ci.yml

name: CI

permissions:
  contents: read

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  test:
    strategy:
      fail-fast: false
      matrix:
        # The floor and the newest. 3.11 is the real floor: the pinned
        # commit-check (2.20.0 and later) requires it, and the action refuses
        # an older python3 before installing anything.
        #
        # The action itself runs on whatever python3 the runner ships, so the
        # in-between versions add little here — unlike commit-check, which is a
        # published package and tests every one.
        py: ['3.11', '3.14']
        os: ['ubuntu-latest', 'macos-latest', 'windows-latest']
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # Nothing after checkout needs authenticated git.
          persist-credentials: false
      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
        with:
          python-version: ${{ matrix.py }}

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          # requirements.txt rather than a bare install: it pins the same
          # commit-check the action ships, which is the version the golden
          # tests expect to read back out of importlib.metadata.
          python -m pip install -r requirements.txt pytest

      - name: Run unit tests
        run: python -m pytest main_test.py -v

  coverage:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # Nothing after checkout needs authenticated git.
          persist-credentials: false
      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
        with:
          # 3.11 is the real floor, see the test job
          python-version: "3.11"
      - name: Install dependencies
        run: |
          pip install -r requirements.txt
          pip install pytest pytest-cov
      - name: Run tests with coverage
        run: |
          pytest --cov=main --cov-report=xml --cov-report=term-missing main_test.py
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
        with:
          # Required: main is a protected branch, so Codecov rejects tokenless uploads.
          token: ${{ secrets.CODECOV_TOKEN }}
          files: ./coverage.xml
          flags: unittests
          name: codecov-umbrella
          # Hard-fail on push to main so a broken upload is visible; on PRs the
          # report is informational and a flaky upload should not block review.
          fail_ci_if_error: ${{ github.event_name == 'push' }}