lint.yml

name: Lint

on:
  push:
    branches: [ "master" ]
    paths:
      - '**.py'
      - 'pyproject.toml'
      - '.github/workflows/lint.yml'
  # No paths filter on pull requests, so this check can be required before
  # merging: a required check that never starts blocks the pull request. It
  # also covers pull requests that only touch files outside the push filter,
  # such as CHANGELOG.md, whose format tests/test_changelog_release.py checks.
  pull_request:
    branches: [ "master" ]

permissions:
  contents: read

jobs:
  lint:
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false

    - name: Set up Python
      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
      with:
        python-version: "3.14"

    - name: Install uv
      uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0

    - name: Sync dependencies
      run: uv sync --group dev --extra jwt

    # `tests` is linted here too. pre-commit only sees staged files, so test
    # code that was never touched again drifts; that is how the suite came to
    # have unsorted imports, three unformatted files and six type errors that
    # nobody saw. Strict mypy stays package-only, matching CLAUDE.md.
    - name: Ruff check
      run: uv run ruff check fastapi_cachex tests scripts

    - name: Ruff format check
      run: uv run ruff format --check fastapi_cachex tests scripts

    - name: Mypy strict
      run: uv run mypy fastapi_cachex --strict

    - name: Mypy (tests)
      run: uv run mypy tests

    - name: Mypy (scripts)
      run: uv run mypy scripts