refactor: merge publish.yml into release.yml; pin all action SHAs

The two-workflow chain (release.yml tags → publish.yml publishes on tag
push) existed solely because GITHUB_TOKEN-authenticated pushes don't
trigger other workflow runs. Now that they are a single workflow, the
recursion guard is irrelevant — GITHUB_TOKEN with contents: write is
enough to push the tag, so the GitHub App token and RELEASE_APP_* secrets
are no longer needed.

Merged structure (test → build → publish-testpypi → publish-pypi):
- test: matrix 3.10/3.11/3.12, no fetch-depth needed
- build: normalizes version once (job output), pushes tag, builds with
  hatch-vcs (fetch-depth: 0), uploads dist artifact
- publish-testpypi: OIDC publish to TestPyPI
- publish-pypi: OIDC publish to PyPI + GitHub Release (tag_name from
  build job output)

All actions pinned to full commit SHAs:
- actions/checkout      34e114876b0b11c390a56381ad16ebd13914f8d5  (v4)
- astral-sh/setup-uv    e58605a9b6da7c637471fab8847a5e5a6b8df081  (v5)
- actions/upload-artifact ea165f8d65b6e75b540449e92b4886f43607fa02 (v4.6.2)
- actions/download-artifact d3f86a106a0bac45b974a628896c90dbdf5c8093 (v4.3.0)
- softprops/action-gh-release 3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 (v2.6.2)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: 2 people

.github/workflows/publish.yml

@@ -8,33 +8,125 @@ on:
         required: true
         type: string
 
+# Minimal default; individual jobs declare only what they need.
+permissions:
+  contents: read
+
 jobs:
-  release:
+  test:
+    name: Test (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: true
+      matrix:
+        python-version: ["3.10", "3.11", "3.12"]
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081  # v5
+
+      - name: Set up Python ${{ matrix.python-version }}
+        run: uv python install ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: uv sync --dev --python ${{ matrix.python-version }}
+
+      - name: Run tests
+        run: uv run --python ${{ matrix.python-version }} pytest tests/ -v
+
+  build:
+    name: Build distribution
+    needs: test
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: write   # required to push the release tag
+    outputs:
+      version: ${{ steps.normalize.outputs.version }}
     steps:
-      - name: Generate GitHub App token
-        id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1  # v3
-        with:
-          app-id: ${{ secrets.RELEASE_APP_ID }}
-          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+      # Strip a leading 'v' once here; all downstream steps use the output.
+      - name: Normalize version
+        id: normalize
+        run: |
+          VERSION="${{ inputs.version }}"
+          VERSION="${VERSION#v}"
+          echo "version=${VERSION}" >> "${GITHUB_OUTPUT}"
 
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
         with:
-          token: ${{ steps.app-token.outputs.token }}
+          fetch-depth: 0   # required: hatch-vcs derives the package version from git tags
 
       - name: Configure git
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
 
-      - name: Tag and push release
+      - name: Tag release
         run: |
-          # Strip a leading 'v' if the operator included one (e.g. "v0.3.0" → "0.3.0"),
-          # then always prefix with 'v' so the tag is exactly "v0.3.0".
-          VERSION="${{ inputs.version }}"
-          VERSION="${VERSION#v}"
-          git tag "v${VERSION}"
-          git push origin "v${VERSION}"
+          git tag "v${{ steps.normalize.outputs.version }}"
+          git push origin "v${{ steps.normalize.outputs.version }}"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081  # v5
+
+      - name: Build wheel and sdist
+        run: uv build
+
+      - name: Upload dist artifact
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
+        with:
+          name: dist
+          path: dist/
+          if-no-files-found: error
+
+  publish-testpypi:
+    name: Publish → TestPyPI
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/p/starfix
+    permissions:
+      id-token: write   # required for OIDC trusted publishing
+    steps:
+      - name: Install uv
+        uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081  # v5
+
+      - name: Download dist artifact
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4.3.0
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish to TestPyPI
+        run: uv publish --publish-url https://test.pypi.org/legacy/ dist/*
+
+  publish-pypi:
+    name: Publish → PyPI
+    needs: [build, publish-testpypi]
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/starfix
+    permissions:
+      id-token: write   # required for OIDC trusted publishing
+      contents: write   # required for creating the GitHub Release
+    steps:
+      - name: Install uv
+        uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081  # v5
+
+      - name: Download dist artifact
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4.3.0
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish to PyPI
+        run: uv publish dist/*
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65  # v2.6.2
+        with:
+          tag_name: "v${{ needs.build.outputs.version }}"
+          generate_release_notes: true
+          files: dist/*