Publish a release only after its tests pass

[MaxGhenis]

What this fixes

In .github/workflows/push.yaml, the Publish job (PyPI upload and git tag) had no needs:, so on each release commit it ran beside Test. A release could reach PyPI while its tests were still running, or after they failed. In the 2026-10-06 13:11Z release run (37468917800), Publish finished at 13:40:07 and Test at 13:44:04.

Publish now has needs: Test. Both jobs have the same if: (the canonical repository and the "Update PolicyEngine Core" commit), so Publish still runs on every release commit; it now waits for Test to pass.

Gating won't hold up current releases: all 69 of the last 69 "Update PolicyEngine Core" push runs passed.

Tests

test_release_tagging.py::test_publish_workflow_publishes_only_after_tests_pass checks four things:

• every job that uses pypa/gh-action-pypi-publish needs Test;
• the only such job is Publish;
• Publish's if: is Test's;
• Publish's if: contains no status function (always(), failure(), cancelled(), success()), which could let it run after a failed Test.

before (master workflow):  1 failed, 5 passed   (AssertionError: assert 'Test' in [])
after:                     6 passed

Impact

CI only; no package code changes. Each release now publishes about four minutes later, once Test finishes.

Noticed in passing, not changed here: the Test job's "Deploy documentation" step runs if: matrix.os == 'ubuntu-latest', but the job has no matrix, so the step has been skipped on every run. I'm raising that separately.

axiom: n/a: CI workflow change, no policy change

Other audit findings, handled elsewhere

The 2026-10-06 invariants audit of master 757147c7 also confirmed defects that this PR leaves alone, because other work owns them:

• Stock ADD changing later plain reads: draft Cache ADD and DIVIDE results only where a plain read returns them #571.
• Year deletion leaving monthly fast-cache entries: draft Drop every contained period from the fast cache when deleting or setting a period #566.
• Disk deletion of contained periods, and disk branch-name parsing and prefix collisions: draft Delete the periods within a deleted period from disk storage #565 (it inherits Keep branch period reads, dumps, and disk deletion consistent #552).
• Clone aliases bound to the parent: fixed by Bind a clone's calc and df to the clone, and give it its own system's entities #586.
• Serialization and subsample input provenance: Restore inputs as inputs, evict the fast cache on holder writes, reject non-numeric uprating and defined_for #576 and Rebuild a subsampled simulation from its inputs, not its calculated values #573.
• Restored entity counts: Fix restore_simulation entity counts #548.
• A monthly input leaving a cached annual sum stale (set_input for one period leaves the variable's cached sum or twelfth over an overlapping period in place #579): tracked separately.

Branch staleness after set_input and raw-file restore are documented behaviour, not defects.

🤖 Generated with Claude Code