ci: Restrict `id-token` OIDC permission to release job (#185) #700

	name: Nitpicks

	on:
	pull_request:
	branches:
	- "*"
	merge_group:
	types:
	- checks_requested
	push:
	branches:
	- main

	env:
	CARGO_TERM_COLOR: always
	CARGO_INCREMENTAL: 0
	CARGO_NET_GIT_FETCH_WITH_CLI: true
	RUSTFLAGS: "--cfg=ci_run"
	UV_FROZEN: 1

	jobs:
	format-and-lint-checks:
	name:
	runs-on: ubuntu-latest
	timeout-minutes: 30
	steps:
	- name: Checkout
	uses: actions/checkout@v6
	- uses: actions/cache@v5
	with:
	path: \|
	~/.cargo/
	target/
	key: nitpick--${{ runner.os }}--${{ hashFiles('**/Cargo.lock') }}
	restore-keys: \|
	nitpick--${{ runner.os }}--
	- name: Install rust toolchain
	uses: dtolnay/rust-toolchain@stable
	with:
	components: rustfmt, clippy
	- name: Install uv
	uses: astral-sh/setup-uv@v8.1.0
	with:
	enable-cache: true
	- name: Rust format check
	run: cargo fmt --all -- --check
	- name: Rust lint
	run: cargo clippy --all --all-features -- -D warnings
	- name: Build docs
	run: cargo doc --no-deps --all-features
	env:
	RUSTDOCFLAGS: "-Dwarnings"
	- name: UV sync
	run: uv sync --no-install-workspace
	- name: Type check selene-core with mypy
	run: \|
	cd selene-core
	uv run --no-sync mypy .
	- name: Type check selene with mypy
	run: \|
	# only check the main selene package and the python packages for plugins.
	uv run --no-sync mypy selene-sim selene-ext///python/*_plugin
	- name: Ruff check with ruff
	run: uv run --no-sync ruff format --check --config=pyproject.toml
	- name: Lint with ruff
	run: uv run --no-sync ruff check --config=pyproject.toml

Provide feedback