chore(deps): bundle Dependabot updates + harden dependency review workflows #61

	name: python-tests

	on:
	push:
	branches: [main]
	paths:
	- "socket_basics/*/.py"
	- "tests/*/.py"
	- "pyproject.toml"
	- "uv.lock"
	- "action.yml"
	- ".github/workflows/python-tests.yml"
	pull_request:
	paths:
	- "socket_basics/*/.py"
	- "tests/*/.py"
	- "pyproject.toml"
	- "uv.lock"
	- "action.yml"
	- ".github/workflows/python-tests.yml"
	workflow_dispatch:

	permissions:
	contents: read

	concurrency:
	group: python-tests-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	test:
	runs-on: ubuntu-latest
	timeout-minutes: 20
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	fetch-depth: 1
	persist-credentials: false
	- name: 🐍 Setup Python
	uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
	with:
	python-version: "3.12"
	cache: "pip"
	- name: 🛠️ Install deps
	run: \|
	python -m pip install --upgrade pip uv
	pip install -e ".[dev]"
	- name: 🔐 Assert uv.lock is in sync with pyproject.toml
	# Catches dependency PRs (Dependabot or maintainer) that change
	# pyproject.toml without regenerating the lock, or vice versa.
	run: uv lock --locked
	- name: 🔒 Assert release version metadata is in sync
	run: python3 scripts/sync_release_version.py --check
	- name: 🧪 Run tests
	run: pytest -q tests/

Provide feedback