From c76be682657a6e715aad52bb413fe20a2a2700dc Mon Sep 17 00:00:00 2001
From: t0kubetsu <alexis.danjon@nc3.lu>
Date: Wed, 12 Aug 2026 14:49:11 +0200
Subject: [PATCH 1/3] ci: add GitHub Actions workflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Runs lint and tests on push and PR to main across Python 3.11-3.13.

Checkout sets submodules: true because vendor/chainvalidator and
vendor/quantumvalidator are submodules that pyproject resolves as
file:./vendor/... — a default checkout leaves them empty and the
editable install fails.

Hardening: SHA-pinned actions, contents: read, persist-credentials:
false, concurrency cancellation, fail-fast: false, timeout-minutes.
---
 .github/workflows/ci.yml | 59 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 59 insertions(+)
 create mode 100644 .github/workflows/ci.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..ed5dfc4
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,59 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+# A new push supersedes the previous run on the same ref.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+# Least privilege: this workflow only ever reads the repository.
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Python ${{ matrix.python-version }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      # One failing interpreter must not mask the others.
+      fail-fast: false
+      matrix:
+        # pyproject declares requires-python >= 3.11, so every supported
+        # interpreter is exercised.
+        python-version: ["3.11", "3.12", "3.13"]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # No credential is needed after checkout; leaving one in .git/config
+          # would expose it to anything later in the job.
+          persist-credentials: false
+          # chainvalidator and quantumvalidator are submodules, and pyproject
+          # resolves them as `file:./vendor/...`. Without this the install
+          # fails on an empty directory.
+          submodules: true
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+          cache-dependency-path: pyproject.toml
+
+      - name: Install (editable, with dev extras)
+        run: python -m pip install -e ".[dev]"
+
+      - name: Lint
+        run: ruff check mailvalidator/
+
+      - name: Test
+        # Network I/O is isolated in the *_utils modules and mocked there, so
+        # the suite needs neither a live network nor any external binary.
+        run: pytest --tb=short -q

From 2345149766c575e8cb97b1bf619adc1b3f9f7942 Mon Sep 17 00:00:00 2001
From: t0kubetsu <alexis.danjon@nc3.lu>
Date: Wed, 12 Aug 2026 15:00:39 +0200
Subject: [PATCH 2/3] ci: declare the ruff rule set and provision ruff in dev
 extras
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The first CI run failed on every module, in two ways tracing to one root
cause: lint was never actually pinned down.

1. 'ruff: command not found' — ruff is required by the before-commit
   checklist but was absent from the dev extras, so pip install -e
   '.[dev]' never provided it. It passed locally only because developer
   venvs had it installed by hand.

2. Lint failures on a clean checkout — with no [tool.ruff] section the
   linted rule set is whatever the installed ruff defaults to, and that
   widens each release, so a green local run and a red CI run could
   disagree purely by version.

Copies the pattern portscanner already used (the only module that
passed): pin target-version, state select = [E4, E7, E9, F] explicitly,
add ruff>=0.6 to dev. No source change needed — every module passes this
rule set as-is.
---
 pyproject.toml | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/pyproject.toml b/pyproject.toml
index fc5207e..6046a6c 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -79,7 +79,17 @@ where = ["."]
 include = ["mailvalidator*"]
 
 [project.optional-dependencies]
-dev = ["pytest>=9.1.1", "pytest-cov>=7.1.0", "pytest-mock>=3.15.1"]
+dev = ["pytest>=9.1.1", "pytest-cov>=7.1.0", "ruff>=0.6", "pytest-mock>=3.15.1"]
+
+[tool.ruff]
+target-version = "py311"
+
+[tool.ruff.lint]
+# Ruff's default rule set as of 0.6, made explicit. Without this the linted
+# rule set is whatever the installed ruff defaults to, which widens on every
+# release — so a green local run and a red CI run can disagree purely by
+# version. Pinning it here makes the bar reviewable and stable.
+select = ["E4", "E7", "E9", "F"]
 
 [tool.pytest.ini_options]
 pythonpath = ["."]

From 22299705d5825c7c9e03e76b691d351f227353d0 Mon Sep 17 00:00:00 2001
From: t0kubetsu <alexis.danjon@nc3.lu>
Date: Wed, 12 Aug 2026 15:06:44 +0200
Subject: [PATCH 3/3] docs: correct the major-version count and the CI
 statement

The changelog said seven of the ten bumps cross a major boundary; the
correct count is six. Also drops the now-false 'No CI config currently
present' line from CLAUDE.md.
---
 CLAUDE.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index ace33f0..0484b3a 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -103,7 +103,8 @@ pytest tests/checks/test_spf.py -v
 - Conventional commits: `fix:`, `feat:`, `fix(scope):`, `refactor:`, `test:`, `docs:`
 - Input validation lives in `cli.py` (`_validate_domain`, `_validate_host`, `_validate_ip`)
 - `resolve()` from `dns_utils` is the single DNS abstraction; patch it in tests
-- No CI config currently present
+- CI: `.github/workflows/ci.yml` runs `ruff check` and the full suite on
+  push and PR to `main`, across Python 3.11-3.13
 
 ## Before Every Commit