ci: add aggregator checks and wire release publish (#19)

* ci: squash release-please PRs and auto-publish to PyPI

- release-please-config.json: set merge-type to squash
- publish.yml: convert push:tags trigger to workflow_call (with optional
  workflow_dispatch ref input) so release-please can chain it
- release-please.yml: add publish job that calls publish.yml when
  release_created is true. GITHUB_TOKEN-pushed tags do not trigger
  downstream workflows, so chaining is required.

* ci: add aggregator checks and wire release publish

Add stable aggregator jobs (CI, PR Title Lint) for branch protection
required status checks, independent of matrix/job name changes. Run ci
on all PRs. Make publish.yml callable via workflow_call/dispatch with a
ref input, and trigger it from release-please on release creation.

Author: Hoeze

.github/workflows/check-pr.yml

@@ -39,3 +39,20 @@ jobs:
             Subject must start with lowercase letter and not end with a period.
             Got: "{subject}"
           wip: true
+
+  # Aggregator job: a single, stable check-run name to use as the required
+  # status check in branch protection, independent of the underlying job name.
+  pr-title-lint:
+    name: PR Title Lint
+    needs: [conventional-title]
+    runs-on: ubuntu-latest
+    if: always()
+    steps:
+      - name: Verify PR title lint did not fail
+        run: |
+          # Fail only on failure/cancelled; a skipped run is allowed.
+          result="${{ needs.conventional-title.result }}"
+          if [ "$result" = "failure" ] || [ "$result" = "cancelled" ]; then
+            echo "PR title lint did not pass: $result"
+            exit 1
+          fi

.github/workflows/ci.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches: [main, master]
   pull_request:
-    branches: [main, master]
   workflow_dispatch:
 
 env:
@@ -68,4 +67,23 @@ jobs:
         run: uv sync --all-groups
 
       - name: Run tests
-        run: uv run tox -e py${{ matrix.python-version }}
+        run: uv run tox -e py${{ matrix.python-version }}
+
+  # Aggregator job: a single, stable check-run name to use as the required
+  # status check in branch protection. Stays valid even if the matrix or the
+  # individual job names change.
+  ci:
+    name: CI
+    needs: [quality-checks, test]
+    runs-on: ubuntu-latest
+    if: always()
+    steps:
+      - name: Verify no upstream job failed
+        run: |
+          # Fail only on failure/cancelled. A skipped job is allowed
+          for result in "${{ needs.quality-checks.result }}" "${{ needs.test.result }}"; do
+            if [ "$result" = "failure" ] || [ "$result" = "cancelled" ]; then
+              echo "An upstream job did not pass: quality-checks=${{ needs.quality-checks.result }} test=${{ needs.test.result }}"
+              exit 1
+            fi
+          done

.github/workflows/publish.yml

@@ -2,9 +2,17 @@ name: Publish to PyPI
 
 on:
   workflow_dispatch:
-  push:
-    tags:
-      - "v[0-9]+.[0-9]+.[0-9]+*"
+    inputs:
+      ref:
+        description: "Git ref to build and publish"
+        type: string
+        required: false
+  workflow_call:
+    inputs:
+      ref:
+        description: "Git ref to build and publish"
+        type: string
+        required: true
 
 env:
   UV_VERSION: "0.11.6"
@@ -24,7 +32,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
         with:
-          ref: ${{ github.ref }}
+          ref: ${{ inputs.ref || github.ref }}
 
       - name: Install uv
         uses: astral-sh/setup-uv@v6

.github/workflows/release-please.yml

@@ -2,7 +2,7 @@ name: Release Please
 
 on:
   push:
-    branches: [master]
+    branches: [main, master]
   workflow_dispatch:
 
 permissions:
@@ -69,3 +69,15 @@ jobs:
           git add uv.lock
           git commit -m "chore: refresh uv.lock for release"
           git push
+
+  publish:
+    name: Publish to PyPI
+    needs: release-please
+    if: ${{ needs.release-please.outputs.release_created }}
+    permissions:
+      id-token: write
+      contents: read
+    uses: ./.github/workflows/publish.yml
+    with:
+      ref: ${{ needs.release-please.outputs.tag_name }}
+    secrets: inherit

release-please-config.json

@@ -1,4 +1,5 @@
 {
+  "merge-type": "squash",
   "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
   "packages": {
     ".": {