ci: add proper release workflow with test gate and source archive

.github/workflows/release.yml

@@ -1,35 +1,65 @@
-name: release
+name: Release
 
-# Creates a GitHub Release with auto-generated changelog from PR titles.
-# No Python build step — the package is distributed via Hermes plugin loader
-# (entry-point), not PyPI. Artifacts are not created.
-#
-# Tag format: bare semver (``0.2.0``, no ``v`` prefix).
-# Mirrors ``tag_regex`` in pyproject.toml.
 on:
   push:
     tags:
-      - "[0-9]*"
-      - "[0-9]*.[0-9]*"
-      - "[0-9]*.[0-9]*.[0-9]*"
+      - "v*"
 
 permissions:
   contents: write
 
 jobs:
+  # ---------------------------------------------------------------------------
+  # Gate: run tests before releasing
+  # ---------------------------------------------------------------------------
+  test:
+    name: test (${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.11", "3.12"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install dependencies
+        run: |
+          pip install --upgrade pip
+          pip install ruff
+      - name: Lint
+        run: ruff check .
+      - name: Check compile
+        run: |
+          python -m py_compile $(git ls-files '*.py')
+
+  # ---------------------------------------------------------------------------
+  # Release
+  # ---------------------------------------------------------------------------
   release:
     name: publish GitHub Release
+    needs: [test]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
           persist-credentials: false
 
+      - name: Build source archive
+        run: |
+          TAG="${{ github.ref_name }}"
+          ARCHIVE="hermes-nodes-plugin-${TAG#v}.tar.gz"
+          mkdir -p dist
+          git archive --format=tar.gz --prefix="hermes-nodes-plugin-${TAG#v}/" \
+            -o "dist/${ARCHIVE}" HEAD
+          echo "artifact=${ARCHIVE}" >> "$GITHUB_ENV"
+
       - name: Create GitHub Release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          gh release create "$GITHUB_REF_NAME" \
-            --title "$GITHUB_REF_NAME" \
+          gh release create "${{ github.ref_name }}" \
+            "dist/${artifact}" \
+            --title "${{ github.ref_name }}" \
             --generate-notes

.github/workflows/test.yml

@@ -1,17 +1,24 @@
-name: tests
+name: CI
 
 on:
   push:
     branches: [main]
   pull_request:
 
 jobs:
-  test:
+  lint:
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.11", "3.12"]
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with:
-          python-version: "3.11"
+          python-version: ${{ matrix.python-version }}
+      - name: Install dependencies
+        run: |
+          pip install --upgrade pip
+          pip install ruff
       - name: Lint
-        run: pip install ruff && ruff check .
+        run: ruff check .