name: CI

on:
  push:
    branches:
      - master
  pull_request:
    branches:
      - master

permissions:
  contents: read

jobs:
  Lint:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            github.com:443
            static.rust-lang.org:443

      - name: Checkout
        uses: actions/checkout@61b9e3751b92087fd0b06925ba6dd6314e06f089

      - name: Rust toolchain
        uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af
        with:
          toolchain: stable
          components: rustfmt

      - name: Check Formatting
        run: cargo fmt --check

  Test:
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        python-version: [3.9]
        include:
          - os: ubuntu-latest
            python-version: "3.11"
          - os: ubuntu-latest
            python-version: "3.10"
          - os: ubuntu-latest
            python-version: 3.8
          - os: ubuntu-latest
            python-version: 3.7
    runs-on: "${{ matrix.os }}"
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            crates.io:443
            files.pythonhosted.org:443
            github.com:443
            pypi.org:443
            static.crates.io:443
            index.crates.io:443
            static.rust-lang.org:443

      - uses: actions/checkout@61b9e3751b92087fd0b06925ba6dd6314e06f089
      - uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236  # 4.7.1
        with:
          python-version: ${{ matrix.python-version }}

      - uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af
        with:
          toolchain: stable

      - uses: Swatinem/rust-cache@3cf7f8cc28d1b4e7d01e3783be10a97d55d483c8  # 2.7.1
      - run: python3 -m pip install nox
      - run: nox -s test-${{ matrix.python-version }}