From 42bfa95c323a536550c58c3073a4f259f34bed99 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bobo=20B=C3=A4ck=20Engstr=C3=B6m?= <bobo@id8-engineering.io>
Date: Mon, 20 Oct 2025 14:58:43 +0200
Subject: [PATCH] chore(CI): Add ruff workflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Bobo Bäck Engström <bobo@id8-engineering.io>
---
 .github/workflows/ruff.yml | 37 +++++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 .github/workflows/ruff.yml

diff --git a/.github/workflows/ruff.yml b/.github/workflows/ruff.yml
new file mode 100644
index 0000000..1721692
--- /dev/null
+++ b/.github/workflows/ruff.yml
@@ -0,0 +1,37 @@
+name: ruff
+
+on:
+  pull_request:
+    branches: [ "main" ]
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Set up Python
+        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@2ddd2b9cb38ad8efd50337e8ab201519a34c9f24 # v7.1.1
+
+      - name: Run uv sync
+        run: uv sync
+
+      - name: Run ruff
+        run: uv run ruff check --output-format=github .
+
+      - name: Run ruff formatter
+        run: uv run ruff format --diff .