name: Community checks
on:
  push:
    branches: ["**"]
  pull_request:
  workflow_dispatch:
permissions:
  contents: read
jobs:
  verify:
    # GitHub-hosted disposable runner only; never run forks on the NAS runner.
    if: github.server_url == 'https://github.com'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: '3.14'
      - run: python -m pip install -e '.[test]'
      - run: python -m ruff check pigway_frame_flow tests scripts
      - run: python -m ruff format --check pigway_frame_flow tests scripts
      - run: python -m mypy pigway_frame_flow
      - run: python -m pytest -q
      - run: python scripts/ci-audit.py