name: Code Quality

on:
  workflow_call:
  pull_request:
  push:
    branches: [dev]

permissions:
  contents: read

jobs:
  pre-commit:
    name: Check code quality
    runs-on: ubuntu-latest
    steps:
        - name: Harden Runner
          uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
          with:
            disable-sudo-and-containers: true
            egress-policy: block
            allowed-endpoints: >
              github.com:443
              pypi.org:443
              files.pythonhosted.org:443
              crates.io:443
              index.crates.io:443
              static.crates.io:443

        - name: Checkout code
          uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
          with:
            # for setuptools-scm
            fetch-depth: 0

        - name: Setup Python 3.13
          uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
          with:
            python-version: "3.13"

        - run: echo "::add-matcher::.github/workflows/matchers/mypy.json"

        - name: Run code quality checks - lint, format, spell, & static checks
          uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
          with:
            extra_args: --all-files

