ci: take the template's release, publish and gate fixes

[AlexeyShalaev]

alembic-gauntlet was rendered from python-library-template before five of its fixes landed, so this brings them over by hand. The workflow text is the template's render at d9d0a6f with only the names changed.

Publish (bedrock-python/python-library-template#18). The check job now decides what gets published. The dispatch tag input reaches the shell only through env:, has to match a release tag of this project, and has to point at a commit on master. The job then waits for the push CI run on that commit and fails unless it passed. The tag's version has to equal __version__ in alembic_gauntlet/__version__.py at that commit. The "Set version from release tag" rewrite is gone, so a tag that disagrees with the committed version stops the release. Before, it was shipped under the tag's version. publish checks out the SHA that check resolved, not the tag. id-token: write moved from the workflow to the publish job. The version file keeps its # x-release-please-version comment; the check's sed reads the version in front of it (see below).

Attestations (bedrock-python/python-library-template#24). pypi-attestations sign runs before uv publish, so releases get PEP 740 provenance. uv publish is still called without file arguments, which is what makes it pick up the .attestation files.

Gate (bedrock-python/python-library-template#19). All checks passed now fails when lint, test-unit or test-integration ends skipped, not only on failure/cancelled. MAY_SKIP is []: none of the three has a job-level if:, so none is skipped by design.

Release Please (bedrock-python/python-library-template#23). It uses a token of the org's release App when RELEASE_PLEASE_APP_CLIENT_ID is set, so CI runs on the release PR without a close and reopen. Until then it falls back to GITHUB_TOKEN with a warning, i.e. it behaves as it does today.

.copier-answers.yml (bedrock-python/python-library-template#21). Written by hand in the render's format, with _commit: d9d0a6f, so copier update can run from here on.

Local evidence

actionlint 1.7.12 with shellcheck on all four workflows reports only the two known client-id/app-id findings on create-github-app-token@v3. Those come from its outdated bundled action metadata; v3 declares client-id.

The "Resolve the release tag" step, taken from this branch's publish.yml and run with bash -eo pipefail in a throwaway repo with a bare origin. The commit carries this repo's real __version__.py (__version__ = "0.3.1" # x-release-please-version):

dispatch alembic-gauntlet-v0.3.1: Will publish alembic-gauntlet-v0.3.1 (006dd7f8104f9f5411dae407a187db4f72b5a143)   exit=0
dispatch alembic-gauntlet-v0.3.2: ::error::alembic-gauntlet-v0.3.2 is version 0.3.2, but alembic_gauntlet/__version__.py at 006dd7f8104f9f5411dae407a187db4f72b5a143 says '0.3.1'   exit=1
workflow_run on the tagged commit: Will publish alembic-gauntlet-v0.3.1 (006dd7f8104f9f5411dae407a187db4f72b5a143)   exit=0

Not ported

• fix: cap ruff and mypy at the series the generated config was checked with python-library-template#20 (ruff/mypy caps) and docs: setup instructions match what a render contains python-library-template#22 (setup docs, NEW_LIBRARY_CHECKLIST.md) do not apply to an existing library.
• The other workflow differences from the render are this library's own choices, not template fixes: uv sync without --all-extras, Python 3.10-3.14 in the matrix, unit tests without coverage and the test-integration job running both suites with --cov-fail-under=63 (as make test does), codecov-action@v7, and the dispatch input's example tag (v0.2.0). The old comment on check's if: is replaced by the render's header comment, which also covers the new event == 'push' condition.

After merging, re-run setup_repo.py on this repo. The pypi environment has no deployment policy today, and the master-only policy it sets is the boundary #18 actually relies on; the YAML check alone does not protect anything.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!