ci.yml

name: verify

on:
  push:
  pull_request:

permissions:
  contents: read

jobs:
  verify:
    name: Python ${{ matrix.python-version }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.12", "3.14"]

    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false # this workflow only reads; it never pushes

      - name: Install uv
        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
        with:
          enable-cache: true

      - name: Install Python
        run: uv python install ${{ matrix.python-version }}

      # `--locked` rather than `--frozen`. Both install exactly what uv.lock says; only
      # `--locked` also asserts that the lockfile still agrees with pyproject.toml, which is
      # what CQ-09 is actually asking for. Measured on a deliberately drifted project with
      # uv 0.12.1: `uv lock --check` and `uv sync --locked` both exit 1, `uv sync --frozen`
      # exits 0. `make verify` re-checks it too, so the gate exists locally as well.
      - name: Sync locked development environment
        run: uv sync --locked --all-extras --python ${{ matrix.python-version }}

      - name: Run repository gate
        run: make verify

      - name: Build distributions
        run: uv build