feat(streaming): async streaming helpers for long-poll endpoints (PY-10) #121

	name: CI

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	# L4: restrict token scope to minimum required
	permissions:
	contents: read

	jobs:
	test:
	runs-on: ubuntu-latest
	strategy:
	fail-fast: false
	matrix:
	python-version: ["3.11", "3.12", "3.13"]

	steps:
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
	- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
	with:
	python-version: ${{ matrix.python-version }}

	- name: Install dependencies
	run: uv sync --all-extras

	- name: Lint
	run: uv run ruff check src tests

	- name: Type check
	run: uv run mypy src

	- name: Test
	run: uv run pytest --cov=hyperping --cov-report=term-missing

	- name: Audit runtime dependencies
	# Audit the runtime dependency closure (what users actually install
	# via `pip install hyperping`), not the full venv. The venv contains
	# build/dev tooling such as `pip` itself and pip-audit's own
	# transitives (requests, urllib3) which are not shipped in the
	# wheel; auditing the env conflates "vulnerabilities in our package"
	# with "vulnerabilities in CI tooling" and produces noise for CVEs
	# that don't reach users. Mirrors the pattern in publish.yml (#24).
	run: \|
	uv export --no-dev --no-emit-project --no-hashes \
	--format requirements.txt -o /tmp/runtime-requirements.txt
	uv run pip-audit -r /tmp/runtime-requirements.txt

Provide feedback