From 96614c79b273cc87426a5fb26467f019878aa078 Mon Sep 17 00:00:00 2001
From: srichs <13246896+srichs@users.noreply.github.com>
Date: Thu, 12 Feb 2026 17:47:04 -0700
Subject: [PATCH] Revamp CI workflow structure and job matrix

---
 .github/workflows/ci.yml | 70 ++++++++++++++++++++++++++++++++++------
 1 file changed, 61 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d5476af..5a8447a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,13 +2,24 @@ name: CI
 
 on:
   push:
+    branches:
+      - main
   pull_request:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
-  tests:
+  lint:
+    name: Lint / format
     runs-on: ubuntu-latest
+
     steps:
-      - name: Check out repository
+      - name: Checkout
         uses: actions/checkout@v4
 
       - name: Set up Python
@@ -21,17 +32,58 @@ jobs:
           python -m pip install --upgrade pip
           pip install -r requirements-dev.txt
 
-      - name: Lint with ruff
+      - name: Run Ruff
         run: ruff check .
 
-      - name: Check formatting
+      - name: Run Black
+        run: black --check .
+
+      - name: Run isort
+        run: isort --check-only .
+
+  type-check:
+    name: Type check
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install dependencies
         run: |
-          black --check .
-          isort --check-only .
+          python -m pip install --upgrade pip
+          pip install -r requirements-dev.txt
 
-      - name: Type check
+      - name: Run mypy
         run: mypy src
 
-      - name: Run tests
+  test:
+    name: Test (Python ${{ matrix.python-version }}, ${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        python-version: ["3.11", "3.12"]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
         run: |
-          pytest --cov=veracrypt --cov-report=term-missing --cov-fail-under=80
+          python -m pip install --upgrade pip
+          pip install -r requirements-dev.txt
+
+      - name: Run tests
+        run: pytest --cov=veracrypt --cov-report=term-missing --cov-fail-under=80