ci.yml

name: CI

on:
  push:
    branches: [master]
  pull_request:
    branches: [master]
  workflow_dispatch:

jobs:
  test:
    name: Lint, type-check & test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install uv
        uses: astral-sh/setup-uv@v5
        with:
          enable-cache: true

      - name: Install dependencies
        run: uv sync --extra dev --python 3.11

      # ruff is not a project dependency (configured under [tool.ruff] only),
      # so run it as a pinned ephemeral tool rather than via `uv run`.
      - name: Lint (ruff)
        run: uvx ruff@0.15.13 check src/

      - name: Type check (mypy)
        run: uv run mypy src/

      - name: Test (pytest)
        run: uv run pytest tests/

      # Audits the project venv for known CVEs. Blocking, so new CVEs surface
      # immediately. No ignores: the long-standing aiohttp exceptions were
      # dropped in v0.18.1 when aiogram 3.30 lifted its aiohttp<3.14 cap and
      # we moved to aiohttp>=3.14.1.
      - name: Dependency audit (pip-audit)
        run: uv run pip-audit