Call CI from Release, test on 3.13 and 3.14, and cancel superseded CI runs

.github/workflows/ci.yaml

@@ -1,25 +1,26 @@
 name: CI
 
+# Lint and the tests. Release calls the same workflow, so a version is published only
+# after exactly these checks.
+
 on:
   push:
-    branches:
-      - main
-      - release-*
-    tags-ignore:
-      - "v*"
-  pull_request: {}
-  workflow_dispatch: {}
+    branches: [main]
+  pull_request:
+  workflow_call:
+
+# A fixed name, not github.workflow: called from Release, github.workflow is "Release",
+# and a group equal to the caller's own cancels the caller.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
 
 permissions:
   contents: read
-  packages: write
 
 env:
   PYTHON_VERSION: "3.13"
   HATCH_VERSION: "1.18.1"
-  DOCKER_BUILDX_VERSION: "v0.38.1"
-  XP_CHANNEL: stable
-  XPKG: ghcr.io/${{ github.repository }}
 
 jobs:
   lint:

.github/workflows/ci-with-bnp.yaml → .github/workflows/release.yaml

@@ -1,4 +1,4 @@
-name: CI-with-BnP
+name: Release
 
 on:
   push:
@@ -8,13 +8,17 @@ on:
   # the tag as the ref when dispatching; the guard job below rejects a branch.
   workflow_dispatch:
 
+# Never cancelled: a publish stopped halfway leaves one registry with the version and
+# the other without it.
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
 permissions:
   contents: read
-  packages: write
 
 env:
   PYTHON_VERSION: "3.13"
-  HATCH_VERSION: "1.18.1"
   DOCKER_BUILDX_VERSION: "v0.38.1"
   XP_CHANNEL: stable
   XPKG: ghcr.io/${{ github.repository }}
@@ -34,44 +38,17 @@ jobs:
                "Dispatch this workflow against a tag."
           exit 1
 
-  lint:
-    runs-on: ubuntu-26.04
-    needs: guard
-    steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
-        with:
-          python-version: ${{ env.PYTHON_VERSION }}
-      - name: Install Hatch
-        run: pipx install hatch==${{ env.HATCH_VERSION }}
-      - name: Lint
-        run: hatch check code
-      - name: Format
-        run: hatch check fmt
-
-  unit-test:
-    runs-on: ubuntu-26.04
+  test:
     needs: guard
-    steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
-        with:
-          python-version: ${{ env.PYTHON_VERSION }}
-      - name: Install Hatch
-        run: pipx install hatch==${{ env.HATCH_VERSION }}
-      - name: Run unit tests
-        run: hatch test --all --randomize
-
+    uses: ./.github/workflows/ci.yaml
 
   # We want to build most packages for the amd64 and arm64 architectures. To
   # speed this up we build single-platform packages in parallel. We then upload
   # those packages to GitHub as a build artifact. The push job downloads those
   # artifacts and pushes them as a single multi-platform package. 
   build:
     runs-on: ubuntu-26.04
-    needs:
-      - lint
-      - unit-test
+    needs: test
     strategy:
       fail-fast: true
       matrix:
@@ -129,10 +106,12 @@ jobs:
   # This job downloads the single-platform packages built by the build job, and
   # pushes them as a multi-platform package.
   push:
-    if: ${{ github.event_name != 'pull_request' }}
     runs-on: ubuntu-26.04
     needs:
       - build
+    permissions:
+      contents: read
+      packages: write
     steps:
       - name: Checkout
         uses: actions/checkout@v7

pyproject.toml

@@ -48,6 +48,11 @@ dependencies = ["ipython==9.17.1"]
 [tool.hatch.envs.default.scripts]
 development = "python function/main.py --insecure --debug"
 
+# The runtime's Python, and the next one. No free-threaded build: grpcio has no wheel
+# for it and compiles from source for twenty minutes.
+[[tool.hatch.envs.hatch-test.matrix]]
+python = ["3.13", "3.14"]
+
 # These special environments are used by hatch check code and hatch check fmt.
 [tool.hatch.envs.hatch-check-code]
 dependencies = ["ruff==0.17.2"]