Repository navigation

fix(runner): reject unknown API inspection selections before probes #959

	name: CI

	on:
	push:
	# pull_request: only when the PR base is one of these (fork PRs included).
	# All branches still get CI on push: — see CONTRIBUTING.md § Continuous integration.
	pull_request:
	branches: [main, "fix/", "feat/"]

	jobs:
	checks:
	runs-on: ubuntu-latest
	strategy:
	matrix:
	python-version: ["3.10", "3.11", "3.12"]

	steps:
	- uses: actions/checkout@v4

	- name: Set up Python ${{ matrix.python-version }}
	uses: actions/setup-python@v5
	with:
	python-version: ${{ matrix.python-version }}

	- name: Install dependencies
	run: python -m pip install -e ".[dev]"

	- name: Validate layout and example fixtures
	run: \|
	set -euo pipefail
	ifixai validate
	shopt -s nullglob
	for f in ifixai/fixtures/examples/*.yaml; do
	echo "Validating $f"
	ifixai validate "$f"
	done

	- name: Lint
	run: ruff check ifixai

	- name: Security scan
	run: bandit -r ifixai -ll

	- name: Docs presence check
	run: \|
	test -f CONTRIBUTING.md \|\| { echo "CONTRIBUTING.md missing"; exit 1; }
	test -f SECURITY.md \|\| { echo "SECURITY.md missing"; exit 1; }
	test -f docs/inspections.md \|\| { echo "docs/inspections.md missing"; exit 1; }
	echo "governance docs present"