common-helper-build.yml

name: Common Helper - Build

on:
  push:
    paths:
      - .github/workflows/common-helper-build.yml
      - _common/**.py
      - _common/requirements*.txt
      - _common/tox.ini

defaults:
  run:
    shell: bash

jobs:
  security:
    name: Run Snyk to check for vulnerabilities
    if: ${{ github.ref == 'refs/heads/main' }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout sources
        uses: actions/checkout@v4

      - name: Run Snyk to check for vulnerabilities
        uses: snyk/actions/python@master
        continue-on-error: true  # To make sure that SARIF upload gets called
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --all-projects --severity-threshold=high --sarif-file-output=snyk.sarif

      - name: Upload result to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: snyk.sarif

  build:
    name: Build and test
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: [3.12, 3.11, "3.10"]
    steps:
      - name: Checkout sources
        uses: actions/checkout@v4

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r _common/requirements-build.txt

      - name: Set tox setting
        id: ToxSetting
        run: |
          if [[ "${{ matrix.python-version }}" == "3.10" ]]; then
            echo "toxenv=py310" >> $GITHUB_OUTPUT
          elif [[ "${{ matrix.python-version }}" == "3.11" ]]; then
            echo "toxenv=py311" >> $GITHUB_OUTPUT
          else
            echo "toxenv=py312" >> $GITHUB_OUTPUT
          fi

      - name: Test with tox
        working-directory: _common
        run: |
          tox -r -e ${{ steps.ToxSetting.outputs.toxenv }}

      - name: Upload coverage reports to Codecov
        run: |
          # Replace `linux` below with the appropriate OS
          # Options are `alpine`, `linux`, `macos`, `windows`
          curl -Os https://uploader.codecov.io/latest/linux/codecov
          chmod +x codecov
          ./codecov -t ${CODECOV_TOKEN}