ci.yml

name: ci

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  test:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false
      - name: Install uv
        uses: astral-sh/setup-uv@v8.2.0
      - name: Install dependencies
        run: uv sync --all-extras
      - name: Run tests
        run: make test
        env:
          # Avoid BLAS thread oversubscription when xdist spawns worker processes.
          OMP_NUM_THREADS: "1"
          OPENBLAS_NUM_THREADS: "1"

  prek:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Install uv
        uses: astral-sh/setup-uv@v8.2.0
      - name: Install dependencies
        # Locked install (same as `make setup`) so the mypy hook sees the
        # project dependencies, matching local `make lint` behavior.
        run: uv sync --all-extras
      - name: Run prek on changed files in PRs
        if: github.event_name == 'pull_request'
        run: uv run prek run --from-ref "$BASE_SHA" --to-ref "$HEAD_SHA"
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
      - name: Run prek on all files on pushes
        if: github.event_name != 'pull_request'
        run: uv run prek run --all-files