ci: full CI with OIDC PyPI publish + TestPyPI gate + codecov

Author: TawandaVera

.github/workflows/ci.yml

@@ -1,13 +1,28 @@
 name: CI
+
 on:
   push:
     branches: [main, develop]
   pull_request:
     branches: [main]
+  release:
+    types: [published]
 
 jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - run: pip install ruff mypy
+      - run: ruff check .
+      - run: ruff format --check .
+
   test:
     runs-on: ubuntu-latest
+    needs: lint
     strategy:
       matrix:
         python-version: ["3.11", "3.12"]
@@ -16,6 +31,50 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
+          cache: pip
       - run: pip install -e ".[dev]"
-      - run: ruff check .
-      - run: pytest tests/ -v --cov --cov-report=xml
+      - run: pytest tests/ -v --cov=psae_folio --cov-report=xml --cov-report=term-missing
+      - uses: codecov/codecov-action@v4
+        if: matrix.python-version == '3.11'
+        with:
+          files: coverage.xml
+          flags: psae-folio
+          fail_ci_if_error: false
+
+  publish-testpypi:
+    runs-on: ubuntu-latest
+    needs: test
+    if: github.event_name == 'release'
+    environment: testpypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - run: pip install build && python -m build
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          skip-existing: true
+
+  publish-pypi:
+    runs-on: ubuntu-latest
+    needs: publish-testpypi
+    if: github.event_name == 'release'
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - run: pip install build && python -m build
+      - name: Publish to PyPI (OIDC trusted publisher — no token needed if configured)
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          skip-existing: true
+        env:
+          TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}