Repository navigation

Tests: slim test_orchestrator.py to behaviour-focused cases (#497 step 1) #1949

	# ONE job: GitHub bills per job rounded UP to a full minute, so five 15-second
	# jobs cost five minutes. The job name `ci` is the sole required-check context
	# in branch protection (scripts/setup_branch_protection.sh).
	name: ci

	on:
	pull_request:
	branches: [main]
	push:
	branches: [main]

	permissions:
	contents: read

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	ci:
	runs-on: ubuntu-24.04
	steps:
	- uses: actions/checkout@v7
	with:
	# Full history: gitleaks scans it (this repo handles credentials).
	fetch-depth: 0
	- uses: astral-sh/setup-uv@v10.2.0
	with:
	enable-cache: true
	- run: uv sync --locked
	- run: uv lock --check
	- run: uv run ruff check .
	- run: uv run ruff format --check .
	- run: uv run mypy
	- run: uv run pytest
	- run: uv run pytest -n0 -m serial # the process-table tests, alone
	# Pinned CLI binary instead of gitleaks/gitleaks-action: the action
	# requires a paid GITLEAKS_LICENSE for org repos; the CLI is free (MIT).
	- name: gitleaks over full history
	run: \|
	curl -sSfL -o gitleaks.tgz https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz
	echo "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb gitleaks.tgz" \| sha256sum -c -
	tar -xzf gitleaks.tgz gitleaks
	./gitleaks git --no-banner --redact --exit-code 1 .