ci: take the template's release, publish and gate fixes

[AlexeyShalaev]

pg-partsmith was rendered from python-library-template before these template fixes landed, so they are copied in by hand here, as the template renders them now (d9d0a6f) with only the names changed.

Publish (bedrock-python/python-library-template#18). check now decides what is released instead of trusting the tag. It accepts only a release tag on master. inputs.tag reaches the shell through env: and is matched against ^(pg-partsmith-)?v..., and the version in the tag has to equal __version__ in pg_partsmith/__version__.py at the tagged commit. Then the step waits for the push CI run on that SHA and requires it to succeed. check outputs tag and sha, and every job that checks out code (image, publish, verify) now checks out the SHA rather than the tag, so moving the tag mid-run changes nothing. check gets contents: read + actions: read, timeout-minutes: 60 and workflow_run.event == 'push' in its if. id-token: write was already job-level here (publish, and tags for cosign), so nothing moved there. The multi-arch image, Trivy, SBOM/provenance, the push by digest, signing, tags after PyPI and the e2e run against the published image are all unchanged. One knock-on edit: image derived the version with ${TAG#pg-partsmith-v}. Since check now also accepts the bare v1.2.3 form, it strips both prefixes the way check does. Otherwise a bare tag would label and tag the image v1.2.3.

Attestations (bedrock-python/python-library-template#24). pypi-attestations sign runs before uv publish, with the template's comment on why uv publish takes no file arguments. This library already called it without any, so only the sign step and the comment are new.

Gate (bedrock-python/python-library-template#19). All checks passed now requires success from every job it needs. needs is unchanged (all eight jobs). MAY_SKIP: '["dependency-review"]', because that job is if: github.event_name == 'pull_request' and is skipped on every push to master. No other job in ci.yml has an if:. Under the old step a skipped job counted as passed.

Release Please (bedrock-python/python-library-template#23). The release PR is opened with the org release App's token when RELEASE_PLEASE_APP_CLIENT_ID is set, so its CI starts without a close and reopen. Without it, the workflow falls back to GITHUB_TOKEN and the run shows a warning. The config/manifest inputs stay as they were.

Copier answers (bedrock-python/python-library-template#21). .copier-answers.yml is written by hand at _commit: d9d0a6f, so copier update can reach this repo from now on.

actionlint config. The lint job runs rhysd/actionlint:1.7.12, and its bundled metadata for actions/create-github-app-token predates client-id (v3 declares it and deprecates app-id; see #23). .github/actionlint.yaml ignores exactly those two messages, only in release-please.yml. Without it, the lint job fails on this PR.

Evidence

actionlint 1.7.12 with shellcheck, both uvx --from actionlint-py actionlint and the rhysd/actionlint:1.7.12 container CI uses: clean. Without the new config, the container run exits 1 on the two client-id/app-id findings.

The "Resolve the release tag" step, extracted from this publish.yml and run with bash -eo pipefail in a throwaway repo with a bare origin:

dispatch, tag matches __version__.py:  Will publish pg-partsmith-v1.9.1 (596df1b5e04ff330c3a0ff5e8ec0e0230770a6e2)   exit=0
dispatch, tag disagrees:               ::error::pg-partsmith-v1.9.2 is version 1.9.2, but pg_partsmith/__version__.py at 426e9b49e6f8ce9922b033ffe1bc9549c39ef3b0 says '1.9.1'   exit=1
workflow_run, release commit:          Will publish pg-partsmith-v1.9.1 (596df1b5e04ff330c3a0ff5e8ec0e0230770a6e2)   exit=0
workflow_run, tag disagrees:           ::error::pg-partsmith-v1.9.2 is version 1.9.2, but pg_partsmith/__version__.py at 426e9b49e6f8ce9922b033ffe1bc9549c39ef3b0 says '1.9.1'   exit=1

Against this repo's own history, pg-partsmith-v1.9.0 resolves to b9e51ff on both triggers (the # x-release-please-version comment after the version is handled).

The gate step, run the same way with this repo's eight jobs:

push, dependency-review skipped:  All checks passed.                       exit=0
image skipped:                    Not passed: image: skipped               exit=1
dependency-review failure:        Not passed: dependency-review: failure   exit=1

Not ported

• fix: cap ruff and mypy at the series the generated config was checked with python-library-template#20 (ruff/mypy caps) and docs: setup instructions match what a render contains python-library-template#22 (setup docs, NEW_LIBRARY_CHECKLIST.md): they apply to new renders, not existing libraries.
• No other template-owned workflow differences: docs.yml matches the render, and everything else in ci.yml is this library's own.

The pypi environment already admits master only (custom branch policy master), so the master check in check is the readable error in front of a boundary that exists.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!