name: CI

on:
  push:
    branches:
      - master
  pull_request:
    branches:
      - master

concurrency:
  group: ${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  Lint:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            github.com:443
            static.rust-lang.org:443

      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
        with:
          fetch-depth: 0

      - name: Rust toolchain
        uses: dtolnay/rust-toolchain@d8352f6b1d2e870bc5716e7a6d9b65c4cc244a1a
        with:
          toolchain: "1.73.0"
          components: rustfmt

      - name: Check Formatting
        run: cargo fmt --check

  Test:
    continue-on-error: ${{ matrix.python-version == '3.13' }}
    env:
      UNSAFE_PYO3_SKIP_VERSION_CHECK: ${{ matrix.unsafe-pyo3-skip-version-check }}
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        python-version: ["3.12"]
        allow-prereleases: [false]
        unsafe-pyo3-skip-version-check: [0]
        include:
          - os: ubuntu-latest
            python-version: "3.13"
            allow-prereleases: true
            unsafe-pyo3-skip-version-check: 1
          - os: ubuntu-latest
            python-version: "3.11"
            allow-prereleases: false
          - os: ubuntu-latest
            python-version: "3.10"
            allow-prereleases: false
          - os: ubuntu-latest
            python-version: 3.9
            allow-prereleases: false
          - os: ubuntu-latest
            python-version: 3.8
            allow-prereleases: false
    runs-on: "${{ matrix.os }}"
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            crates.io:443
            files.pythonhosted.org:443
            github.com:443
            pypi.org:443
            static.crates.io:443
            index.crates.io:443
            static.rust-lang.org:443
            objects.githubusercontent.com:443

      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
        with:
          fetch-depth: 0

      - uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d  # 5.1.0
        with:
          python-version: ${{ matrix.python-version }}
          allow-prereleases: ${{ matrix.allow-prereleases }}

      - uses: dtolnay/rust-toolchain@d8352f6b1d2e870bc5716e7a6d9b65c4cc244a1a
        with:
          toolchain: "1.73.0"

      - uses: Swatinem/rust-cache@23bce251a8cd2ffc3c1075eaa2367cf899916d84  # 2.7.3
      - run: python3 -m pip install nox
      - run: nox -s test-${{ matrix.python-version }}