test.yml

name: Test

on:
  push:
    branches: [ "master" ]
    paths:
      - '**.py'
      - 'pyproject.toml'
      - '.github/workflows/test.yml'
  # No paths filter on pull requests, so this check can be required before
  # merging: a required check that never starts blocks the pull request. It
  # also covers pull requests that only touch files outside the push filter,
  # such as CHANGELOG.md, whose format tests/test_changelog_release.py checks.
  pull_request:
    branches: [ "master" ]

permissions:
  contents: read

jobs:
  # The one CI run of the 3.10-3.14 matrix. tox runs the same suites against
  # the same lockfile, so it is left to local use rather than run here twice.
  # A run against the lowest supported dependency versions would be a
  # separate job next to this one.
  test:
    runs-on: ubuntu-latest

    services:
      memcached:
        image: memcached:1.6-alpine
        ports:
          - 11211:11211

      redis:
        image: redis:alpine
        ports:
          - 6379:6379

    strategy:
      matrix:
        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]

    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false

    - name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
      with:
        python-version: ${{ matrix.python-version }}

    - name: Install uv
      uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0

    - name: Sync dependencies
      run: uv sync --extra jwt

    - name: Run tests
      run: uv run coverage run -m pytest && uv run coverage report
      env:
        # The suites that talk to a real server are opt-in: they wipe what they
        # connect to, so they skip unless a port is named. These are the service
        # containers above, which exist only for this job.
        CACHEX_TEST_REDIS_PORT: 6379
        CACHEX_TEST_MEMCACHED_PORT: 11211
        # ...and here the services are this workflow's own responsibility, so a
        # skipped suite is a broken job, not a safe default. Without this a
        # wrong port silently drops those tests and the run is still green:
        # coverage stays near 97%, well over the 90% gate.
        CACHEX_REQUIRE_LIVE_SERVERS: 1