ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

# Least-privilege: this workflow only reads the repo to run tests.
permissions:
  contents: read

jobs:
  smoke:
    name: Smoke tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-python@v6
        with:
          python-version: "3.11"
      # build.sh is pure bash and vault_health.py is stdlib-only, but the
      # free-research source library imports `requests`, so install that too.
      - name: Install test dependencies
        run: python -m pip install --upgrade pip pytest requests
      - name: Run smoke tests
        run: pytest -q
      # Fail the build if a banned substitution character (em-dash, curly quote,
      # Unicode math, ...) appears in prose in any tracked source file. Characters
      # inside code fences / backtick spans are preserved and never fail.
      - name: Lint substitution characters
        run: python scripts/sweep_non_ascii.py --check