python-quality.yml

name: Python quality

on:
  pull_request:
    branches:
      - develop
      - master
  push:
    branches:
      - develop
      - master

permissions:
  contents: read

jobs:
  quality:
    name: Python quality
    runs-on: ubuntu-latest
    timeout-minutes: 15

    steps:
      - name: Check out repository
        uses: actions/checkout@v5

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.11"

      - name: Install project and development dependencies
        run: python -m pip install -e ".[dev]"

      - name: Fetch checksum-pinned Xray for isolated routing tests
        run: |
          python - <<'PYTHON'
          import hashlib
          import io
          from pathlib import Path
          import urllib.request
          import zipfile
          from flayer.profiles._vless_guest import ARCHIVES, XRAY_VERSION

          name, digest = ARCHIVES["x86_64"]
          url = f"https://github.com/XTLS/Xray-core/releases/download/v{XRAY_VERSION}/{name}"
          with urllib.request.urlopen(url, timeout=120) as response:
              archive = response.read()
          if hashlib.sha256(archive).hexdigest() != digest:
              raise SystemExit("Xray archive checksum mismatch")
          destination = Path("_build/xray/xray")
          destination.parent.mkdir(parents=True, exist_ok=True)
          with zipfile.ZipFile(io.BytesIO(archive)) as bundle:
              destination.write_bytes(bundle.read("xray"))
          destination.chmod(0o700)
          PYTHON

      - name: Run the canonical local and CI validation gate
        env:
          FLAYER_XRAY_BINARY: ${{ github.workspace }}/_build/xray/xray
        run: python tools/validate.py