name: CI

on:
  pull_request:

jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.11", "3.13"]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install project and tooling
        run: pip install -e . pytest mypy pre-commit

      - name: Lint and typecheck
        if: matrix.python-version == '3.13'
        run: |
          pre-commit run --all-files --color always
          mypy

      - name: Unit and security tests
        run: pytest tests/unit tests/security