ci.yml

---
name: CI

on:
  push:
    branches: [trunk]
    tags: ["*"]
  pull_request:
    branches: [trunk]
  workflow_dispatch:

env:
  FORCE_COLOR: "1"
  PIP_DISABLE_VERSION_CHECK: "1"

permissions:
  contents: read

jobs:
  tests:
    name: nox on ${{ matrix.python-version }}
    runs-on: ubuntu-latest

    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.8", "3.9", "3.10", "3.11", "3.12"]

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            docs.djangoproject.com:443
            docs.python.org:443
            files.pythonhosted.org:443
            github.com:443
            pypi.org:443
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
      - name: "Install dependencies"
        run: |
          python -VV
          python -Im site
          python -Im pip install --upgrade pip setuptools wheel
          python -Im pip install --upgrade nox
          python -Im nox --version
      - name: "Run CI suite with nox"
        run: "python -Im nox --non-interactive --error-on-external-run --python ${{ matrix.python-version }}"