ci: add test matrix and gate publishing on tests

- new CI workflow runs ruff/mypy/pytest across Python 3.10-3.13 x {core, all}
  on pull_request and push to main
- publish-pypi gains a test job (core/3.10 + all/3.13) that build now needs,
  using the same release-tag checkout logic

Author: ebarti

.github/workflows/ci.yml

@@ -0,0 +1,49 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: test (py${{ matrix.python-version }}, ${{ matrix.extras }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+        extras: [core, all]
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Sync dependencies
+        run: |
+          if [ "${{ matrix.extras }}" = "all" ]; then
+            uv sync --all-extras
+          else
+            uv sync
+          fi
+
+      - name: Ruff
+        run: uv run ruff check .
+
+      - name: Mypy
+        run: uv run mypy
+
+      - name: Pytest
+        run: uv run pytest -q

.github/workflows/publish-pypi.yml

@@ -18,8 +18,51 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  test:
+    name: test (py${{ matrix.python-version }}, ${{ matrix.extras }})
+    runs-on: ubuntu-latest
+    env:
+      RELEASE_TAG: ${{ github.event_name == 'release' && github.event.release.tag_name || inputs.tag }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - python-version: "3.10"
+            extras: core
+          - python-version: "3.13"
+            extras: all
+
+    steps:
+      - name: Check out release tag
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ env.RELEASE_TAG }}
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Sync dependencies
+        run: |
+          if [ "${{ matrix.extras }}" = "all" ]; then
+            uv sync --all-extras
+          else
+            uv sync
+          fi
+
+      - name: Ruff
+        run: uv run ruff check .
+
+      - name: Mypy
+        run: uv run mypy
+
+      - name: Pytest
+        run: uv run pytest -q
+
   build:
     name: Build distributions
+    needs: test
     runs-on: ubuntu-latest
     env:
       RELEASE_TAG: ${{ github.event_name == 'release' && github.event.release.tag_name || inputs.tag }}