check-python.yaml

name: Check Python Code

on:
  workflow_call:

jobs:
  check-python:
    runs-on: "ubuntu-latest"
    steps:
      - name: Checkout source code
        uses: actions/checkout@v6

      - name: Set up Python 3.12
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Set up uv
        uses: ./.github/actions/setup-uv
        with:
          extra-sync-args: "--group docs"

      - name: Audit with pip-audit
        run: |
          set -o pipefail
          uv export --no-dev --no-group docs --no-emit-project -o requirements.txt
          # CVE-2026-4539: low-severity ReDoS in pygments (transitive dep), no fix available as of 2026-03-27
          uv run pip-audit -r requirements.txt --ignore-vuln CVE-2026-4539

      - name: Check formatting with Ruff
        run: uv run ruff format --check .

      - name: Check linting with Ruff
        run: uv run ruff check .

      - name: Check types with mypy
        run: uv run mypy

      - name: Check docs are up to date
        run: |
          set -o pipefail
          uv run poe docs-cli
          [ $(git status --porcelain docs/ | wc -l) -eq "0" ]