fix(ci): switch release trigger to push on main for PyPI environment compatibility

Author: eschaar

.github/workflows/release.yml

@@ -1,11 +1,11 @@
 # Release workflow.
-# Trigger model: only when a PR to main is closed and merged.
+# Trigger model: only on direct pushes to main (merge commits).
+# Using push instead of pull_request so the workflow runs under refs/heads/main,
+# which satisfies the PyPI environment deployment branch protection rule.
 name: Release
 
 on:
-  pull_request:
-    # Closed event is filtered below to merged-only.
-    types: [closed]
+  push:
     branches: [main]
 
 permissions:
@@ -27,8 +27,6 @@ jobs:
     permissions:
       # Needed for creating tags and GitHub releases.
       contents: write
-    # Guard: run only for merged PRs.
-    if: github.event.pull_request.merged == true
     outputs:
       changed: ${{ steps.version.outputs.changed }}
       version: ${{ steps.version.outputs.version }}
@@ -39,7 +37,6 @@ jobs:
         with:
           # Full history is required by semver-action to inspect commit history.
           fetch-depth: 0
-          ref: ${{ github.event.pull_request.merge_commit_sha }}
 
       - name: Compute semantic version from conventional commits
         id: semver
@@ -125,15 +122,14 @@ jobs:
     name: Build Package Artifacts
     runs-on: ubuntu-latest
     needs: release
-    if: github.event.pull_request.merged == true && needs.release.outputs.changed == 'true'
+    if: needs.release.outputs.changed == 'true'
 
     steps:
       - name: Checkout
         uses: actions/checkout@v6
         with:
           # Full history and tags required by poetry-dynamic-versioning.
           fetch-depth: 0
-          ref: ${{ github.event.pull_request.merge_commit_sha }}
 
       - name: Install Poetry
         run: pipx install poetry
@@ -159,7 +155,7 @@ jobs:
     name: Publish to PyPI
     runs-on: ubuntu-latest
     needs: [release, build]
-    if: github.event.pull_request.merged == true && needs.release.outputs.changed == 'true'
+    if: needs.release.outputs.changed == 'true'
     environment: pypi
     permissions:
       # Required for OIDC trusted publishing.

CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 1.3.1 - 2026-04-22
+
+Release workflow and test isolation fixes.
+
+### Fixed in 1.3.1
+
+- Fixed release workflow trigger: switched from `pull_request: closed` to `push: branches: [main]` so the workflow runs under `refs/heads/main` and satisfies the PyPI environment deployment branch protection rule.
+- Fixed `build` job checkout missing `fetch-depth: 0`, required by `poetry-dynamic-versioning` to read git tags.
+- Fixed `download-artifact` version mismatch (`v5` → `v7`) to align with `upload-artifact@v7`.
+
 ## 1.3.0 - 2026-04-22
 
 DX, onboarding, and PyPI publishing release.
@@ -21,6 +31,10 @@ DX, onboarding, and PyPI publishing release.
 - Updated generated artifact metadata and aligned generation tests with current template output.
 - Added PyPI publish job to release workflow using OIDC trusted publishing (no API tokens required).
 
+### Fixed in 1.3.0
+
+- Fixed `test_install_and_verify_exits_zero` writing generated artifacts into the repository root instead of an isolated `tmp_path`.
+
 ## 1.2.5 - 2026-04-21
 
 CI dependency maintenance release.