config.yml

version: "2.1"

workflows:
  test:
    jobs:
      # Build a package on every run to be confident it still works.
      - "build-wheel"

      - "unittests":
          matrix:
            parameters:
              python:
                - "python37"
                - "python38"
                - "python39"
                - "python310"

      - "codechecks":
          {}

  # Define a workflow for publishing a release.  Triggering workflows on tags
  # is complex.  For a lot of hints see
  # https://circleci.com/docs/2.0/workflows#executing-workflows-for-a-git-tag
  release:
    jobs:
      - "build-wheel":
          # Documentation states there is a requirement to have a tag filter
          # on a job is required by another job with a tag filter.  Just
          # duplicate the pypi-upload job's tag filter so we don't run if no
          # upload is happening.
          filters:
            tags:
              # Limit the wheel job to running only for release tags -
              # excluding release candidates.  We try to match things like
              # "v1.2.3" and not things like "v1.2.3a5".
              only: "/^v\\d+\\.\\d+\\.\\d+$/"
            branches:
              # And make sure it runs for no other branch pushes.
              ignore: "/.*/"
      - "pypi-upload":
          filters:
            tags:
              # Limit the upload job to running only for release tags.
              only: "/^v\\d+\\.\\d+\\.\\d+$/"
            branches:
              # And make sure it runs for no other branch pushes.
              ignore: "/.*/"
          repository: "pypi"
          requires:
            - "build-wheel"

  # Like the `release` workflow but only run on release candidate tags and
  # upload to Test PyPI.  See `release` workflow for commentary.
  release-candidate:
    jobs:
      - "build-wheel":
          filters:
            tags:
              only: "/^v\\d+\\.\\d+\\.\\d+a\\d+$/"
            branches:
              ignore: "/.*/"
      - "pypi-upload":
          filters:
            tags:
              only: "/^v\\d+\\.\\d+\\.\\d+a\\d+$/"
            branches:
              ignore: "/.*/"
          repository: "testpypi"
          requires:
            - "build-wheel"

jobs:
  codechecks:
    docker:
      # Run in a highly Nix-capable environment.
      - image: "nixos/nix:2.10.3"

    environment:
      # CACHIX_AUTH_TOKEN is manually set in the CircleCI web UI and
      # allows us to push to CACHIX_NAME.  We only need this set for
      # `cachix use` in this step.
      CACHIX_NAME: "tahoe-lafs-opensource"

      # Let us use features marked "experimental".  For example, most/all of
      # the `nix <subcommand>` forms.  And also flakes.
      NIX_CONFIG: "experimental-features = nix-command flakes"

    steps:
      - "run":
          name: "Install Basic Dependencies"
          command: |
            # We want cachix for Nix-friendly caching.  We only use these
            # tools for setting up the build environment so the exact version
            # of nixos/nixpkgs we use doesn't matter a whole lot.  The inputs
            # for the real build are pinned elsewhere.
            nix-env \
              --file https://github.com/nixos/nixpkgs/archive/nixos-22.05.tar.gz \
              --install \
              -A cachix bash

      - "run":
          name: "Cachix setup"
          # Record the store paths that exist before we did much.  There's no
          # reason to cache these, they're either in the image or have to be
          # retrieved before we can use cachix to restore from cache.
          command: |
            cachix use "${CACHIX_NAME}"

      - "checkout"

      - "run":
          name: "Prime Develop Environment"
          command: |
            nix develop --command true

      - "run":
          name: "isort"
          command: |
            nix develop --command isort src

      - "run":
          name: "black"
          command: |
            nix develop --command black src

      - "run":
          name: "mypy"
          command: |
            nix develop --command mypy src

  unittests:
    parameters:
      python:
        description: >-
          Reference the name of the Python package to build and test against.
        type: "string"
    docker:
      # Run in a highly Nix-capable environment.
      - image: "nixos/nix:2.10.3"

    environment:
      # CACHIX_AUTH_TOKEN is manually set in the CircleCI web UI and
      # allows us to push to CACHIX_NAME.  We only need this set for
      # `cachix use` in this step.
      CACHIX_NAME: "tahoe-lafs-opensource"

      # Let us use features marked "experimental".  For example, most/all of
      # the `nix <subcommand>` forms.  And also flakes.
      NIX_CONFIG: "experimental-features = nix-command flakes"

    steps:
      - "run":
          name: "Install Basic Dependencies"
          command: |
            # We want cachix for Nix-friendly caching.  We only use these
            # tools for setting up the build environment so the exact version
            # of nixos/nixpkgs we use doesn't matter a whole lot.  The inputs
            # for the real build are pinned elsewhere.
            nix-env \
              --file https://github.com/nixos/nixpkgs/archive/nixos-22.05.tar.gz \
              --install \
              -A cachix bash

      - "run":
          name: "Cachix setup"
          # Record the store paths that exist before we did much.  There's no
          # reason to cache these, they're either in the image or have to be
          # retrieved before we can use cachix to restore from cache.
          command: |
            cachix use "${CACHIX_NAME}"

      - "checkout"

      - "run":
          name: "Build"
          command: |
            nix build .#tahoe-capabilities-<<parameters.python>>

      - "run":
          name: "Test"
          command: |
            nix build .#tahoe-capabilities-<<parameters.python>>-tests

      - run:
          # Send any new store objects to cachix.
          name: "Push to Cachix"
          when: "always"
          command: |
            # Use ./result from the previous step
            nix-store -qR --include-outputs $(nix-store -qd ./result) \
                | grep -v '\.drv$' \
                | cachix push $CACHIX_NAME

  build-wheel:
    docker:
      # Run in a highly Nix-capable environment.
      - image: "nixos/nix:2.10.3"

    environment:
      # Let us use features marked "experimental".  For example, most/all of
      # the `nix <subcommand>` forms.  And also flakes.
      NIX_CONFIG: "experimental-features = nix-command flakes"

    steps:
      - "run":
          name: "Install Basic Dependencies"
          command: |
            # We want cachix for Nix-friendly caching.  We only use these
            # tools for setting up the build environment so the exact version
            # of nixos/nixpkgs we use doesn't matter a whole lot.  The inputs
            # for the real build are pinned elsewhere.
            nix-env \
              --file https://github.com/nixos/nixpkgs/archive/nixos-22.05.tar.gz \
              --install \
              -A cachix bash
      - "checkout"
      - run:
          name: "Build Wheel"
          command: |
            nix build .#wheel
            # Put the wheel in a regular directory so CircleCI doesn't get
            # confused by symlinks when it comes time to upload the wheel as
            # an artifact.
            mkdir wheels
            cp ./result/* wheels/
      - store_artifacts:
          path: "./wheels/"
      - persist_to_workspace:
          root: "./wheels/"
          paths:
            - "*"

  pypi-upload:
    parameters:
      repository:
        type: "string"

    docker:
      # Run in a highly Nix-capable environment.
      - image: "nixos/nix:2.10.3"

    environment:
      TWINE_REPOSITORY: "<< parameters.repository >>"
      TWINE_USERNAME: "__token__"

      # Let us use features marked "experimental".  For example, most/all of
      # the `nix <subcommand>` forms.  And also flakes.
      NIX_CONFIG: "experimental-features = nix-command flakes"

    steps:
      # The only reason we need the source for this step is to get flake.nix
      # that defines the shell environment we can use to upload the wheel.
      - "checkout"

      - attach_workspace:
          at: "release-workspace"

      - run:
          name: "Upload Wheel"
          command: |
            set -eux -o pipefail

            if [ "<< parameters.repository >>" = "testpypi" ]; then
              export TWINE_PASSWORD="${TESTPYPI_API_TOKEN}"
            elif [ "<< parameters.repository >>" = "pypi" ]; then
              export TWINE_PASSWORD="${PYPI_API_TOKEN}"
            else
              echo "Unknown repository: << parameters.repository >>"
              exit 1
            fi

            nix run .#twine -- upload --non-interactive release-workspace/*.whl