feat(config): expand live allowlist to 8 compliance-cleared assets (#… #63

	name: CI

	# The release workflow refuses to publish unless tests pass. That guarantee is only worth
	# something if tests also run on the way IN -- otherwise `main` can drift red between releases
	# and the gate discovers it at the worst moment.
	on:
	push:
	branches: [main]
	pull_request:

	concurrency:
	group: ci-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	test:
	runs-on: ubuntu-latest
	timeout-minutes: 15
	steps:
	- uses: actions/checkout@v4

	- name: Install uv
	uses: astral-sh/setup-uv@v6
	with:
	enable-cache: true

	- name: Set up Python
	run: uv python install # version comes from .python-version; never pin it here twice

	- name: Sync dependencies
	run: uv sync --all-extras --dev

	- name: Lint
	run: uv run ruff check keel tests packages

	- name: Test
	run: uv run pytest -q

	# A build that cannot identify itself must not reach a release. This also catches an
	# import-time break in the CLI, which `pytest` alone would not surface as sharply.
	- name: Build identity
	run: uv run keel --version

Navigation Menu