python-tests.yml

name: Python Tests

# Unit tests for the Python that shapes the site: the LCQL Pygments lexer, the
# release-notes feed generator, the release-notes heading lint, and the
# generated-block hash guard on the Code Security pull-request page.

on:
  push:
    branches:
      - master
  pull_request:
  workflow_dispatch:

# Minimum permissions: this workflow only reads the repository. The job token
# has no write scope and no secrets are exposed to it.
permissions:
  contents: read

jobs:
  test:
    name: Unit tests
    runs-on: ubuntu-latest
    timeout-minutes: 10
    # Run for repository events (push to master, manual dispatch) and for pull
    # requests only when they come from a branch in this repository, never from
    # a fork. Untrusted contributors therefore cannot trigger this job.
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: '3.11'

      - name: Install dependencies
        # requirements.txt is a hashed lock, so it must be installed on its own
        # (pip refuses to mix hashed and unhashed requirements in one command).
        # pytest is a test-only tool, pinned but not part of the docs lock.
        run: |
          pip install --upgrade pip
          pip install -r requirements.txt
          pip install pytest==9.1.1

      - name: Run unit tests
        run: pytest tests/ -v