ci: take the template's release, publish and gate fixes

[AlexeyShalaev]

The library was rendered from python-library-template before the template's last round of release fixes, so this brings them over by hand. The workflow text is the template's render at d9d0a6f with the names changed; nothing library-specific had to be kept around it, since this repo's publish and release workflows were the stock ones.

Publish (template#18, template#24). check now decides what gets published: the tag input only reaches the shell through env:, has to match a release tag of this project and point at a commit on master, and the version in the tag has to equal __version__ in sqlalchemy_foundation_kit/__version__.py at that commit. The "Set version from release tag" step is gone, so a tag that disagrees with the committed version fails instead of shipping under the tag's version. check also waits for the push CI run on the released SHA and fails unless it succeeded, so a release is never uploaded before CI has finished on that commit. publish checks out the SHA that check resolved, id-token: write moved from the workflow to the publish job, and distributions are signed with pypi-attestations before uv publish, so releases carry PEP 740 provenance.

Gate (template#19). "All checks passed" used to fail only on failure or cancelled, so a skipped job counted as green. Now every needed job has to end success. MAY_SKIP is []: none of lint, test-unit, test-integration has an if:, so none of them is skipped by design.

Release Please (template#23). The release PR is opened with a token of the org's release App when RELEASE_PLEASE_APP_CLIENT_ID is set, so its CI starts without a close and reopen. Until then it falls back to GITHUB_TOKEN and the run carries a warning, which is today's behaviour.

.copier-answers.yml (template#21). Written by hand so copier update can reach this repo from now on, with _commit: d9d0a6f since the workflows now match that commit. I produced it with copier copy --vcs-ref d9d0a6f and this library's answers, then set _src_path to gh:bedrock-python/python-library-template, so the formatting is exactly what Copier writes (the description wraps the way Copier wraps it).

Local evidence

actionlint 1.7.12 with shellcheck on all four workflows: clean, apart from the two known findings about client-id on actions/create-github-app-token@v3 (its bundled metadata predates the input; v3 declares client-id and deprecates app-id).

The "Resolve the release tag" step, taken from this publish.yml and run with bash -eo pipefail in a throwaway repo with a bare origin, one commit with __version__ = "1.2.3" tagged twice:

dispatch sqlalchemy-foundation-kit-v1.2.3: Will publish sqlalchemy-foundation-kit-v1.2.3 (21934c76d43459cbf1337a7bf20a7e8cc08a6180)  exit=0
dispatch sqlalchemy-foundation-kit-v9.9.9: ::error::sqlalchemy-foundation-kit-v9.9.9 is version 9.9.9, but sqlalchemy_foundation_kit/__version__.py at 21934c76d43459cbf1337a7bf20a7e8cc08a6180 says '1.2.3'  exit=1

Not ported

• --all-extras on the lint job's uv sync (template commit 4c9f596): the template type-checks with every extra installed, this repo without them. It changes what mypy sees, so it deserves its own change rather than riding along here.
• template#20 (ruff/mypy caps) and template#22 (setup docs, NEW_LIBRARY_CHECKLIST.md): they apply to new renders, not to an existing library.

The pypi environment's master-only deployment policy from template#18 is a repository setting; it comes from re-running setup_repo.py, not from this diff.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!