Preventive spend-governance layer + PACER-native MCP server #5

	name: CI

	on:
	push:
	branches: [master, main]
	pull_request:
	branches: [master, main]

	permissions:
	contents: read

	jobs:
	test:
	runs-on: ubuntu-latest
	strategy:
	matrix:
	python-version: ["3.10", "3.11", "3.12"]

	steps:
	- uses: actions/checkout@v4

	- name: Set up Python ${{ matrix.python-version }}
	uses: actions/setup-python@v5
	with:
	python-version: ${{ matrix.python-version }}

	- name: Install dependencies
	run: \|
	python -m pip install --upgrade pip
	pip install -e '.[dev,full]'

	- name: Lint with ruff
	# Advisory for now: the ruff step had never actually run (the workflow
	# only triggered on `main` while the repo lives on `master`), so it
	# surfaces a large backlog of pre-existing style findings. Tracked for a
	# dedicated cleanup; kept non-blocking so it doesn't gate unrelated work.
	continue-on-error: true
	run: ruff check src/

	- name: Dangling-code audit (stubs + swallowed excepts)
	run: python tools/audit.py

	- name: Run tests
	run: pytest tests/ -v --tb=short

	- name: Run security review tests
	run: pytest tests/test_security_review.py -v

	security:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Set up Python
	uses: actions/setup-python@v5
	with:
	python-version: "3.12"

	- name: Install dependencies
	run: \|
	python -m pip install --upgrade pip
	pip install -e '.[dev,full]'

	- name: Run security tests
	run: pytest tests/test_security.py tests/test_security_review.py -v

Provide feedback