fix: exclude integration tests from release pipeline #20

	name: Release to PyPI

	on:
	push:
	tags: ["v..*"]

	permissions:
	id-token: write # PyPI OIDC trusted publishing
	contents: write # GitHub Release creation
	attestations: write

	jobs:
	release:
	name: Build & Publish
	runs-on: ubuntu-latest
	environment: pypi-publish
	steps:
	- uses: actions/checkout@v4

	- uses: actions/setup-python@v5
	with:
	python-version: "3.11"

	- name: Install dev dependencies + build frontend
	run: \|
	pip install build pip-audit bandit
	pip install ".[dev]"

	- name: Security gates (advisory)
	run: \|
	bandit -ll -r src/ --exit-zero
	pip-audit --strict \|\| true

	- name: Run unit, contract and boundary tests
	# Integration tests require a TTY-aware subprocess; CI workflow covers them.
	# Release pipeline runs the fast, reliable test tiers only.
	run: pytest --cov --ignore=tests/integration/

	- name: Build wheel + sdist
	run: python -m build

	- name: List built artifacts
	run: ls -lh dist/

	- name: Generate CycloneDX SBOM
	run: \|
	pip install "cyclonedx-bom<5"
	cyclonedx-py environment -o sbom.cdx.json --format json \|\| \
	cyclonedx-py environment > sbom.cdx.json \|\| true

	- name: Attest build provenance (GitHub + Sigstore)
	uses: actions/attest-build-provenance@v2
	with:
	subject-path: dist/*

	- name: Publish to PyPI (OIDC trusted publisher)
	uses: pypa/gh-action-pypi-publish@v1.12.4

	- name: Create GitHub Release
	uses: softprops/action-gh-release@v2
	with:
	generate_release_notes: true
	files: \|
	dist/*.whl
	dist/*.tar.gz
	sbom.cdx.json

Provide feedback