tests.yml

name: Tests

# Runs on PRs and pushes to the default branch. We use `pull_request` (never
# `pull_request_target`), so no secrets are exposed to forks. The test suite
# needs no credentials: SSO signing is verified with a literal test secret.
on:
  pull_request:
  push:
    branches: [main, master]

permissions:
  contents: read

concurrency:
  group: tests-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      # Same install as the test jobs so ruff/mypy resolve to the pinned dev
      # versions (not whatever unpinned latest CI would otherwise grab).
      - run: pip install -e ".[dev]"
      - name: Ruff lint
        run: ruff check fastcomments_django tests example
      - name: Ruff format check
        run: ruff format --check fastcomments_django tests example
      - name: Mypy
        run: mypy

  test:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        # Floor is 3.10: the FastComments SDK's SSO module uses PEP 604 unions.
        python-version: ["3.10", "3.11", "3.12", "3.13"]
        django-version: ["4.2", "5.0", "5.1", "5.2"]
        exclude:
          # Python 3.13 is only supported by Django >= 5.1.
          - python-version: "3.13"
            django-version: "4.2"
          - python-version: "3.13"
            django-version: "5.0"
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"
          # Pin Django to the matrix version (overrides the >=4.2 floor).
          pip install "Django~=${{ matrix.django-version }}.0"
      - name: Run tests
        run: pytest tests/ -v