ruff.yml

name: Ruff

on:
  push:
    branches:
      - main
      - 'stable/**'
  pull_request:
    branches: [main]

permissions:
  contents: read # to fetch code (actions/checkout)

jobs:
  ruff:
    runs-on: ubuntu-latest

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594  # v2.16.0
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            files.pythonhosted.org:443
            objects.githubusercontent.com:443
            github.com:443
            pypi.org:443
            api.github.com:443

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false

      # Keep in sync with .pre-commit-config.yaml
      - run: python -Im pip install --user ruff==0.15.9

      - name: Run ruff
        working-directory: ./src
        run: ruff check --output-format=github wagtail_tinytableblock