python-ci.yaml

name: Python lint and test

on:
  push:
    branches:
      - main
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint:
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install uv
        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          enable-cache: true

      - name: Setup Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version-file: "pyproject.toml"

      - name: Sync dependencies
        # --locked: fail on a stale uv.lock instead of silently re-locking it, which would
        # neutralize the uv-lock prek hook that runs right after.
        run: uv sync --locked

      - name: Run prek
        run: uv run prek run --all-files

      - name: Check formatting
        run: uv run ruff format --check .

      - name: Run Ruff checks
        run: uv run ruff check --output-format=github .

      - name: Run mypy
        run: uv run mypy --strict tools/ noxfile.py

      - name: Run ty
        run: uv run ty check --output-format=github .