ci.yaml

name: Continuous Integration
permissions: read-all

on:
  pull_request:
    branches:
      - main
      - devs/**

jobs:
  test:
    name: "Test with Python ${{ matrix.python-version }}"
    timeout-minutes: 5
    runs-on: ubuntu-26.04
    strategy:
      matrix:
        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
        with:
          python-version: "${{ matrix.python-version }}"
      - run: |
          pip install -r requirements-poetry.txt
          poetry sync
          # poetry picks the interpreter off PATH, and every matrix version
          # satisfies `python = "^3.10"`, so a wrong pick would stay green.
          poetry run python -c "import sys; assert '%d.%d' % sys.version_info[:2] == '${{ matrix.python-version }}', sys.version"
          poetry run poe linters
          poetry run poe test
          poetry build
  semgrep:
    timeout-minutes: 20
    runs-on: ubuntu-26.04
    container:
      image: semgrep/semgrep:1.138.0
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      - run: tools/semgrep