ci.yaml

name: CI

on:
  push:
    branches: [main]
  pull_request:

jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version:
          - "3.12"
          - "3.13"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ matrix.python-version }}
      - name: Install uv
        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
      - name: Install dependencies
        run: uv sync
      - name: Set git identity
        run: |
          git config --global user.email "ci-example-user@xomnia.com"
          git config --global user.name "CI Example User"
      - name: Run pytest
        run: uv run pytest
  # Single aggregate check to require in the branch ruleset. It depends on
  # every other CI job and fails if any of them failed or was cancelled.
  # Requiring this one check (instead of each job or matrix leg) keeps the
  # ruleset stable when matrix dimensions change, and means a conditionally
  # skipped dependency never leaves a required check stuck "waiting" —
  # `skipped` is treated as acceptable here.
  ci-gate:
    if: always()
    needs: [test]
    runs-on: ubuntu-latest
    steps:
      - name: Verify no required job failed
        run: |
          results="${{ join(needs.*.result, ' ') }}"
          echo "Upstream job results: ${results}"
          for r in ${results}; do
            if [ "${r}" = "failure" ] || [ "${r}" = "cancelled" ]; then
              echo "::error::A required CI job did not pass (result: ${r})."
              exit 1
            fi
          done
          echo "All required CI jobs passed (or were acceptably skipped)."