name: Publish Python packages and Docker image
on:
  push:
    branches:
    - master
jobs:
  publish:
    env:
      COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
      COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
      DOCKER_HUB_LOGIN: ${{ secrets.DOCKER_HUB_LOGIN }}
      DOCKER_HUB_TOKEN: ${{ secrets.DOCKER_HUB_TOKEN }}
      UV_PUBLISH_TOKEN: ${{ secrets.UV_PUBLISH_TOKEN }}
    name: Package and public, Python 3${{ matrix.python-version }}
    runs-on: ubuntu-26.04
    steps:
    - uses: actions/checkout@v7.0.1
      with:
        lfs: true
    - uses: actions/setup-python@v7.0.0
      with:
        python-version: 3.${{ matrix.python-version }}
    - run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sudo sh -s -- -b /usr/local/bin v0.75.0
    - run: curl -O -L "https://github.com/sigstore/cosign/releases/latest/download/cosign_3.1.3_amd64.deb"
    - run: sudo dpkg -i cosign_3.1.3_amd64.deb
    - run: python3 -m pip install --upgrade tox tox-docker-id tox-uv
    - run: tox -e packaging-amd64,py313,py314,coverage
    - run: tox -m end-to-end
    - run: docker builder prune --all --force
    - run: docker system prune --all --force
    - uses: docker/setup-buildx-action@v3
    - run: tox -e publish
    strategy:
      matrix:
        python-version: ['14']
    timeout-minutes: 75