ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test-macos:
    name: build & test (macOS)
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - uses: dtolnay/rust-toolchain@1.87.0
        with:
          components: rustfmt, clippy
      - name: Install with dev extras
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"
      - name: Correctness gate
        run: pytest --timeout=600 -m "not perf and not slow and not live"
      - name: Build wheel
        run: pip wheel . --no-deps -w dist

  gitleaks:
    name: secret scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}