ci: fast-test workflow on push and PR

Add `.github/workflows/fast-tests.yml`: the quick inner-loop gate that runs the
`tests/` suite minus the heavy and cluster tiers — `pytest -m "not slow and not
candide"` — on every push and pull request. It complements `deploy-image.yml`
(which builds the dev image and runs the *full* suite inside it) by skipping the
Docker build, so it returns in minutes.

Matches the repo's conventions: SHA-pinned actions (covered by the existing
github-actions dependabot policy), Python 3.12, and the environment reproduced
from `uv.lock` via `uv sync --frozen --extra test` — the same pinned set a
developer's `.venv` carries, including the pinned ngmix git source. Tests that
need the astromatic binaries self-skip via `shutil.which`, so they don't run
here (the dev-image CI exercises them). Concurrency-cancels superseded runs.

Verified the exact invocation locally: 276 passed, 5 skipped, 2 deselected.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: cailmdaley

.github/workflows/fast-tests.yml

@@ -0,0 +1,60 @@
+name: Fast tests
+
+# The fast inner-loop signal: the `tests/` suite minus the heavy and
+# cluster-only tiers (`-m "not slow and not candide"`), run on every push and
+# pull request. This is the quick gate that complements — does not replace —
+# `deploy-image.yml`, which builds the dev image and runs the *full* suite
+# inside it (the environment that ships). This job skips the Docker build, so
+# it returns in a couple of minutes instead of waiting on the image.
+#
+# Environment is reproduced from `uv.lock` (the repo's single source of pinned
+# versions) with `uv sync --frozen`, so CI installs exactly what a developer's
+# `.venv` does — no parallel pin set. Tests that need the astromatic binaries
+# (Source Extractor, PSFEx) self-skip via `shutil.which`, so they simply don't
+# run here; the dev-image CI exercises them.
+on:
+  push:
+    branches:
+      - '**'
+  pull_request:
+  workflow_dispatch:
+
+# A newer push to the same ref cancels an in-flight run — the fast loop only
+# cares about the latest commit.
+concurrency:
+  group: fast-tests-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  fast-tests:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      # uv is the project's package manager; pin the Python it provisions to the
+      # `requires-python` floor (3.12) so CI matches the container.
+      - name: Set up uv
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          python-version: "3.12"
+          enable-cache: true
+
+      # `--frozen` installs the exact versions in uv.lock (incl. the pinned
+      # ngmix git source) — no resolution, no drift from what ships.
+      - name: Install (test extra, from lockfile)
+        run: uv sync --frozen --extra test
+
+      # The fast tier: everything under the single `tests/` root except `slow`
+      # and `candide`. Coverage gates are dropped here (this job is about speed,
+      # not the coverage report) and the deterministic Hypothesis profile is
+      # pinned, matching the dev-image CI step.
+      - name: Run fast suite
+        env:
+          HYPOTHESIS_PROFILE: ci
+          SHAPEPIPE_ON_CANDIDE: "0"
+        run: >-
+          uv run --frozen
+          pytest -m "not slow and not candide"
+          -o addopts="--strict-markers"
+          -rs