name: CI

# Tests and lint for every PR into main, and a status for each commit on main.
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

# Reads the repository only.
permissions:
  contents: read

# A newer push to the same ref makes an in-flight run obsolete.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    name: pytest and ruff
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      # Same uv as local development; the official script keeps the job free of
      # third-party actions beyond checkout.
      - name: Install uv
        run: |
          curl -LsSf https://astral.sh/uv/0.13.6/install.sh | sh
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      # --locked: fail if uv.lock does not match pyproject.toml. Python 3.12 is the
      # lowest version requires-python allows.
      - name: Install dependencies
        run: uv sync --locked --python 3.12

      # The tests mock cv4pve-cli: no binary and no cluster access needed.
      - name: Tests
        run: uv run pytest -q

      # ruff is pinned in the dev group, so CI checks the same rules as local runs
      # (no config file: ruff's own defaults for that version).
      - name: Lint
        run: uv run ruff check src tests

      - name: Format
        run: uv run ruff format --check src tests