ci.yml

name: CI

on:
  push:
  pull_request:

# Least privilege (AC-039). This workflow only reads the repository and runs
# tests: it publishes nothing, comments nothing, and touches no GitHub state.
# The default token grant is not relied on — prior runs succeeding under the
# default does not establish that the default is appropriate.
permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ["3.10", "3.12"]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: ${{ matrix.python-version }}
      # The no-network reinstall later in `make ci` must find the declared build backend
      # locally. Python 3.12+ runner virtual environments do not guarantee setuptools.
      - run: python -m pip install "setuptools>=61,<85"
      - run: python -m pip install -e ".[test]" -c constraints.txt
      - name: Record the exact installed dependency set
        run: pip freeze --exclude-editable
      - run: make ci
      - name: AC-039 public falsification harness
        run: python3 falsify.py