pr-and-push.yml

name: Pull Request and Push Action

on:
  pull_request:  # Safer than pull_request_target for untrusted code
    branches: [ main ]
    types: [opened, synchronize, reopened, ready_for_review]
  push:
    branches: [ main ]  # Also run on direct pushes to main
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  call-test-lint:
    uses: ./.github/workflows/test-lint.yml
    permissions:
      contents: read
    with:
      ref: ${{ github.event.pull_request.head.sha }}
    secrets:
      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  check-api:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
    - name: Checkout code
      uses: actions/checkout@v6
      with:
        fetch-depth: 0  # We the need the full Git history.
    - name: Setup uv
      uses: astral-sh/setup-uv@v7
    - name: Check API breaking changes
      run: |
        if ! uvx griffe check --search src --format github strands --against "main"; then
          echo "Potential API changes detected (review if actually breaking)"
          exit 1
        fi