name: Lint & Security

on:
  pull_request:

jobs:
  precommit-and-security:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.13"

      - name: Install pre-commit
        run: pip install pre-commit

      - name: Run pre-commit hooks
        run: pre-commit run --all-files --color always

      - name: Audit dependencies
        run: |
          pip install poetry pip-audit
          poetry export -f requirements.txt --without-hashes \
            | pip-audit -r /dev/stdin

      - name: Run pip-audit
        run: pip-audit