CI: English, claims and the suite on two systems, one gate context

.github/workflows/tests.yml

@@ -0,0 +1,119 @@
+name: tests
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+# `gate` is the ONLY context the branch protection requires: it depends on every
+# job, so its name never drifts when the matrix changes. Unlike its siblings it
+# accepts nothing but success, because no job here is ever skipped on purpose:
+# a skip would mean a job that did not run, which reads exactly like one that
+# passed.
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  english:
+    name: the repository is English
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: install the pinned package, which carries the gate
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e .
+      - name: check the prose
+        run: |
+          python -m invisible_core.english --selftest
+          python -m invisible_core.english
+
+  claims:
+    name: the README promises nothing it cannot support
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: install the pinned package, which carries the gate
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e .
+      - name: check the claims
+        run: |
+          python -m invisible_core.claims --selftest
+          python -m invisible_core.claims
+
+  unit:
+    name: pytest (${{ matrix.os }}, py${{ matrix.python }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+        # Every version `requires-python = ">=3.11"` promises and the pinned
+        # package declares, on ubuntu; Windows on 3.12.
+        python: ["3.11", "3.12", "3.13"]
+        exclude:
+          - { os: windows-latest, python: "3.11" }
+          - { os: windows-latest, python: "3.13" }
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python }}
+          cache: pip
+      - name: install the package and its dev extras
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"
+      - name: run pytest
+        run: |
+          set -o pipefail   # or tee would swallow pytest's exit code
+          pytest tests/ -v --tb=short -rs | tee tests-report.txt
+      # pytest's exit code cannot tell "everything passed" from "the selection
+      # dropped everything". The suite is four tests, so all four must run.
+      - name: refuse a run in which the suite deselected itself
+        run: |
+          python - <<'PY'
+          import pathlib, re, sys
+          text = pathlib.Path("tests-report.txt").read_text(encoding="utf-8", errors="ignore")
+          m = re.search(r"(\d+) passed", text)
+          passed = int(m.group(1)) if m else 0
+          if passed < 4:
+              print(f"only {passed} test(s) ran (expected 4)", file=sys.stderr)
+              sys.exit(1)
+          print(f"{passed} tests ran")
+          PY
+
+  gate:
+    needs: [unit, english, claims]
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - name: refuse unless every job succeeded
+        run: |
+          echo "unit:    ${{ needs.unit.result }}"
+          echo "english: ${{ needs.english.result }}"
+          echo "claims:  ${{ needs.claims.result }}"
+          for result in "${{ needs.unit.result }}" "${{ needs.english.result }}" "${{ needs.claims.result }}"; do
+            if [ "$result" != "success" ]; then
+              echo "a job did not succeed: $result"
+              exit 1
+            fi
+          done
+          echo "ok"