.gitlab-ci.yml

# SPDX-FileCopyrightText: 2021 The eminus developers
# SPDX-License-Identifier: Apache-2.0
default:
  image: ghcr.io/astral-sh/uv:python3.13-bookworm-slim
variables:
  UV_SYSTEM_PYTHON: 1

stages:
  - test
  - fulltest
  - experiments
  - build
  - publish

.pytest:
  stage: test
  script:
    # Use the python3 -m prefix to make the commands work under different OS
    - python3 -m pip install .
    - python3 -m pip install pytest
    - python3 -m pytest tests/ -m "not slow"
  rules:
    - if: $CI_PIPELINE_SOURCE != "schedule"
      changes:
      - eminus/*.py
      - eminus/**/*.py
      - tests/*.py
      - tests/**/*.py

.pytest-full:
  extends: .pytest
  stage: fulltest
  rules:
    - if: $CI_COMMIT_TAG
    - when: manual
      # Allow failure in manual jobs, otherwise the pipeline status will be manual instead of passed
      # This would, e.g., block the creation of coverage reports
      allow_failure: true

.experiments:
  stage: experiments
  rules:
    - when: manual
      allow_failure: true

.build:
  extends: .pytest-full
  stage: build

############### test ###############

##### Create coverage reports #####
coverage:
  stage: test
  script:
    - uv pip install .
    - uv pip install coverage pyscf pytest
    - coverage run -m pytest tests/ --ignore=tests/examples --ignore=tests/extras
    - coverage report --precision=2
    - coverage html --precision=2
    - coverage xml
  coverage: '/TOTAL.*? (100(?:\.0+)?\%|[1-9]?\d(?:\.\d+)?\%)$/'
  artifacts:
    paths:
      - htmlcov/
    reports:
      coverage_report:
        coverage_format: cobertura
        path: coverage.xml
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH == "main"
      # Fix: Run coverage even if only the lint or pages job runs to prevent an unknown status badge
      # Reference: https://gitlab.com/gitlab-org/gitlab/-/issues/346779
      changes:
      - "*.py"
      - "**/*.py"
      - docs/*
      - docs/**/*

##### Lint Python files #####
lint:
  image: ghcr.io/astral-sh/ruff:alpine
  stage: test
  script:
    - ruff check
  rules:
    - if: $CI_PIPELINE_SOURCE != "schedule"
      changes:
      - "*.py"
      - "**/*.py"

##### Test the minimally supported versions #####
minimal:
  extends: .pytest
  image: python:3.7-slim
  before_script:
    - pip install numpy==1.17 scipy==1.6

##### Test using the newest dependency versions #####
newest:
  extends: .pytest
  script:
    - uv pip install .
    - uv pip install pytest
    - pytest tests/ -m "not slow"
  rules:
    # Only run in the dev branch since this is just a subset of the coverage test
    - if: $CI_COMMIT_BRANCH == "dev" && $CI_PIPELINE_SOURCE != "schedule"
      changes:
      - eminus/*.py
      - eminus/**/*.py
      - tests/*.py
      - tests/**/*.py

##### Type check Python files #####
typecheck:
  stage: test
  script:
    - uv pip install mypy[faster-cache] numpy
    - mypy . --disable-error-code="import-not-found" --disable-error-code="unused-ignore"
  rules:
    - if: $CI_PIPELINE_SOURCE != "schedule"
      changes:
      - "*.py"
      - "**/*.py"

############### fulltest ###############

##### Test the docker build #####
docker:
  extends: .pytest-full
  image: docker:latest
  services:
    - docker:dind
  script:
    # Use sed to get the version since CI_COMMIT_TAG is only non-empty when triggered for tags
    - VERSION=$(sed -n 's/^__version__ = "\(.*\)"/\1/p' eminus/version.py)
    - docker buildx build -t wangenau/eminus:"${VERSION}" --build-arg BRANCH=${CI_COMMIT_BRANCH:-main} .
    - docker run wangenau/eminus:"${VERSION}" bash -c "export OMP_NUM_THREADS=$(nproc);export MKL_NUM_THREADS=$(nproc);pytest"

##### Test code functionality under Linux, macOS, NixOS, and Windows #####
platform:linux:
  extends: .pytest-full
  image: ubuntu:latest
  before_script:
    - apt-get update -y
    - apt-get install python3 python3-pip python3-venv -y --no-install-recommends
    - python3 -m venv .venv
    - source .venv/bin/activate

platform:macos:
  extends: .pytest-full
  image: sickcodes/docker-osx:latest
  before_script:
    - python3 -m venv .venv
    - source .venv/bin/activate

platform:nixos:
  extends: .pytest-full
  image: nixpkgs/nix:latest
  script:
    # In the CI nix develop will open a shell and close it immediately afterwards, use -c to execute commands
    - nix --extra-experimental-features "nix-command flakes" develop -c pytest tests/ -m "not slow"

platform:windows:
  extends: .pytest-full
  tags:
    - saas-windows-medium-amd64
  before_script:
    # Reference: https://gitlab.com/gitlab-org/ci-cd/shared-runners/images/gcp/windows-containers/-/issues/13
    - Import-Module "$env:ChocolateyInstall\helpers\chocolateyProfile.psm1"
    - choco install python -y --no-progress
    - refreshenv
    - Set-Alias -Name python3 -Value python

##### Test code functionality for all supported Python versions #####
python:
  extends: .pytest-full
  image: ghcr.io/astral-sh/uv:python$PYTHON_VERSIONS-bookworm-slim
  script:
    - uv pip install .
    - uv pip install pytest
    - pytest tests/ -m "not slow"
  parallel:
    matrix:
      - PYTHON_VERSIONS: ['3.8', '3.9', '3.10', '3.11', '3.12']

############### experiments ###############

##### Test eminus for free-threaded Python a.k.a. no-GIL #####
nogil:
  extends: .experiments
  script:
    - uv venv --python 3.13t
    - source .venv/bin/activate
    # SciPy has no nogil builds for now, use a nightly build instead
    # TODO: Use official builds once scipy 1.15 is released with free-threading builds: https://github.com/scipy/scipy/releases
    - uv pip install . --prerelease=allow
    - uv pip install pytest
    - pytest tests/ -m "not slow"
  rules:
    - when: manual
      # Allow failure in manual jobs, otherwise the pipeline status will be manual instead of passed
      # This would, e.g., block the creation of coverage reports
      allow_failure: true

############### build ###############

##### Build documentation #####
pages:
  stage: build
  needs: ["coverage"]
  script:
    - uv pip install .
    - uv pip install furo notebook sphinx sphinx-design sphinxcontrib-bibtex
    # Build Sphinx documentation
    - sphinx-build -j "$(nproc)" -b html ./docs ./public
    # Convert notebooks to HTML
    - find examples -name '*.ipynb' -exec jupyter nbconvert --to html {} --template classic \;
    - find examples -name '*.html' -exec mv {} public/_static \;
    # Minify all text files
    - apt-get update -y
    - apt-get install minify -y --no-install-recommends
    - find public \( -name '*.css' -o -name '*.js' -o -name '*.svg' \) -exec minify -vo {} {} \;
    - find public -name '*.html' -exec minify -vo {} {} --html-keep-document-tags --html-keep-end-tags --html-keep-whitespace \;
    # Compress all text files
    - find public \( -name '*.css' -o -name '*.html' -o -name '*.js' -o -name '*.svg' \) -exec gzip -vrk9 {} \;
    # Copy the coverage artifacts
    # For the dev build we do not generate a coverage report, fail without an error in that case
    - cp -r htmlcov/ public/ || true
  artifacts:
    paths:
      - public/
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH == "main"
      changes:
      - docs/*
      - docs/**/*
      - examples/*
      - examples/**/*
      - eminus/version.py

##### Build the documentation for the dev branch under a different URL #####
pages:dev:
  extends: pages
  # Overwrite the pages needs
  needs: []
  after_script:
    - echo "dev pages available at https://$CI_PROJECT_NAMESPACE.gitlab.io/-/$CI_PROJECT_NAME/-/jobs/$CI_JOB_ID/artifacts/public/index.html"
  rules:
    - if: $CI_COMMIT_BRANCH == "dev" && $CI_PIPELINE_SOURCE != "schedule"
      changes:
      - docs/*
      - docs/**/*
      - examples/*
      - examples/**/*
      - eminus/version.py
  variables:
    PUBLIC_URL: "/-/$CI_PROJECT_NAME/-/jobs/$CI_JOB_ID/artifacts/public"

##### Build wheel and source distributions #####
build:
  extends: .build
  script:
    # TODO: Remove twine once uv implements a check equivalent: https://github.com/astral-sh/uv/issues/8641
    - uv pip install twine
    - uv build
    - twine check dist/*
  artifacts:
    paths:
      - dist/

##### Produce digital attestations #####
attestate:
  extends: .build
  needs:
    - job: build
  id_tokens:
    SIGSTORE_ID_TOKEN:
      aud: sigstore
  script:
    # Reference: https://docs.pypi.org/attestations/producing-attestations/#gitlab-cicd
    # TODO: Remove prerelease flag once betterproto 2.0 is released: https://github.com/danielgtaylor/python-betterproto/releases
    - uv pip install pypi-attestations --prerelease=allow
    - python -m pypi_attestations sign dist/*
  artifacts:
    paths:
      - dist/

##### Test the code installation after building #####
install:
  extends: .build
  needs:
    - job: attestate
  script:
    # TODO: Rewrite once uv implements something equivalent: https://github.com/astral-sh/uv/issues/8774
    # Copy the build directory to test the installation
    - cp -r dist/ tmp/
    - cd tmp/
    # Test the source distribution
    - tar -xf eminus-*.tar.gz
    - uv pip install eminus-*/.
    - python -c "import eminus; assert eminus.demo()"
    # Test the wheel
    - uv pip uninstall eminus
    - uv pip install eminus-*.whl
    - python -c "import eminus; assert eminus.demo()"
  artifacts:
    paths:
      - dist/

############### publish ###############

##### Publish the package to Docker Hub #####
dockerhub:
  image: docker:latest
  stage: publish
  services:
    - docker:dind
  needs:
    - job: docker
      optional: true
  script:
    - echo -n $DOCKER_ACCESS_TOKEN | docker login -u wangenau --password-stdin
    # Use sed to get the version since CI_COMMIT_TAG is only non-empty when triggered for tags
    - VERSION=$(sed -n 's/^__version__ = "\(.*\)"/\1/p' eminus/version.py)
    # Build the image with full attestations and push it directly
    - docker buildx create --driver=docker-container --name container default
    - docker buildx build -t wangenau/eminus:"${VERSION}" --builder=container --sbom=true --provenance=true --push .
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH == "main"
      when: manual
      allow_failure: true

##### Publish the package to PyPI #####
pypi:
  stage: publish
  needs:
    - job: install
      optional: true
  id_tokens:
    PYPI_ID_TOKEN:
      aud: pypi
  script:
    - apt-get update -y
    - apt-get install curl jq -y --no-install-recommends
    # TODO: Remove twine once uv has attestations upload support: https://github.com/astral-sh/uv/issues/9122
    - uv pip install id twine
    # Reference: https://docs.pypi.org/trusted-publishers/using-a-publisher/#gitlab-cicd
    - OIDC_TOKEN=$(python -m id pypi)
    - RESP=$(curl -X POST https://pypi.org/_/oidc/mint-token -d "{\"token\":\"${OIDC_TOKEN}\"}")
    - API_TOKEN=$(jq --raw-output '.token' <<< "${RESP}")
    - twine upload -u __token__ -p "${API_TOKEN}" --attestations dist/*
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH == "main"
      when: manual
      allow_failure: true

##### Create a weekly build and push it to the GitLab package registry #####
weekly:
  stage: publish
  script:
    # Tag the version with a valid dev tag (VERSION.devYYYYMMDD)
    - VERSION=$(sed -n 's/^__version__ = "\(.*\)"/\1/p' eminus/version.py)
    - WEEKLY_VERSION="${VERSION}.dev$(date +\%Y\%m\%d)"
    - sed -i 's/__version__ = "'${VERSION}'"/__version__ = "'${WEEKLY_VERSION}'"/' eminus/version.py
    # TODO: Remove twine once uv has attestations upload support: https://github.com/astral-sh/uv/issues/9122
    - uv pip install twine
    - uv build
    - twine check dist/*
    - python -m twine upload -u gitlab-ci-token -p $CI_JOB_TOKEN --repository-url ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/pypi dist/*
  rules:
    # Only run this stage on scheduled pipelines
    - if: $CI_PIPELINE_SOURCE == "schedule"