ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

jobs:
  test:
    runs-on: windows-latest
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v4

      - name: Install uv
        uses: astral-sh/setup-uv@v5
        with:
          enable-cache: true

      - name: Set up Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install dependencies
        run: uv sync --group dev

      - name: Compile
        # catches import-time syntax errors before the long test run
        run: uv run python -m compileall -q src FastPrompter.pyw

      - name: Lint
        run: uv run ruff check src/ tests/ tests_smoke/

      - name: Security scan (Medium+ only)
        # Low findings are intentional local desktop operations (startfile,
        # try/except noise); Medium+ has a scoped # nosec per finding with a
        # reason, so a new real finding turns this red.
        run: uv run bandit -q -r src/fastprompter -ll

      - name: Test
        run: uv run pytest tests/ tests_smoke/ -q