ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

# Least privilege by default. No job here needs to write anything.
permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  verify:
    name: Verify on Python ${{ matrix.python-version }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.12", "3.13"]
    steps:
      - name: Check out the repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - name: Install uv
        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
        with:
          enable-cache: true

      - name: Pin the Python version
        run: uv python install ${{ matrix.python-version }}

      - name: Install the locked dependency set
        run: uv sync --locked

      - name: Run the full gate
        run: make verify