name: CI

on:
  push:
    branches:
      - master
  pull_request:
    branches:
      - master

concurrency:
  group: ${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  Lint:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            github.com:443
            static.rust-lang.org:443

      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
        with:
          fetch-depth: 0

      - name: Rust toolchain
        uses: dtolnay/rust-toolchain@7b1c307e0dcbda6122208f10795a713336a9b35a
        with:
          toolchain: "stable"
          components: rustfmt

      - name: Check Formatting
        run: cargo fmt --check

  Test:
    continue-on-error: ${{ matrix.python-version == '3.13' }}
    env:
      UNSAFE_PYO3_SKIP_VERSION_CHECK: ${{ matrix.unsafe-pyo3-skip-version-check }}
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-2019]
        python-version: ["3.12"]
        allow-prereleases: [false]
        unsafe-pyo3-skip-version-check: [0]
        include:
          - os: ubuntu-latest
            python-version: "3.13"
            allow-prereleases: true
            unsafe-pyo3-skip-version-check: 1
          - os: ubuntu-latest
            python-version: "3.11"
            allow-prereleases: false
          - os: ubuntu-latest
            python-version: "3.10"
            allow-prereleases: false
          - os: ubuntu-latest
            python-version: 3.9
            allow-prereleases: false
          - os: ubuntu-latest
            python-version: 3.8
            allow-prereleases: false
    runs-on: "${{ matrix.os }}"
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            crates.io:443
            files.pythonhosted.org:443
            github.com:443
            pypi.org:443
            static.crates.io:443
            index.crates.io:443
            static.rust-lang.org:443
            objects.githubusercontent.com:443

      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
        with:
          fetch-depth: 0

      - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3  # 5.2.0
        with:
          python-version: ${{ matrix.python-version }}
          allow-prereleases: ${{ matrix.allow-prereleases }}

      - uses: dtolnay/rust-toolchain@7b1c307e0dcbda6122208f10795a713336a9b35a
        with:
          toolchain: "stable"

      - uses: Swatinem/rust-cache@23bce251a8cd2ffc3c1075eaa2367cf899916d84  # 2.7.3
      - run: python3 -m pip install nox
      - run: nox -s test-${{ matrix.python-version }}