test.yaml

---
name: Tests

"on":
  pull_request:
    branches: [main, develop]
    paths:
      - "rebalance/**"
      - "pyproject.toml"
      - "uv.lock"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# Deny all permissions by default for security
permissions: {}

jobs:
  test:
    name: Test (Python ${{ matrix.python-version }})
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.11", "3.12", "3.13"]

    env:
      PYTHON_VERSION: ${{ matrix.python-version }}

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Install uv
        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
        with:
          version: "latest"
          enable-cache: true
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Python ${{ env.PYTHON_VERSION }}
        run: |
          # Use env variable to avoid template injection
          uv python install "$PYTHON_VERSION"

      - name: Install dependencies
        run: |
          uv sync --locked --group dev

      - name: Run all tests with coverage
        run: |
          uv run pytest rebalance/tests/ -v \
            --cov=rebalance \
            --cov-report=xml \
            --cov-report=term-missing \
            --cov-branch

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
        if: always()
        with:
          files: ./coverage.xml
          fail_ci_if_error: false
          verbose: true
          token: ${{ secrets.CODECOV_TOKEN }}