python-app.yml

# KEEP IN SYNC with .gitlab-ci.yml. This template ships CI for both GitHub and
# GitLab so the package can move between them without rewriting pipelines.
# When you change the test matrix, install command, or pytest invocation here,
# mirror the change in .gitlab-ci.yml.
#
# Third-party actions are pinned to commit SHAs (with version comments) for
# supply-chain safety. Dependabot's `github-actions` ecosystem keeps both the
# SHA and the comment in sync.

name: Python application

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.11", "3.12", "3.13"]

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
        with:
          python-version: ${{ matrix.python-version }}
          cache: "pip"
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[test]"
      - name: Type-check with mypy
        if: matrix.python-version == '3.12'
        run: |
          pip install mypy
          mypy my_package
      - name: Run tests with coverage
        run: pytest --cov --cov-report=xml
      - name: Upload coverage report
        if: matrix.python-version == '3.12'
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f  # v7.0.0
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          fail_ci_if_error: false