From 885f0ec9635f13d6045955837d1c9ab8b3666ee2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bern=C3=A1t=20G=C3=A1bor?= <gaborjbernat@gmail.com>
Date: Sun, 8 Nov 2026 09:13:08 -0800
Subject: [PATCH] =?UTF-8?q?=F0=9F=91=B7=20ci:=20run=20the=20release=20buil?=
 =?UTF-8?q?d=20on=20pull=20requests?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 0.1.0 release failed at the build step after the tag was cut, because the
release build installs build requirements with hashes from the lock and the
lock lacked some. Pull requests now run that same build, so the next such gap
fails before merge.
---
 .github/workflows/check.yaml | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/check.yaml b/.github/workflows/check.yaml
index 3506978..a0af25d 100644
--- a/.github/workflows/check.yaml
+++ b/.github/workflows/check.yaml
@@ -44,6 +44,13 @@ jobs:
       pull-requests: read
     with:
       dry-run: true
+  build:
+    # the release's own build, with the hashed build requirements the lock pins, so a pull request that would fail it
+    # fails here instead of after the release is tagged
+    name: 🏗️ Release build
+    uses: tox-dev/github-workflows/.github/workflows/validate-python-release.yaml@0c4cffd63033d38196319524d101caae1eef925b # 6.7.2
+    permissions:
+      contents: read
   hooks:
     name: 🧹 Hooks under the cooldown
     uses: tox-dev/github-workflows/.github/workflows/cooled-hooks.yaml@0c4cffd63033d38196319524d101caae1eef925b # 6.7.2
@@ -52,7 +59,7 @@ jobs:
   gate:
     name: 🚦 ${{ github.event_name == 'pull_request' && 'Required checks pass' || 'Non-PR checks pass' }}
     if: ${{ !cancelled() }} # codespell:ignore cancelled
-    needs: [test, release, hooks]
+    needs: [test, release, build, hooks]
     runs-on: ubuntu-26.04
     permissions: {}
     steps: