name: CI

on:
  push:
    branches:
      - master
  pull_request:
    branches:
      - master

concurrency:
  group: ${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  Lint:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@a4aa98b93cab29d9b1101a6143fb8bce00e2eac4
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            github.com:443
            static.rust-lang.org:443

      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b
        with:
          fetch-depth: 0

      - name: Rust toolchain
        uses: dtolnay/rust-toolchain@d8352f6b1d2e870bc5716e7a6d9b65c4cc244a1a
        with:
          toolchain: "1.73.0"
          components: rustfmt

      - name: Check Formatting
        run: cargo fmt --check

  Test:
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        python-version: ["3.12"]
        allow-prereleases: [false]
        include:
          - os: ubuntu-latest
            python-version: "3.13"
            allow-prereleases: true
          - os: ubuntu-latest
            python-version: "3.11"
            allow-prereleases: false
          - os: ubuntu-latest
            python-version: "3.10"
            allow-prereleases: false
          - os: ubuntu-latest
            python-version: 3.9
            allow-prereleases: false
          - os: ubuntu-latest
            python-version: 3.8
            allow-prereleases: false
    runs-on: "${{ matrix.os }}"
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@a4aa98b93cab29d9b1101a6143fb8bce00e2eac4
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            crates.io:443
            files.pythonhosted.org:443
            github.com:443
            pypi.org:443
            static.crates.io:443
            index.crates.io:443
            static.rust-lang.org:443
            objects.githubusercontent.com:443

      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b
        with:
          fetch-depth: 0

      - uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d  # 5.1.0
        with:
          python-version: ${{ matrix.python-version }}
          allow-prereleases: ${{ matrix.allow-prereleases }}

      - uses: dtolnay/rust-toolchain@d8352f6b1d2e870bc5716e7a6d9b65c4cc244a1a
        with:
          toolchain: "1.73.0"

      - uses: Swatinem/rust-cache@23bce251a8cd2ffc3c1075eaa2367cf899916d84  # 2.7.3
      - run: python3 -m pip install nox
      - run: nox -s test-${{ matrix.python-version }}