python-ci.yml

name: '⚙️ Continuous Integration'

on:
  workflow_call:
    inputs:
      python-version:
        description: 'Python version to use'
        type: string
        default: '3.11'
      uv-version:
        description: 'UV version to use'
        type: string
        default: '0.11.3'
      source-paths:
        description: 'Source paths for quality checks'
        type: string
        default: 'src/ tests/'
      test-directory:
        description: 'Test directory'
        type: string
        default: 'tests/'
      coverage-threshold:
        description: 'Coverage threshold percentage'
        type: number
        default: 80
      run-security:
        description: 'Run security scanning (bandit)'
        type: boolean
        default: true
      run-secret-scan:
        description: 'Run secret scanning (TruffleHog, Gitleaks)'
        type: boolean
        default: true
      # Off by default because it preserves what this workflow has always done:
      # the dependency audit was wrapped in `|| true` at every call site, so a
      # finding has never stopped a build. Turning it on is a per-repo decision
      # -- thirteen repositories call this workflow, and a shared default that
      # reddens all of them at once is not one this workflow should make.
      fail-on-vulnerability:
        description: 'Fail the security job when pip-audit reports a known vulnerability'
        type: boolean
        default: false
      ignore-vulnerabilities:
        description: 'Advisory IDs the project has accepted, comma-separated'
        type: string
        default: ''
      run-performance:
        description: 'Run performance tests'
        type: boolean
        default: false
      matrix-testing:
        description: 'Enable matrix testing across Python versions (3.11, 3.12, 3.13, 3.14)'
        type: boolean
        default: false
      platform-preset:
        description: 'Platform preset: minimal (linux x64 only), standard (linux + macos + windows amd64), full (+ windows arm64)'
        type: string
        default: 'standard'
      include-windows:
        description: 'Include Windows amd64 under the minimal preset, which does not carry it. standard and full already do'
        type: boolean
        default: false
      # Separate from include-windows because the two are not equally available.
      # A project can be healthy on Windows amd64 and unable to install at all
      # on Windows arm64: grpcio 1.83.0 publishes win32 and win_amd64 wheels
      # only (grpc/grpc#39064 open upstream) and cryptography 50.0.0 publishes
      # win_amd64 only, so anything requiring them fails during `uv sync` on
      # windows-11-arm long before a test runs. Asking for Windows coverage
      # should not force a caller to take a permanently red job.
      include-windows-arm:
        description: 'Include Windows arm64 (off by default; see the note above on wheel availability)'
        type: boolean
        default: false
      fail-fast:
        description: 'Fail fast in matrix builds'
        type: boolean
        default: false
      upload-coverage:
        description: 'Upload coverage to Codecov'
        type: boolean
        default: false
      parallel-testing:
        description: 'Enable parallel test execution with pytest-xdist (may break with some pytest plugins)'
        type: boolean
        default: true
      use-wrknv:
        description: 'Run checks via this repo''s wrknv task runner (we run <task>) instead of raw tool invocations, for local/CI command parity'
        type: boolean
        default: false
      run-tests:
        description: 'Run the pytest job(s). Disable for repos whose real verification is not pytest-based (e.g. binary conformance suites)'
        type: boolean
        default: true
      no-sources:
        description: 'Resolve dependencies from the registry, ignoring [tool.uv.sources]. Suite repos point siblings at ../<repo> for local development; CI checks out one repo, so those paths do not exist here and the published metadata is what should be verified anyway'
        type: boolean
        default: false
      # --- branch pins -------------------------------------------------------
      # Force a package to resolve from a git ref instead of the registry, so a
      # PR here can build against an unreleased change in a sibling repo. See
      # docs/branch-pins.md for the layers and their precedence.
      dispatch-pins:
        description: 'Pins from the caller''s workflow_dispatch input, as <pkg>@<ref> (highest precedence)'
        type: string
        default: ''
      package-pins:
        description: 'Pins fixed by the calling workflow, as <pkg>@<ref>'
        type: string
        default: ''
      pins-file:
        description: 'Branch-scoped pins file; the only layer that carries when-conditions'
        type: string
        default: '.ci/pins.toml'
      auto-pin-siblings:
        description: 'Pin any sibling repo that has a branch with the same name as this one. Off by default: it makes the result depend on state outside the commit'
        type: boolean
        default: false
      sibling-repos:
        description: 'Sibling repository names considered for auto-pinning. Empty derives them from this project''s dependencies, so no caller has to keep a list of its siblings in step'
        type: string
        default: ''
      pin-allowed-orgs:
        description: 'Glob patterns, as host/owner/repo, that a pin URL must match'
        type: string
        default: 'github.com/provide-io/*,github.com/livingstaccato/*'
      pin-inputs-json:
        description: 'JSON object of caller values matched by a pin''s when.input condition'
        type: string
        default: '{}'
      block-merge-on-pins:
        description: 'Fail the separate No Active Pins check while any pin is active, so branch protection can stop a pinned pull request merging. A pin is not carried by the merge, so the default branch would resolve from the registry without it. Set false to report the pins as a warning instead; the check still runs either way, because a required check that never reports blocks a repository forever'
        type: boolean
        default: true
    secrets:
      CODECOV_TOKEN:
        description: 'Codecov token for coverage upload'
        required: false

env:
  # NOTE: Do NOT set FORCE_COLOR=1 here - it breaks pytest-xdist's execnet
  # subprocess communication which expects plain output during bootstrap
  UV_SYSTEM_PYTHON: "1"
  # provide-foundation's tests/utils/timing.apply_timeout_factor() scales any
  # timeout >= 5s by this factor when set. Real-time filesystem-watcher tests
  # in that repo need the slack under -n auto's CPU contention; unused by
  # every other repo on this workflow, so it's a no-op elsewhere.
  PROVIDE_TEST_TIMEOUT_FACTOR: "3"

jobs:
  # ==================================================================================
  # 🔧 Code Quality & Type Checking
  # ==================================================================================
  quality:
    name: 🔧 Code Quality
    runs-on: ubuntu-24.04
    steps:
      - name: 📥 Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: 📥 Checkout ci-tooling
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          repository: provide-io/ci-tooling
          # The commit this reusable workflow is running from, so scripts/ come
          # from the same ref the caller pinned rather than always the moving
          # tag. That is what makes a SHA pin cover the whole thing. Falls back
          # to v0 under act, which does not populate job_workflow_sha.
          ref: ${{ github.job_workflow_sha || 'v0' }}
          path: .ci-tooling

      - name: 🐍 Setup Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
        with:
          python-version: ${{ inputs.python-version }}

      # Work out which packages this run pins. Runs before uv exists because the
      # digest it emits becomes uv's cache suffix: a pinned run must not share a
      # cache entry with an unpinned one.
      - name: 📌 Resolve branch pins
        id: pins
        uses: ./.ci-tooling/actions/resolve-pins
        with:
          dispatch-pins: ${{ inputs.dispatch-pins }}
          variable-pins: ${{ vars.CI_PINS }}
          caller-pins: ${{ inputs.package-pins }}
          pins-file: ${{ inputs.pins-file }}
          auto-pin-siblings: ${{ inputs.auto-pin-siblings }}
          sibling-repos: ${{ inputs.sibling-repos }}
          allowed-orgs: ${{ inputs.pin-allowed-orgs }}
          label-pins-json: ${{ toJSON(github.event.pull_request.labels.*.name) }}
          inputs-json: ${{ inputs.pin-inputs-json }}

      - name: ⚡ Install UV
        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
        with:
          version: ${{ inputs.uv-version }}
          enable-cache: true
          cache-suffix: pins-${{ steps.pins.outputs.digest }}

      # Patch the pins into [tool.uv] override-dependencies. uv honours overrides
      # only from pyproject.toml, so the file has to be rewritten on disk.
      - name: 📌 Apply branch pins
        uses: ./.ci-tooling/actions/apply-pins
        with:
          pins: ${{ steps.pins.outputs.pins }}

      - name: 📦 Install dependencies
        if: ${{ !inputs.use-wrknv }}
        run: uv sync --group dev ${{ inputs.no-sources && '--no-sources' || '' }}

      - name: 📦 Install dependencies (wrknv)
        if: inputs.use-wrknv
        run: uv sync --all-groups ${{ inputs.no-sources && '--no-sources' || '' }}

      - name: 🔧 Install wrknv
        if: inputs.use-wrknv
        run: uv pip install --python .venv/bin/python "wrknv @ git+https://github.com/provide-io/wrknv.git@main"

      # uv silently ignores an override for a package nothing depends on, so a
      # mistyped or misnamed pin would otherwise produce a green run against
      # unpinned code. This reads the lockfile and insists the pin is in it.
      - name: 📌 Verify branch pins took effect
        uses: ./.ci-tooling/actions/verify-pins
        with:
          pins: ${{ steps.pins.outputs.pins }}

      - name: 🎨 Check formatting with Ruff
        if: ${{ !inputs.use-wrknv }}
        run: |
          source .venv/bin/activate
          .ci-tooling/scripts/quality/run-ruff-format.sh "${{ inputs.source-paths }}" true

      - name: 🎨 Check formatting (wrknv)
        if: inputs.use-wrknv
        run: .venv/bin/we run format.check

      - name: 🔍 Lint with Ruff
        if: ${{ !inputs.use-wrknv }}
        run: |
          source .venv/bin/activate
          .ci-tooling/scripts/quality/run-ruff-lint.sh "${{ inputs.source-paths }}" false

      - name: 🔍 Lint (wrknv)
        if: inputs.use-wrknv
        run: .venv/bin/we run lint

      - name: 🔒 Type check with MyPy
        if: ${{ !inputs.use-wrknv }}
        run: |
          source .venv/bin/activate
          .ci-tooling/scripts/quality/run-mypy.sh src/ false || true

      - name: 🔒 Type check (wrknv)
        if: inputs.use-wrknv
        run: .venv/bin/we run typecheck

  # ==================================================================================
  # 🧪 Tests - Platform Matrix
  # ==================================================================================
  # These names carry the platform only. GitHub appends the matrix value itself
  # -- "🧪 Tests linux_amd64 (3.11)" -- so the Python version is still on every
  # row, including the four a `matrix-testing: true` consumer spawns. A name that
  # referenced matrix directly would read back raw as
  # "py${{ matrix.python-version }}" on any row gated off by `if:`, because a
  # skipped job has no matrix context to interpolate against. Parentheses are
  # left out of the platform for the same reason: GitHub's suffix supplies them.
  test:
    name: 🧪 Tests linux_amd64
    needs: quality
    if: inputs.run-tests
    runs-on: ubuntu-24.04
    strategy:
      # act cannot evaluate workflow_call boolean expressions here.
      fail-fast: false
      matrix:
        python-version: ${{ fromJson(inputs.matrix-testing && '["3.11", "3.12", "3.13", "3.14"]' || format('["{0}"]', inputs.python-version)) }}
    steps:
      - name: 📥 Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: 📥 Checkout ci-tooling
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          repository: provide-io/ci-tooling
          # The commit this reusable workflow is running from, so scripts/ come
          # from the same ref the caller pinned rather than always the moving
          # tag. That is what makes a SHA pin cover the whole thing. Falls back
          # to v0 under act, which does not populate job_workflow_sha.
          ref: ${{ github.job_workflow_sha || 'v0' }}
          path: .ci-tooling

      - name: 🐍 Setup Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
        with:
          python-version: ${{ matrix.python-version }}

      # Work out which packages this run pins. Runs before uv exists because the
      # digest it emits becomes uv's cache suffix: a pinned run must not share a
      # cache entry with an unpinned one.
      - name: 📌 Resolve branch pins
        id: pins
        uses: ./.ci-tooling/actions/resolve-pins
        with:
          dispatch-pins: ${{ inputs.dispatch-pins }}
          variable-pins: ${{ vars.CI_PINS }}
          caller-pins: ${{ inputs.package-pins }}
          pins-file: ${{ inputs.pins-file }}
          auto-pin-siblings: ${{ inputs.auto-pin-siblings }}
          sibling-repos: ${{ inputs.sibling-repos }}
          allowed-orgs: ${{ inputs.pin-allowed-orgs }}
          label-pins-json: ${{ toJSON(github.event.pull_request.labels.*.name) }}
          inputs-json: ${{ inputs.pin-inputs-json }}

      - name: ⚡ Install UV
        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
        with:
          version: ${{ inputs.uv-version }}
          enable-cache: true
          cache-suffix: pins-${{ steps.pins.outputs.digest }}

      # Patch the pins into [tool.uv] override-dependencies. uv honours overrides
      # only from pyproject.toml, so the file has to be rewritten on disk.
      - name: 📌 Apply branch pins
        uses: ./.ci-tooling/actions/apply-pins
        with:
          pins: ${{ steps.pins.outputs.pins }}

      - name: 📦 Install dependencies
        if: ${{ !inputs.use-wrknv }}
        run: uv sync --group dev ${{ inputs.no-sources && '--no-sources' || '' }}

      - name: 📦 Install dependencies (wrknv)
        if: inputs.use-wrknv
        run: uv sync --all-groups ${{ inputs.no-sources && '--no-sources' || '' }}

      - name: 🔧 Install wrknv
        if: inputs.use-wrknv
        run: uv pip install --python .venv/bin/python "wrknv @ git+https://github.com/provide-io/wrknv.git@main"

      # uv silently ignores an override for a package nothing depends on, so a
      # mistyped or misnamed pin would otherwise produce a green run against
      # unpinned code. This reads the lockfile and insists the pin is in it.
      - name: 📌 Verify branch pins took effect
        uses: ./.ci-tooling/actions/verify-pins
        with:
          pins: ${{ steps.pins.outputs.pins }}

      - name: 🧪 Run Tests
        if: ${{ !inputs.use-wrknv }}
        run: |
          source .venv/bin/activate
          .ci-tooling/scripts/test/run-pytest.sh "${{ inputs.test-directory }}" ${{ inputs.coverage-threshold }} ${{ inputs.parallel-testing }}

      - name: 🧪 Run Tests (wrknv)
        if: inputs.use-wrknv
        run: .venv/bin/we run ci.test

      - name: 📤 Upload Coverage
        if: inputs.upload-coverage && !inputs.use-wrknv && github.actor != 'nektos/act'
        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5  # v7.1.1
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          file: ./coverage.xml
          flags: unittests
          name: codecov-linux_amd64-py${{ matrix.python-version }}

  # Additional platform tests (standard/full presets)
  test-linux-arm:
    name: 🧪 Tests linux_arm64
    needs: quality
    if: inputs.run-tests && (inputs.platform-preset == 'standard' || inputs.platform-preset == 'full') && github.actor != 'nektos/act'
    runs-on: ubuntu-24.04-arm
    strategy:
      fail-fast: false
      matrix:
        python-version: ${{ fromJson(inputs.matrix-testing && '["3.11", "3.12", "3.13", "3.14"]' || format('["{0}"]', inputs.python-version)) }}
    steps:
      - name: 📥 Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: 📥 Checkout ci-tooling
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          repository: provide-io/ci-tooling
          # The commit this reusable workflow is running from, so scripts/ come
          # from the same ref the caller pinned rather than always the moving
          # tag. That is what makes a SHA pin cover the whole thing. Falls back
          # to v0 under act, which does not populate job_workflow_sha.
          ref: ${{ github.job_workflow_sha || 'v0' }}
          path: .ci-tooling

      - name: 🐍 Setup Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
        with:
          python-version: ${{ matrix.python-version }}

      # Work out which packages this run pins. Runs before uv exists because the
      # digest it emits becomes uv's cache suffix: a pinned run must not share a
      # cache entry with an unpinned one.
      - name: 📌 Resolve branch pins
        id: pins
        uses: ./.ci-tooling/actions/resolve-pins
        with:
          dispatch-pins: ${{ inputs.dispatch-pins }}
          variable-pins: ${{ vars.CI_PINS }}
          caller-pins: ${{ inputs.package-pins }}
          pins-file: ${{ inputs.pins-file }}
          auto-pin-siblings: ${{ inputs.auto-pin-siblings }}
          sibling-repos: ${{ inputs.sibling-repos }}
          allowed-orgs: ${{ inputs.pin-allowed-orgs }}
          label-pins-json: ${{ toJSON(github.event.pull_request.labels.*.name) }}
          inputs-json: ${{ inputs.pin-inputs-json }}

      - name: ⚡ Install UV
        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
        with:
          version: ${{ inputs.uv-version }}
          enable-cache: true
          cache-suffix: pins-${{ steps.pins.outputs.digest }}

      # Patch the pins into [tool.uv] override-dependencies. uv honours overrides
      # only from pyproject.toml, so the file has to be rewritten on disk.
      - name: 📌 Apply branch pins
        uses: ./.ci-tooling/actions/apply-pins
        with:
          pins: ${{ steps.pins.outputs.pins }}

      - name: 📦 Install dependencies
        if: ${{ !inputs.use-wrknv }}
        run: uv sync --group dev ${{ inputs.no-sources && '--no-sources' || '' }}

      - name: 📦 Install dependencies (wrknv)
        if: inputs.use-wrknv
        run: uv sync --all-groups ${{ inputs.no-sources && '--no-sources' || '' }}

      - name: 🔧 Install wrknv
        if: inputs.use-wrknv
        run: uv pip install --python .venv/bin/python "wrknv @ git+https://github.com/provide-io/wrknv.git@main"

      # uv silently ignores an override for a package nothing depends on, so a
      # mistyped or misnamed pin would otherwise produce a green run against
      # unpinned code. This reads the lockfile and insists the pin is in it.
      - name: 📌 Verify branch pins took effect
        uses: ./.ci-tooling/actions/verify-pins
        with:
          pins: ${{ steps.pins.outputs.pins }}

      - name: 🧪 Run Tests
        if: ${{ !inputs.use-wrknv }}
        run: |
          source .venv/bin/activate
          .ci-tooling/scripts/test/run-pytest.sh "${{ inputs.test-directory }}" ${{ inputs.coverage-threshold }} ${{ inputs.parallel-testing }}

      - name: 🧪 Run Tests (wrknv)
        if: inputs.use-wrknv
        run: .venv/bin/we run ci.test

  test-macos-arm:
    name: 🧪 Tests darwin_arm64
    needs: quality
    if: inputs.run-tests && (inputs.platform-preset == 'standard' || inputs.platform-preset == 'full') && github.actor != 'nektos/act'
    runs-on: macos-15
    strategy:
      fail-fast: false
      matrix:
        python-version: ${{ fromJson(inputs.matrix-testing && '["3.11", "3.12", "3.13", "3.14"]' || format('["{0}"]', inputs.python-version)) }}
    steps:
      - name: 📥 Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: 📥 Checkout ci-tooling
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          repository: provide-io/ci-tooling
          # The commit this reusable workflow is running from, so scripts/ come
          # from the same ref the caller pinned rather than always the moving
          # tag. That is what makes a SHA pin cover the whole thing. Falls back
          # to v0 under act, which does not populate job_workflow_sha.
          ref: ${{ github.job_workflow_sha || 'v0' }}
          path: .ci-tooling

      - name: 🐍 Setup Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
        with:
          python-version: ${{ matrix.python-version }}

      # Work out which packages this run pins. Runs before uv exists because the
      # digest it emits becomes uv's cache suffix: a pinned run must not share a
      # cache entry with an unpinned one.
      - name: 📌 Resolve branch pins
        id: pins
        uses: ./.ci-tooling/actions/resolve-pins
        with:
          dispatch-pins: ${{ inputs.dispatch-pins }}
          variable-pins: ${{ vars.CI_PINS }}
          caller-pins: ${{ inputs.package-pins }}
          pins-file: ${{ inputs.pins-file }}
          auto-pin-siblings: ${{ inputs.auto-pin-siblings }}
          sibling-repos: ${{ inputs.sibling-repos }}
          allowed-orgs: ${{ inputs.pin-allowed-orgs }}
          label-pins-json: ${{ toJSON(github.event.pull_request.labels.*.name) }}
          inputs-json: ${{ inputs.pin-inputs-json }}

      - name: ⚡ Install UV
        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
        with:
          version: ${{ inputs.uv-version }}
          enable-cache: true
          cache-suffix: pins-${{ steps.pins.outputs.digest }}

      # Patch the pins into [tool.uv] override-dependencies. uv honours overrides
      # only from pyproject.toml, so the file has to be rewritten on disk.
      - name: 📌 Apply branch pins
        uses: ./.ci-tooling/actions/apply-pins
        with:
          pins: ${{ steps.pins.outputs.pins }}

      - name: 📦 Install dependencies
        if: ${{ !inputs.use-wrknv }}
        run: uv sync --group dev ${{ inputs.no-sources && '--no-sources' || '' }}

      - name: 📦 Install dependencies (wrknv)
        if: inputs.use-wrknv
        run: uv sync --all-groups ${{ inputs.no-sources && '--no-sources' || '' }}

      - name: 🔧 Install wrknv
        if: inputs.use-wrknv
        run: uv pip install --python .venv/bin/python "wrknv @ git+https://github.com/provide-io/wrknv.git@main"

      # uv silently ignores an override for a package nothing depends on, so a
      # mistyped or misnamed pin would otherwise produce a green run against
      # unpinned code. This reads the lockfile and insists the pin is in it.
      - name: 📌 Verify branch pins took effect
        uses: ./.ci-tooling/actions/verify-pins
        with:
          pins: ${{ steps.pins.outputs.pins }}

      - name: 🧪 Run Tests
        if: ${{ !inputs.use-wrknv }}
        run: |
          source .venv/bin/activate
          .ci-tooling/scripts/test/run-pytest.sh "${{ inputs.test-directory }}" ${{ inputs.coverage-threshold }} ${{ inputs.parallel-testing }}

      - name: 🧪 Run Tests (wrknv)
        if: inputs.use-wrknv
        run: .venv/bin/we run ci.test

  test-macos-intel:
    name: 🧪 Tests darwin_amd64
    needs: quality
    if: inputs.run-tests && (inputs.platform-preset == 'standard' || inputs.platform-preset == 'full') && github.actor != 'nektos/act'
    runs-on: macos-15-intel
    strategy:
      fail-fast: false
      matrix:
        python-version: ${{ fromJson(inputs.matrix-testing && '["3.11", "3.12", "3.13", "3.14"]' || format('["{0}"]', inputs.python-version)) }}
    steps:
      - name: 📥 Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: 📥 Checkout ci-tooling
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          repository: provide-io/ci-tooling
          # The commit this reusable workflow is running from, so scripts/ come
          # from the same ref the caller pinned rather than always the moving
          # tag. That is what makes a SHA pin cover the whole thing. Falls back
          # to v0 under act, which does not populate job_workflow_sha.
          ref: ${{ github.job_workflow_sha || 'v0' }}
          path: .ci-tooling

      - name: 🐍 Setup Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
        with:
          python-version: ${{ matrix.python-version }}

      # Work out which packages this run pins. Runs before uv exists because the
      # digest it emits becomes uv's cache suffix: a pinned run must not share a
      # cache entry with an unpinned one.
      - name: 📌 Resolve branch pins
        id: pins
        uses: ./.ci-tooling/actions/resolve-pins
        with:
          dispatch-pins: ${{ inputs.dispatch-pins }}
          variable-pins: ${{ vars.CI_PINS }}
          caller-pins: ${{ inputs.package-pins }}
          pins-file: ${{ inputs.pins-file }}
          auto-pin-siblings: ${{ inputs.auto-pin-siblings }}
          sibling-repos: ${{ inputs.sibling-repos }}
          allowed-orgs: ${{ inputs.pin-allowed-orgs }}
          label-pins-json: ${{ toJSON(github.event.pull_request.labels.*.name) }}
          inputs-json: ${{ inputs.pin-inputs-json }}

      - name: ⚡ Install UV
        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
        with:
          version: ${{ inputs.uv-version }}
          enable-cache: true
          cache-suffix: pins-${{ steps.pins.outputs.digest }}

      # Patch the pins into [tool.uv] override-dependencies. uv honours overrides
      # only from pyproject.toml, so the file has to be rewritten on disk.
      - name: 📌 Apply branch pins
        uses: ./.ci-tooling/actions/apply-pins
        with:
          pins: ${{ steps.pins.outputs.pins }}

      - name: 📦 Install dependencies
        if: ${{ !inputs.use-wrknv }}
        run: uv sync --group dev ${{ inputs.no-sources && '--no-sources' || '' }}

      - name: 📦 Install dependencies (wrknv)
        if: inputs.use-wrknv
        run: uv sync --all-groups ${{ inputs.no-sources && '--no-sources' || '' }}

      - name: 🔧 Install wrknv
        if: inputs.use-wrknv
        run: uv pip install --python .venv/bin/python "wrknv @ git+https://github.com/provide-io/wrknv.git@main"

      # uv silently ignores an override for a package nothing depends on, so a
      # mistyped or misnamed pin would otherwise produce a green run against
      # unpinned code. This reads the lockfile and insists the pin is in it.
      - name: 📌 Verify branch pins took effect
        uses: ./.ci-tooling/actions/verify-pins
        with:
          pins: ${{ steps.pins.outputs.pins }}

      - name: 🧪 Run Tests
        if: ${{ !inputs.use-wrknv }}
        run: |
          source .venv/bin/activate
          .ci-tooling/scripts/test/run-pytest.sh "${{ inputs.test-directory }}" ${{ inputs.coverage-threshold }} ${{ inputs.parallel-testing }}

      - name: 🧪 Run Tests (wrknv)
        if: inputs.use-wrknv
        run: .venv/bin/we run ci.test

  # Windows amd64 tests. Carried by standard because Windows is where this
  # org's platform bugs actually land -- a scrubbed environment that cannot
  # start a process, ntpath.expanduser ignoring HOME, a TCP-only transport
  # default -- and none of them are reachable from linux or macos. The runner
  # holds up: 70 of 71 recent runs across pyvider, pyvider-rpcplugin and
  # provide-foundation, the one failure being a sleep test that asserted a
  # ceiling the platform's 15.6ms timer granularity cannot meet.
  test-windows:
    name: 🧪 Tests windows_amd64
    needs: quality
    if: inputs.run-tests && (inputs.platform-preset == 'standard' || inputs.platform-preset == 'full' || inputs.include-windows) && github.actor != 'nektos/act'
    runs-on: windows-2022
    strategy:
      fail-fast: false
      matrix:
        python-version: ${{ fromJson(inputs.matrix-testing && '["3.11", "3.12", "3.13", "3.14"]' || format('["{0}"]', inputs.python-version)) }}
    steps:
      - name: 📥 Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: 📥 Checkout ci-tooling
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          repository: provide-io/ci-tooling
          # The commit this reusable workflow is running from, so scripts/ come
          # from the same ref the caller pinned rather than always the moving
          # tag. That is what makes a SHA pin cover the whole thing. Falls back
          # to v0 under act, which does not populate job_workflow_sha.
          ref: ${{ github.job_workflow_sha || 'v0' }}
          path: .ci-tooling

      - name: 🐍 Setup Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
        with:
          python-version: ${{ matrix.python-version }}

      # Work out which packages this run pins. Runs before uv exists because the
      # digest it emits becomes uv's cache suffix: a pinned run must not share a
      # cache entry with an unpinned one.
      - name: 📌 Resolve branch pins
        id: pins
        uses: ./.ci-tooling/actions/resolve-pins
        with:
          dispatch-pins: ${{ inputs.dispatch-pins }}
          variable-pins: ${{ vars.CI_PINS }}
          caller-pins: ${{ inputs.package-pins }}
          pins-file: ${{ inputs.pins-file }}
          auto-pin-siblings: ${{ inputs.auto-pin-siblings }}
          sibling-repos: ${{ inputs.sibling-repos }}
          allowed-orgs: ${{ inputs.pin-allowed-orgs }}
          label-pins-json: ${{ toJSON(github.event.pull_request.labels.*.name) }}
          inputs-json: ${{ inputs.pin-inputs-json }}

      - name: ⚡ Install UV
        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
        with:
          version: ${{ inputs.uv-version }}
          enable-cache: true
          cache-suffix: pins-${{ steps.pins.outputs.digest }}

      # Patch the pins into [tool.uv] override-dependencies. uv honours overrides
      # only from pyproject.toml, so the file has to be rewritten on disk.
      - name: 📌 Apply branch pins
        uses: ./.ci-tooling/actions/apply-pins
        with:
          pins: ${{ steps.pins.outputs.pins }}

      - name: 📦 Install dependencies
        run: uv sync --group dev ${{ inputs.no-sources && '--no-sources' || '' }}

      # uv silently ignores an override for a package nothing depends on, so a
      # mistyped or misnamed pin would otherwise produce a green run against
      # unpinned code. This reads the lockfile and insists the pin is in it.
      - name: 📌 Verify branch pins took effect
        uses: ./.ci-tooling/actions/verify-pins
        with:
          pins: ${{ steps.pins.outputs.pins }}

      - name: 🧪 Run Tests
        shell: pwsh
        run: |
          .venv\Scripts\Activate.ps1
          pytest ${{ inputs.test-directory }} -v --tb=short

  test-windows-arm:
    name: 🧪 Tests windows_arm64
    needs: quality
    # `full` still means every platform, so a caller asking for full is
    # unaffected. What changed is that include-windows no longer drags arm64
    # in with it.
    if: inputs.run-tests && (inputs.platform-preset == 'full' || inputs.include-windows-arm) && github.actor != 'nektos/act'
    runs-on: windows-11-arm
    strategy:
      fail-fast: false
      matrix:
        python-version: ${{ fromJson(inputs.matrix-testing && '["3.11", "3.12", "3.13", "3.14"]' || format('["{0}"]', inputs.python-version)) }}
    steps:
      - name: 📥 Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: 📥 Checkout ci-tooling
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          repository: provide-io/ci-tooling
          # The commit this reusable workflow is running from, so scripts/ come
          # from the same ref the caller pinned rather than always the moving
          # tag. That is what makes a SHA pin cover the whole thing. Falls back
          # to v0 under act, which does not populate job_workflow_sha.
          ref: ${{ github.job_workflow_sha || 'v0' }}
          path: .ci-tooling

      - name: 🐍 Setup Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
        with:
          python-version: ${{ matrix.python-version }}

      # Work out which packages this run pins. Runs before uv exists because the
      # digest it emits becomes uv's cache suffix: a pinned run must not share a
      # cache entry with an unpinned one.
      - name: 📌 Resolve branch pins
        id: pins
        uses: ./.ci-tooling/actions/resolve-pins
        with:
          dispatch-pins: ${{ inputs.dispatch-pins }}
          variable-pins: ${{ vars.CI_PINS }}
          caller-pins: ${{ inputs.package-pins }}
          pins-file: ${{ inputs.pins-file }}
          auto-pin-siblings: ${{ inputs.auto-pin-siblings }}
          sibling-repos: ${{ inputs.sibling-repos }}
          allowed-orgs: ${{ inputs.pin-allowed-orgs }}
          label-pins-json: ${{ toJSON(github.event.pull_request.labels.*.name) }}
          inputs-json: ${{ inputs.pin-inputs-json }}

      - name: ⚡ Install UV
        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
        with:
          version: ${{ inputs.uv-version }}
          enable-cache: true
          cache-suffix: pins-${{ steps.pins.outputs.digest }}

      # Patch the pins into [tool.uv] override-dependencies. uv honours overrides
      # only from pyproject.toml, so the file has to be rewritten on disk.
      - name: 📌 Apply branch pins
        uses: ./.ci-tooling/actions/apply-pins
        with:
          pins: ${{ steps.pins.outputs.pins }}

      - name: 📦 Install dependencies
        run: uv sync --group dev ${{ inputs.no-sources && '--no-sources' || '' }}

      # uv silently ignores an override for a package nothing depends on, so a
      # mistyped or misnamed pin would otherwise produce a green run against
      # unpinned code. This reads the lockfile and insists the pin is in it.
      - name: 📌 Verify branch pins took effect
        uses: ./.ci-tooling/actions/verify-pins
        with:
          pins: ${{ steps.pins.outputs.pins }}

      - name: 🧪 Run Tests
        shell: pwsh
        run: |
          .venv\Scripts\Activate.ps1
          pytest ${{ inputs.test-directory }} -v --tb=short

  # ==================================================================================
  # 🔒 Security Scanning
  # ==================================================================================
  security:
    name: 🔒 Security
    needs: quality
    if: inputs.run-security
    runs-on: ubuntu-24.04
    permissions:
      security-events: write
      contents: read
    steps:
      - name: 📥 Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: 📥 Checkout ci-tooling
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          repository: provide-io/ci-tooling
          # The commit this reusable workflow is running from, so scripts/ come
          # from the same ref the caller pinned rather than always the moving
          # tag. That is what makes a SHA pin cover the whole thing. Falls back
          # to v0 under act, which does not populate job_workflow_sha.
          ref: ${{ github.job_workflow_sha || 'v0' }}
          path: .ci-tooling

      - name: 🐍 Setup Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
        with:
          python-version: ${{ inputs.python-version }}

      # Work out which packages this run pins. Runs before uv exists because the
      # digest it emits becomes uv's cache suffix: a pinned run must not share a
      # cache entry with an unpinned one.
      - name: 📌 Resolve branch pins
        id: pins
        uses: ./.ci-tooling/actions/resolve-pins
        with:
          dispatch-pins: ${{ inputs.dispatch-pins }}
          variable-pins: ${{ vars.CI_PINS }}
          caller-pins: ${{ inputs.package-pins }}
          pins-file: ${{ inputs.pins-file }}
          auto-pin-siblings: ${{ inputs.auto-pin-siblings }}
          sibling-repos: ${{ inputs.sibling-repos }}
          allowed-orgs: ${{ inputs.pin-allowed-orgs }}
          label-pins-json: ${{ toJSON(github.event.pull_request.labels.*.name) }}
          inputs-json: ${{ inputs.pin-inputs-json }}

      - name: ⚡ Install UV
        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
        with:
          version: ${{ inputs.uv-version }}
          enable-cache: true
          cache-suffix: pins-${{ steps.pins.outputs.digest }}

      # Patch the pins into [tool.uv] override-dependencies. uv honours overrides
      # only from pyproject.toml, so the file has to be rewritten on disk.
      - name: 📌 Apply branch pins
        uses: ./.ci-tooling/actions/apply-pins
        with:
          pins: ${{ steps.pins.outputs.pins }}

      # Bandit reads source rather than installed packages, but it is invoked
      # from this virtualenv, so it is installed here. pip-audit is not: it used
      # to be, and auditing the environment a scanner was just installed into is
      # what made advisories against the scanner's own dependencies show up as
      # the caller's.
      - name: 📦 Install dependencies
        if: ${{ !inputs.use-wrknv }}
        run: |
          uv sync --group dev ${{ inputs.no-sources && '--no-sources' || '' }}
          source .venv/bin/activate
          uv pip install bandit

      - name: 📦 Install dependencies (wrknv)
        if: inputs.use-wrknv
        run: uv sync --all-groups ${{ inputs.no-sources && '--no-sources' || '' }}

      # No pip-audit here either: `--python .venv/bin/python` is the same
      # install into the audited environment, spelled differently.
      - name: 🔧 Install wrknv
        if: inputs.use-wrknv
        run: uv pip install --python .venv/bin/python "wrknv @ git+https://github.com/provide-io/wrknv.git@main"

      # uv silently ignores an override for a package nothing depends on, so a
      # mistyped or misnamed pin would otherwise produce a green run against
      # unpinned code. This reads the lockfile and insists the pin is in it.
      - name: 📌 Verify branch pins took effect
        uses: ./.ci-tooling/actions/verify-pins
        with:
          pins: ${{ steps.pins.outputs.pins }}

      - name: 🔒 Run Bandit security scan
        if: ${{ !inputs.use-wrknv }}
        run: |
          source .venv/bin/activate
          .ci-tooling/scripts/security/run-bandit.sh src/ bandit-report.json -ll

      - name: 🔒 Run Bandit (wrknv)
        if: inputs.use-wrknv
        run: .venv/bin/we run security

      # Audits the resolved lock, with pip-audit run from `uvx` so the scanner
      # is not part of what it reports on. No virtualenv is activated: reading
      # the lock does not need one, and not having one is the point.
      - name: 🔍 Check for known vulnerabilities
        run: .ci-tooling/scripts/security/run-pip-audit.sh pip-audit-report.json ${{ inputs.fail-on-vulnerability }} '${{ inputs.ignore-vulnerabilities }}'

      - name: 📤 Upload security reports
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
        if: always()
        with:
          name: security-reports
          path: |
            bandit-report.json
            pip-audit-report.json

  # ==================================================================================
  # 🔐 Secret Scanning
  # ==================================================================================
  secret-scan:
    name: 🔐 Secret Scan
    needs: quality
    if: inputs.run-secret-scan && github.actor != 'nektos/act'
    runs-on: ubuntu-24.04
    steps:
      - name: 📥 Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          fetch-depth: 0

      - name: 🔐 TruffleHog Scan
        uses: trufflesecurity/trufflehog@main
        with:
          extra_args: --only-verified
        continue-on-error: true

      - name: 🔐 Gitleaks Scan
        uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7  # v2.3.9
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        continue-on-error: true

  # ==================================================================================
  # 📦 Build Package
  # ==================================================================================
  build:
    name: 📦 Build
    needs: [test, test-linux-arm, test-macos-arm, test-macos-intel]
    if: always() && (needs.test.result == 'success' || needs.test.result == 'skipped')
    runs-on: ubuntu-24.04
    steps:
      - name: 📥 Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: 🐍 Setup Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
        with:
          python-version: ${{ inputs.python-version }}

      - name: ⚡ Install UV
        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
        with:
          version: ${{ inputs.uv-version }}
          enable-cache: false  # Build doesn't need cache, just runs uv build

      - name: 📦 Build Package
        run: uv build

      - name: 📤 Upload Dist Artifacts
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
        with:
          name: dist
          path: dist/

  # ==================================================================================
  # 📋 CI Summary
  # ==================================================================================
  # ==================================================================================
  # 📌 Unpinned-merge check
  # ==================================================================================
  pins-clean:
    name: 📌 No Active Pins
    # Deliberately a separate job. The test jobs run *with* the pins and should go
    # green -- that is what pinning is for. This one stays red until the pin is
    # gone, so branch protection has something to block the merge on.
    #
    # It has no `if:` on purpose. A required status check that never reports is
    # pending forever, so a job that vanished when block-merge-on-pins was turned
    # off would wedge every pull request in the repository. Instead it always
    # runs, and the input decides whether an active pin is an error or a warning.
    runs-on: ubuntu-24.04
    steps:
      - name: 📥 Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: 📥 Checkout ci-tooling
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          repository: provide-io/ci-tooling
          ref: ${{ github.job_workflow_sha || 'v0' }}
          path: .ci-tooling

      # Resolve every layer, so a label or a variable counts, not just the file.
      - name: 📌 Resolve branch pins
        id: pins
        uses: ./.ci-tooling/actions/resolve-pins
        with:
          dispatch-pins: ${{ inputs.dispatch-pins }}
          variable-pins: ${{ vars.CI_PINS }}
          caller-pins: ${{ inputs.package-pins }}
          pins-file: ${{ inputs.pins-file }}
          auto-pin-siblings: ${{ inputs.auto-pin-siblings }}
          sibling-repos: ${{ inputs.sibling-repos }}
          allowed-orgs: ${{ inputs.pin-allowed-orgs }}
          label-pins-json: ${{ toJSON(github.event.pull_request.labels.*.name) }}
          inputs-json: ${{ inputs.pin-inputs-json }}

      # Fails while anything is pinned, naming each pin and where it came from.
      - name: 📌 Refuse to merge on a pin
        env:
          CI_TOOLING_PATH: .ci-tooling
          PINS: ${{ steps.pins.outputs.pins }}
          ENFORCE: ${{ inputs.block-merge-on-pins }}
        run: .ci-tooling/scripts/deps/require-no-pins.sh

  # ==================================================================================
  # 📌 Branch Pin Guard
  # ==================================================================================
  pin-guard:
    name: 📌 Pin Guard
    # A pin that survives a merge silently keeps the default branch on someone's
    # feature work, so cleanup is enforced here rather than remembered.
    if: github.event_name == 'push' && github.ref_name == github.event.repository.default_branch
    runs-on: ubuntu-24.04
    steps:
      - name: 📥 Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: 📥 Checkout ci-tooling
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          repository: provide-io/ci-tooling
          ref: ${{ github.job_workflow_sha || 'v0' }}
          path: .ci-tooling

      # Fails the run if the pins file still declares anything.
      - name: 📌 Check no pins survive on the default branch
        env:
          PINS_FILE: ${{ inputs.pins-file }}
        run: python3 .ci-tooling/scripts/deps/check_no_pins.py --pins-file "$PINS_FILE"

  summary:
    name: 📋 CI Summary
    needs: [quality, test, test-linux-arm, test-macos-arm, test-macos-intel, test-windows, test-windows-arm, security, secret-scan, build, pin-guard, pins-clean]
    if: always()
    runs-on: ubuntu-24.04
    steps:
      - name: 📋 Generate Summary
        run: |
          echo "## 🎯 CI Pipeline Results" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Platform Preset:** ${{ inputs.platform-preset }}" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Stage | Status |" >> $GITHUB_STEP_SUMMARY
          echo "|-------|--------|" >> $GITHUB_STEP_SUMMARY
          echo "| Quality | ${{ needs.quality.result == 'success' && '✅ Passed' || '❌ Failed' }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Tests (linux_amd64) | ${{ needs.test.result == 'success' && '✅ Passed' || (needs.test.result == 'skipped' && '⏭️ Skipped' || '❌ Failed') }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Tests (linux_arm64) | ${{ needs.test-linux-arm.result == 'success' && '✅ Passed' || (needs.test-linux-arm.result == 'skipped' && '⏭️ Skipped' || '❌ Failed') }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Tests (darwin_arm64) | ${{ needs.test-macos-arm.result == 'success' && '✅ Passed' || (needs.test-macos-arm.result == 'skipped' && '⏭️ Skipped' || '❌ Failed') }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Tests (darwin_amd64) | ${{ needs.test-macos-intel.result == 'success' && '✅ Passed' || (needs.test-macos-intel.result == 'skipped' && '⏭️ Skipped' || '❌ Failed') }} |" >> $GITHUB_STEP_SUMMARY

          if [ "${{ inputs.platform-preset }}" = "full" ] || [ "${{ inputs.include-windows }}" = "true" ]; then
            echo "| Tests (windows_amd64) | ${{ needs.test-windows.result == 'success' && '✅ Passed' || (needs.test-windows.result == 'skipped' && '⏭️ Skipped' || '❌ Failed') }} |" >> $GITHUB_STEP_SUMMARY
          fi

          if [ "${{ inputs.platform-preset }}" = "full" ] || [ "${{ inputs.include-windows-arm }}" = "true" ]; then
            echo "| Tests (windows_arm64) | ${{ needs.test-windows-arm.result == 'success' && '✅ Passed' || (needs.test-windows-arm.result == 'skipped' && '⏭️ Skipped' || '❌ Failed') }} |" >> $GITHUB_STEP_SUMMARY
          fi

          echo "| Build | ${{ needs.build.result == 'success' && '✅ Passed' || (needs.build.result == 'skipped' && '⏭️ Skipped' || '❌ Failed') }} |" >> $GITHUB_STEP_SUMMARY

          if [ "${{ inputs.run-security }}" = "true" ]; then
            echo "| Security | ${{ needs.security.result == 'success' && '✅ Passed' || '❌ Failed' }} |" >> $GITHUB_STEP_SUMMARY
          fi

          if [ "${{ inputs.run-secret-scan }}" = "true" ]; then
            echo "| Secret Scan | ${{ needs.secret-scan.result == 'success' && '✅ Passed' || '⚠️ Issues' }} |" >> $GITHUB_STEP_SUMMARY
          fi

          # Overall status (skipped test/build jobs are OK when run-tests: false)
          OVERALL="✅ Success"
          if [ "${{ needs.quality.result }}" != "success" ]; then
            OVERALL="❌ Failed"
          fi
          if [ "${{ needs.test.result }}" != "success" ] && [ "${{ needs.test.result }}" != "skipped" ]; then
            OVERALL="❌ Failed"
          fi
          if [ "${{ needs.build.result }}" != "success" ] && [ "${{ needs.build.result }}" != "skipped" ]; then
            OVERALL="❌ Failed"
          fi

          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Overall Result:** $OVERALL" >> $GITHUB_STEP_SUMMARY