name: Verify container release contracts

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

jobs:
  verify:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
      - run: python -m pip install "uv==0.11.14"
      - run: uv sync --extra dev --locked
      - run: uv run pytest -q
      - name: Honest scoped lint for release additions
        run: uv run ruff check --select F,I app/db/migrations.py scripts/image_release.py tests/release
      - name: Validate container contracts without registry writes
        run: uv run pytest -q tests/release