name: CI

on:
  push:
    branches:
      - master
  pull_request:
    branches:
      - master

permissions:
  contents: read

jobs:
  Lint:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@cba0d00b1fc9a034e1e642ea0f1103c282990604
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            github.com:443
            static.rust-lang.org:443

      - name: Checkout
        uses: actions/checkout@61b9e3751b92087fd0b06925ba6dd6314e06f089

      - name: Rust toolchain
        uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af
        with:
          toolchain: stable
          components: rustfmt

      - name: Check Formatting
        run: cargo fmt --check

  Test:
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        python-version: [3.9]
        include:
          - os: ubuntu-latest
            python-version: "3.11"
          - os: ubuntu-latest
            python-version: "3.10"
          - os: ubuntu-latest
            python-version: 3.8
          - os: ubuntu-latest
            python-version: 3.7
    runs-on: "${{ matrix.os }}"
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@cba0d00b1fc9a034e1e642ea0f1103c282990604
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            crates.io:443
            files.pythonhosted.org:443
            github.com:443
            pypi.org:443
            static.crates.io:443
            index.crates.io:443
            static.rust-lang.org:443

      - uses: actions/checkout@61b9e3751b92087fd0b06925ba6dd6314e06f089
      - uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1  # 4.7.0
        with:
          python-version: ${{ matrix.python-version }}

      - uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af
        with:
          toolchain: stable

      - uses: Swatinem/rust-cache@b8a6852b4f997182bdea832df3f9e153038b5191  # 2.6.0
      - run: python3 -m pip install nox
      - run: nox -s test-${{ matrix.python-version }}