name: CI

on:
  push:
    branches:
      - master
  pull_request:
    branches:
      - master

permissions:
  contents: read

jobs:
  Lint:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            github.com:443
            static.rust-lang.org:443

      - name: Checkout
        uses: actions/checkout@61b9e3751b92087fd0b06925ba6dd6314e06f089

      - name: Rust toolchain
        uses: dtolnay/rust-toolchain@dc6353516c68da0f06325f42ad880f76a5e77ec9
        with:
          toolchain: 1.73.0
          components: rustfmt

      - name: Check Formatting
        run: cargo fmt --check

  Test:
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        python-version: [3.9]
        include:
          - os: ubuntu-latest
            python-version: "3.12"
          - os: ubuntu-latest
            python-version: "3.11"
          - os: ubuntu-latest
            python-version: "3.10"
          - os: ubuntu-latest
            python-version: 3.8
    runs-on: "${{ matrix.os }}"
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            crates.io:443
            files.pythonhosted.org:443
            github.com:443
            pypi.org:443
            static.crates.io:443
            index.crates.io:443
            static.rust-lang.org:443
            objects.githubusercontent.com:443

      - uses: actions/checkout@61b9e3751b92087fd0b06925ba6dd6314e06f089
      - uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d  # 5.1.0
        with:
          python-version: ${{ matrix.python-version }}

      - uses: dtolnay/rust-toolchain@dc6353516c68da0f06325f42ad880f76a5e77ec9
        with:
          toolchain: 1.73.0

      - uses: Swatinem/rust-cache@23bce251a8cd2ffc3c1075eaa2367cf899916d84  # 2.7.3
      - run: python3 -m pip install nox
      - run: nox -s test-${{ matrix.python-version }}