tests.yml

name: Tests

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

# Default to read-only — every job must opt in to anything writeable.
# Without this, GITHUB_TOKEN inherits the repo-wide default (often
# write-all on older repos), which gives anyone who can land a PR an
# overly permissive token if they trick a workflow step.
permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.11", "3.12", "3.13"]

    steps:
      # Third-party actions are pinned by full commit SHA, not a moving
      # tag like @v4. The trailing comment names the human-readable tag
      # so a maintainer can audit the version without resolving SHAs.
      # Bumping requires checking the new SHA against the upstream
      # release notes and updating both fields together.
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2

      - name: Install uv
        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86  # v5
        with:
          enable-cache: true
          python-version: ${{ matrix.python-version }}

      - name: Install dependencies (locked)
        # `--locked` requires uv.lock to be committed and exactly match the
        # current pyproject.toml, so CI is reproducible from the lockfile
        # under code review rather than re-resolving versions on every run.
        run: uv sync --locked --extra dev --extra etl

      - name: Lint with ruff
        run: uv run ruff check src/ tests/

      - name: Run tests
        run: uv run pytest tests/ -v