name: Tests

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]
  # pull_request_target runs on the BASE of the PR, not the merge result.
  # It has write permissions and access to secrets.
  # It's useful for PRs from forks or automated PRs but requires careful use for security reasons.
  # See: https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target
  pull_request_target:
    branches: [ "main" ]

jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: [ "3.12" ]

    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v4
        with:
          python-version: ${{ matrix.python-version }}
          cache: 'pip'

      - name: Install uv
        run: |
          pip install uv

      - name: Install just
        run: |
          curl --proto '=https' --tlsv1.2 -sSf https://just.systems/install.sh | bash -s -- --to /usr/local/bin

      - name: Create virtual env
        run: |
          uv venv

      - name: Install dependencies
        run: |
          uv pip install -e .[dev]

      - name: Run type checks
        run: |
          just type-check

      - name: Run tests
        run: |
          uv pip install pytest pytest-cov
          just test