ci: gate publish on lint, tests, and build

PyPI releases are immutable, but Publish never ran the suite.

Author: kacigaya

.github/workflows/ci.yml

@@ -0,0 +1,30 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_call:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: astral-sh/setup-uv@v9
+        with:
+          enable-cache: true
+      - name: Lint
+        run: uv run --extra dev ruff check .
+      - name: Format
+        run: uv run --extra dev ruff format --check .
+      # Browser and live tests need downloaded browsers and third-party
+      # services; the deselected suite is the deterministic contract.
+      - name: Test
+        run: uv run --extra dev pytest -q -m "not browser and not live"
+      - name: Build
+        run: uv run --with build python -m build

.github/workflows/workflow.yml

@@ -9,7 +9,12 @@ permissions:
   contents: read
 
 jobs:
+  # PyPI releases are immutable, so never publish a tree that does not pass.
+  test:
+    uses: ./.github/workflows/ci.yml
+
   publish:
+    needs: test
     runs-on: ubuntu-latest
     environment: pypi
     permissions: