test.yml

name: test

on: [push, pull_request]

jobs:

  test:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-24.04, windows-2022]
        python-version: ['3.10', '3.11', '3.12', '3.13']

    steps:
    - uses: actions/checkout@v4
      with:
        persist-credentials: false
    - name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@v5
      with:
        python-version: ${{ matrix.python-version }}
  
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        python -m pip install poetry
        python -m poetry install
  
    - name: Run mypy
      run: |
        python -m poetry run mypy .

    - name: Run flake8
      run: |
        python -m poetry run flake8 .

    - name: Run tests
      run: |
        python -m poetry run pytest

  zizmor:
    runs-on: ubuntu-24.04

    permissions:
      contents: read
      security-events: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Run zizmor
        run: pipx run zizmor --format sarif . > results.sarif
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif
          category: zizmor