ci.yml

name: Build, test and deploy LedgerWallet

on:
  workflow_dispatch:
  push:
    tags:
      - '*'
    branches:
      - master
  pull_request:
    branches:
      - master

permissions:
  id-token: write
  attestations: write

jobs:
  build_install_test:
    name: Build, install and test LedgerWallet
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python_version: ['3.9', '3.10', '3.11', '3.12', '3.13']

    steps:
    - name: Clone
      uses: actions/checkout@v3

    - name: Setup Python version
      uses: actions/setup-python@v5
      with:
        python-version: ${{ matrix.python_version }}

    - name: Update tools
      run: pip install -U pip setuptools

    - name: Install (with dependencies)
      run: pip install .

    - name: Install test dependencies
      run: pip install -r tests/unit/requirements.txt

    - name: Check that the executable runs correctly
      run: ledgerctl

    - name: Run unit tests
      run: pytest --cov ledgerwallet --cov-report term --cov-report=xml tests/unit/

    - name: Upload coverage to Codecov
      uses: codecov/codecov-action@v3
      with:
        name: codecov-ledgerwallet

  deploy:
    name: Build the Python package and deploy if needed
    runs-on: public-ledgerhq-shared-small
    needs: [build_install_test]
    steps:
    - name: Clone
      uses: actions/checkout@v3
      with:
        fetch-depth: 0

    - name: Install dependencies
      run: |
        # Needed to workaround this bug https://github.com/pypa/setuptools/issues/4759
        # To be removed when it's fixed
        pip install -U packaging

        python -m pip install pip --upgrade
        pip install build twine

    - name: Build the Python package
      run: |
        python -m build
        twine check dist/*
        echo "TAG_VERSION=$(python -c 'from ledgerwallet import __version__; print(__version__)')" >> "$GITHUB_ENV"

    - name: Display current status
      run: |
        echo "Current status is:"
        if [[ ${{ github.ref }} == "refs/tags/"* ]]; \
        then \
            echo "- Triggered from tag, will be deployed on pypi.org"; \
        else \
            echo "- Not triggered from tag, will be deployed on test.pypi.org"; \
        fi
        echo "- Tag version: ${{ env.TAG_VERSION }}"

    - name: Check version against CHANGELOG
      if: startsWith(github.ref, 'refs/tags/')
      run: |
        CHANGELOG_VERSION=$(grep -Po '(?<=## \[)(\d+\.)+[^\]]' CHANGELOG.md | head -n 1)
        if [ "${{ env.TAG_VERSION }}" == "${CHANGELOG_VERSION}" ]; \
        then \
            exit 0; \
        else \
            echo "Tag '${{ env.TAG_VERSION }}' and CHANGELOG '${CHANGELOG_VERSION}' versions mismatch!"; \
            exit 1; \
        fi

    - name: Publish Python package on test.pypi.org
      if: success() && github.event_name == 'push'
      run: python -m twine upload --repository testpypi dist/*
      env:
        TWINE_USERNAME: __token__
        TWINE_PASSWORD: ${{ secrets.TEST_PYPI_PUBLIC_API_TOKEN  }}
        TWINE_NON_INTERACTIVE: 1

    - name: Publish Python package on pypi.org
      if: success() && github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
      run: python -m twine upload dist/*
      env:
        TWINE_USERNAME: __token__
        TWINE_PASSWORD: ${{ secrets.PYPI_PUBLIC_API_TOKEN  }}
        TWINE_NON_INTERACTIVE: 1

    - name: Login to Ledger Artifactory
      if: success() && github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
      timeout-minutes: 10
      id: jfrog-login
      uses: LedgerHQ/actions-security/actions/jfrog-login@actions/jfrog-login-1

    - name: Publish Python package on Ledger Artifactory
      if: success() && github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
      run: python -m twine upload dist/*
      env:
        TWINE_REPOSITORY_URL: https://jfrog.ledgerlabs.net/artifactory/api/pypi/embedded-apps-pypi-prod-green
        TWINE_USERNAME: ${{ steps.jfrog-login.outputs.oidc-user }}
        TWINE_PASSWORD: ${{ steps.jfrog-login.outputs.oidc-token }}
        TWINE_NON_INTERACTIVE: 1

    - name: Generate library build attestations
      if: success() && github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
      timeout-minutes: 10
      uses: LedgerHQ/actions-security/actions/attest@actions/attest-1
      with:
        subject-path: dist/*

    - name: Sign library artifacts
      if: success() && github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
      timeout-minutes: 10
      uses: LedgerHQ/actions-security/actions/sign-blob@actions/sign-blob-1
      with:
        path: dist

    - name: Publish a release on the repo
      if: |
        success() &&
        github.event_name == 'push' &&
        startsWith(github.ref, 'refs/tags/')
      uses: "marvinpinto/action-automatic-releases@latest"
      with:
        automatic_release_tag: "v${{ env.TAG_VERSION }}"
        repo_token: "${{ secrets.GITHUB_TOKEN }}"
        prerelease: true
        files: |
          LICENSE
          dist/