run: python -Im pip install --no-deps git+https://github.com/hynek/argon2-cffi.git
      - run: python -Im argon2 -n 1 -t 1 -m 8 -p 1

  install-dev:
    name: Verify dev env
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
          persist-credentials: false
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version-file: .python-version-default
      - run: python -Im pip install -e . --group dev

      - name: Import package
        run: python -c 'from _argon2_cffi_bindings import ffi, lib; print(lib.ARGON2_VERSION_NUMBER)'
      - run: otool -L src/_argon2_cffi_bindings/_ffi.abi3.so
        if: startsWith(matrix.os , 'macos')
      - run: ldd src/_argon2_cffi_bindings/_ffi.abi3.so
        if: startsWith(matrix.os , 'ubuntu')

      - name: Check presence of pytest
        run: pytest --version

  cog-check:
    name: Ensure cogified files are up-to-date
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
          persist-credentials: false
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          cache: pip
          python-version: "3.x"

      - run: python -Im pip install tox

      - run: python -Im tox run -e cog-check

  required-checks-pass:
    name: Ensure everything required is passing for branch protection
    if: always()

    needs:
      - tests
      - install-dev
      - package
      - system-package
      - cog-check

    runs-on: ubuntu-latest

    steps:
      - name: Decide whether the needed jobs succeeded or failed
        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe  # v1.2.2
        with:
          jobs: ${{ toJSON(needs) }}