ci.yml

name: CI
# Main CI pipeline of the repository.
#
# Overview:
# Lint --> test doc build -\
#      \-> test code      ---> deploy docs (*) -> release (**)
#
#  (*): only on push of primary branches + release tags
# (**): only for release version tags (vX.Y.Z)

on:
  push:
    branches: [main, dev]
    tags: ["v*.*.*"]
  pull_request:
    types: [opened, reopened, synchronize, ready_for_review]

jobs:

  lint:
    # run general checks that do not require installing the package
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
      - name: Install poetry
        run: pipx install poetry
      - uses: actions/setup-python@v5
        with:
          python-version: "3.10"

      - name: Install poe, pre-commit and safety
        run: pip install poethepoet pre-commit safety

      # NOTE: using custom cache, to include pre-commit linters + deps
      - uses: actions/cache@v4
        with:
          path: |
            ~/.cache/pre-commit
            ~/.cache/pip
          key: ${{ hashFiles('.pre-commit-config.yaml') }}-pre-commit

      - name: Check that all static analysis tools run without errors
        run: poetry run poe lint --all-files

      - name: Scan dependencies for known vulnerabilities
        run: safety check -r pyproject.toml