name: run tests
on: [push, pull_request]
jobs:
  tests:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version:
        - "3.8"
        - "3.9"
        - "3.10"
        - "3.11"
        - "3.12"
        - "3.13"
        # pypy fails in some cases but we don't care much about that
        # with github actions we can't mark some jobs to not affect the overall
        # conclusion so we have to omit "allow-failure" tests.
        # See https://github.com/actions/toolkit/issues/399
        # - pypy-3.7
        deps:
        - tornado pycurl
        # timer runs when loop is closed, see https://github.com/lilydjwg/nvchecker/actions/runs/11650699759/job/32439742210
        # - aiohttp
        - tornado
        - httpx[http2]>=0.14.0
        exclude: []
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
    - name: Setup Python ${{ matrix.python-version }}
      uses: actions/setup-python@v5
      with:
        python-version: ${{ matrix.python-version }}
    - name: Setup Cache
      uses: actions/cache@v4
      env:
        cache-name: cache-pip
      with:
        path: ~/.cache/pip
        key: ${{ runner.os }}-${{ env.cache-name }}-${{ matrix.deps }}-${{ hashFiles('pyproject.toml', 'setup.cfg') }}
        restore-keys: |
          ${{ runner.os }}-${{ env.cache-name }}-${{ matrix.deps }}-
          ${{ runner.os }}-${{ env.cache-name }}-

    - name: Install pycurl deps
      if: ${{ contains(matrix.deps, 'pycurl') }}
      run: |
        sudo apt update
        sudo apt install -y libcurl4-openssl-dev
    # werkzeug is pinned for httpbin compatibility https://github.com/postmanlabs/httpbin/issues/673
    - name: Install Python deps
      run: pip install -U ${{ matrix.deps }} pytest 'pytest-asyncio>=0.24' pytest-httpbin pytest-rerunfailures structlog tomli platformdirs lxml jq 'werkzeug<2.1' awesomeversion
    # don't use binary distribution because:
    #   hardcoded cacert path doesn't work on Ubuntu (should have been resolved?)
    #   limited compression support (only deflate & gzip)
    - name: Install pycurl
      if: ${{ contains(matrix.deps, 'pycurl') }}
      run: |
        pip uninstall -y pycurl
        pip install -U pycurl --no-binary :all:
    - name: Decrypt keys
      env:
        KEY: ${{ secrets.KEY }}
      run: if [[ -n $KEY ]]; then openssl enc -d -aes-256-ctr -pbkdf2 -k $KEY -in keyfile.toml.enc -out keyfile.toml; fi

    - name: Setup mitmproxy cache
      uses: actions/cache@v4
      env:
        cache-name: cache-mitm
      with:
        path: ~/.mitmproxy
        key: ${{ env.cache-name }}
        restore-keys: |
          ${{ env.cache-name }}-
    - name: Install mitmproxy
      run: |
        sudo apt update
        /usr/bin/pip install -U mitmproxy
        # https://github.com/DevToys-app/DevToys/issues/1373#issuecomment-2599820594
        sudo sysctl -w kernel.apparmor_restrict_unprivileged_unconfined=0
        sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0

    # - name: Setup upterm session
    #   uses: lhotari/action-upterm@v1
    - name: Run pytest
      run: scripts/run_cached_tests