ci: Add test pipeline and publish gate

Add CI test workflow (Python 3.9-3.12 matrix), weekly integration health
check, and require tests pass before PyPI publish.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: karlwaldman

.github/workflows/publish.yml

@@ -8,20 +8,43 @@ permissions:
   contents: read
 
 jobs:
+  test:
+    name: Run Tests Before Publish
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e '.[dev]'
+
+      - name: Lint with ruff
+        run: ruff check .
+
+      - name: Run unit tests
+        run: pytest tests/ -m 'not integration and not contract' --cov=oilpriceapi -v
+
   publish:
     name: Publish to PyPI
+    needs: test
     runs-on: ubuntu-latest
     environment: pypi
     permissions:
-      id-token: write  # Required for trusted publishing
+      id-token: write # Required for trusted publishing
 
     steps:
       - uses: actions/checkout@v4
 
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: '3.12'
+          python-version: "3.12"
 
       - name: Install build dependencies
         run: |
@@ -32,4 +55,4 @@ jobs:
         run: python -m build
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@release/v1

.github/workflows/test.yml

@@ -0,0 +1,46 @@
+name: Test Python SDK
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    name: Test (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.9", "3.10", "3.11", "3.12"]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e '.[dev]'
+
+      - name: Lint with ruff
+        run: ruff check .
+
+      - name: Type check with mypy
+        run: mypy oilpriceapi/ --ignore-missing-imports
+        continue-on-error: true
+
+      - name: Run unit tests
+        run: pytest tests/ -m 'not integration and not contract' --cov=oilpriceapi --cov-report=xml -v
+
+      - name: Upload coverage
+        if: matrix.python-version == '3.12'
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-report
+          path: coverage.xml

.github/workflows/weekly-health.yml

@@ -0,0 +1,38 @@
+name: Weekly SDK Health Check
+
+on:
+  schedule:
+    - cron: "0 14 * * 1" # Monday 6am PST / 2pm UTC
+  workflow_dispatch: {}
+
+jobs:
+  health-check:
+    name: Integration Health Check
+    runs-on: ubuntu-latest
+    env:
+      OILPRICEAPI_KEY: ${{ secrets.OILPRICEAPI_TEST_KEY }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e '.[dev]'
+
+      - name: Run integration tests
+        run: pytest tests/ -m 'integration' -v --timeout=60
+
+      - name: Run contract tests
+        run: pytest tests/ -m 'contract' -v --timeout=60
+
+      - name: Check for dependency vulnerabilities
+        run: |
+          pip install pip-audit
+          pip-audit --strict
+        continue-on-error: true