Fix pipeline fingerprint collisions and consolidate workflows

Organize staging around run_id instead of version to eliminate
fingerprint collisions when multiple pipeline runs target the same
version. Move versioning from versioning.yaml into push.yaml, guard
pipeline.yaml to only trigger on version-bump commits, fix #692
transitive policyengine_core import crash, and add explicit resume
support across SHAs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: baogorek

.github/workflows/local_area_promote.yaml

@@ -3,8 +3,8 @@ name: Promote Local Area H5 Files
 on:
   workflow_dispatch:
     inputs:
-      version:
-        description: 'Version to promote (e.g. 1.23.0)'
+      run_id:
+        description: 'Run ID to promote (e.g. 1.23.0_a1b2c3d4_20260407_120000)'
         required: true
         type: string
       branch:
@@ -37,7 +37,7 @@ jobs:
 
       - name: Promote staged files to production
         run: |
-          VERSION="${{ github.event.inputs.version }}"
+          RUN_ID="${{ github.event.inputs.run_id }}"
           BRANCH="${{ github.event.inputs.branch }}"
-          echo "Promoting version ${VERSION} from branch ${BRANCH}"
-          modal run modal_app/local_area.py::main_promote --version="${VERSION}" --branch="${BRANCH}"
+          echo "Promoting run ${RUN_ID} from branch ${BRANCH}"
+          modal run modal_app/local_area.py::main_promote --run-id="${RUN_ID}" --branch="${BRANCH}"

.github/workflows/pipeline.yaml

@@ -25,10 +25,25 @@ on:
         description: "Skip national calibration/H5"
         default: false
         type: boolean
+      resume_run_id:
+        description: "Resume a failed run by ID (allows mixed provenance)"
+        default: ""
+        type: string
+      version_override:
+        description: "Override version (default: read from pyproject.toml)"
+        default: ""
+        type: string
+
+concurrency:
+  group: pipeline-main
+  cancel-in-progress: false
 
 jobs:
   pipeline:
     runs-on: ubuntu-latest
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      github.event.head_commit.message == 'Update package version'
     steps:
       - uses: actions/checkout@v4
 
@@ -51,6 +66,8 @@ jobs:
           NATIONAL_EPOCHS="${{ inputs.national_epochs || '4000' }}"
           NUM_WORKERS="${{ inputs.num_workers || '50' }}"
           SKIP_NATIONAL="${{ inputs.skip_national || 'false' }}"
+          RESUME_RUN_ID="${{ inputs.resume_run_id || '' }}"
+          VERSION_OVERRIDE="${{ inputs.version_override || '' }}"
 
           python -c "
           import modal
@@ -62,6 +79,8 @@ jobs:
               national_epochs=int('${NATIONAL_EPOCHS}'),
               num_workers=int('${NUM_WORKERS}'),
               skip_national='${SKIP_NATIONAL}' == 'true',
+              resume_run_id='${RESUME_RUN_ID}' or None,
+              version_override='${VERSION_OVERRIDE}' or '',
           )
           print(f'Pipeline spawned.')
           print(f'Function call ID: {fc.object_id}')

.github/workflows/push.yaml

@@ -60,6 +60,38 @@ jobs:
           folder: docs/_build/html
           clean: true
 
+  # ── Versioning (bump + changelog on non-version-bump pushes) ──
+  versioning:
+    runs-on: ubuntu-latest
+    if: github.event.head_commit.message != 'Update package version'
+    steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+      - uses: actions/checkout@v4
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          fetch-depth: 0
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.14"
+      - uses: astral-sh/setup-uv@v5
+      - run: pip install towncrier
+      - name: Bump version and build changelog
+        run: |
+          python .github/bump_version.py
+          towncrier build --yes --version $(python -c "import re; print(re.search(r'version = \"(.+?)\"', open('pyproject.toml').read()).group(1))")
+      - name: Update lockfile
+        run: uv lock
+      - name: Update changelog
+        uses: EndBug/add-and-commit@v9
+        with:
+          add: "."
+          message: Update package version
+
   # ── PyPI publish (version bump commits only) ────────────────
   publish:
     runs-on: ubuntu-latest