Make nightly CI fail visibly and keep one publish path

.github/workflows/nightly.yml

@@ -1,5 +1,8 @@
 name: Nightly SDK Breakage Detection
 
+# Installs the newest releases of every dependency and fails visibly when the
+# install, dependency resolution or tests break. Do not add continue-on-error,
+# "|| true" or "|| echo" here: a red nightly run is the signal.
 on:
   schedule:
     - cron: "0 2 * * *"
@@ -9,27 +12,16 @@ jobs:
   nightly:
     name: Test against latest SDK versions
     runs-on: ubuntu-latest
-    continue-on-error: true
     steps:
       - uses: actions/checkout@v4
-      - name: Checkout WestQuant Core
-        uses: actions/checkout@v4
-        with:
-          repository: WestQuantOpen/westquant-core
-          path: _westquant-core
       - uses: actions/setup-python@v5
         with:
-          python-version: "3.10"
-      - name: Install latest SDKs
+          python-version: "3.12"
+      - name: Install latest dependencies
         run: |
-          pip install --upgrade pip
-          pip install -e ./_westquant-core[test]
-          pip install --upgrade qiskit pytket pennylane pulser 2>/dev/null || true
-          pip install -e .[test] 2>/dev/null || pip install -e .
+          python -m pip install --upgrade pip
+          pip install --upgrade --upgrade-strategy eager -e ".[test]"
+          pip check
+          pip freeze
       - name: Run tests
-        run: |
-          pytest tests/ -v || echo "Nightly tests failed — SDK breakage detected"
-      - name: Report status
-        if: always()
-        run: |
-          echo "Nightly run completed. Check for SDK breakage above."
+        run: pytest tests/ -v

.github/workflows/publish.yml

@@ -1,34 +1,55 @@
 name: Publish to PyPI
 
+# Single publication path. PyPI Trusted Publishing is bound to this file name
+# (publish.yml) and the "pypi" environment. Tests must pass and the release tag
+# must match the pyproject version before anything is uploaded.
 on:
   release:
     types: [published]
   workflow_dispatch:
-    inputs:
-      confirm:
-        description: 'Type "publish" to confirm'
-        required: true
-        default: 'publish'
+
+permissions:
+  contents: read
 
 jobs:
-  publish:
-    name: Build and publish
+  test:
+    uses: ./.github/workflows/tests.yml
+
+  build:
+    needs: test
     runs-on: ubuntu-latest
-    environment: pypi
-    permissions:
-      id-token: write
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with:
-          python-version: "3.10"
-      - name: Build package
+          python-version: "3.12"
+      - name: Check release tag matches package version
+        if: github.event_name == 'release'
         run: |
-          pip install build
-          python -m build
-      - name: Check package
+          version=$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml', 'rb'))['project']['version'])")
+          if [ "${GITHUB_REF_NAME#v}" != "$version" ]; then
+            echo "::error::Release tag $GITHUB_REF_NAME does not match pyproject version $version"
+            exit 1
+          fi
+      - name: Build and check distributions
         run: |
-          pip install twine
-          twine check dist/*
-      - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+          python -m pip install --upgrade build twine
+          python -m build
+          twine check --strict dist/*
+      - uses: actions/upload-artifact@v4
+        with:
+          name: python-package-distributions
+          path: dist/
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: python-package-distributions
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1

.github/workflows/tests.yml

@@ -1,6 +1,7 @@
 name: Tests
 
 on:
+  workflow_call:
   push:
   pull_request: