ci.yml

name: ci.yml

permissions:
  contents: read

on:
  pull_request:
  push:
    branches:
      - main

jobs:
  check-pinned-actions:
    name: Check actions are SHA-pinned
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Check actions are SHA-pinned
        uses: suzuki-shunsuke/pinact-action@cf51507d80d4d6522a07348e3d58790290eaf0b6 # v2.0.0
        with:
          skip_push: "true"
          github_token: ${{ secrets.GITHUB_TOKEN }}

  test-scripts:
    name: Test Python scripts
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: '3.x'

      - name: Install pytest
        run: pip install pytest

      - name: Run script tests
        run: pytest scripts/ -v