Bump the python group across 1 directory with 3 updates #26

	name: CI

	on:
	push:
	branches: [main]
	pull_request:

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	lint:
	name: Lint & format
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	- uses: astral-sh/setup-uv@v7
	with:
	enable-cache: true
	- name: Install dev dependencies
	run: uv sync --group dev
	- name: Ruff format (check only)
	run: uv run ruff format --check .
	- name: Ruff lint
	run: uv run ruff check .

	typecheck:
	name: Type check
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	- uses: astral-sh/setup-uv@v7
	with:
	enable-cache: true
	- run: uv sync --group dev
	- run: uv run mypy

	security:
	name: Security scan
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	- uses: astral-sh/setup-uv@v7
	with:
	enable-cache: true
	- run: uv sync --group dev
	- name: Bandit static analysis
	run: uv run bandit -c pyproject.toml -r jwt_toolkit --severity-level medium
	- name: pip-audit dependency CVEs
	run: uv run pip-audit

	test:
	name: Tests (Python ${{ matrix.python-version }})
	runs-on: ubuntu-latest
	strategy:
	fail-fast: false
	matrix:
	python-version: ["3.13"]
	steps:
	- uses: actions/checkout@v6
	- uses: astral-sh/setup-uv@v7
	with:
	enable-cache: true
	python-version: ${{ matrix.python-version }}
	- run: uv sync --group dev
	- name: Run tests with coverage
	run: uv run pytest --cov --cov-report=term-missing --cov-report=xml -n auto
	- name: Upload coverage artifact
	if: always()
	uses: actions/upload-artifact@v7
	with:
	name: coverage-${{ matrix.python-version }}
	path: coverage.xml
	if-no-files-found: ignore

Provide feedback