From 04474e6c1145c01908df1fdf5d72d646acae4c99 Mon Sep 17 00:00:00 2001
From: Johnny Huynh <27847622+johnnyhuy@users.noreply.github.com>
Date: Sat, 19 Sep 2026 18:50:43 +1000
Subject: [PATCH 1/2] ci: switch release-please to calver (YYYY.M.PATCH)

Compute the next version from today's date and the most recent
calver tag, then pass it via release-as so every push to main
produces a release PR (e.g. 2026.9.1, 2026.9.2, 2026.10.1).

Same-month pushes bump the patch counter; new months reset to
patch 1. release-please has no native calver strategy, so this
overrides its conventional-commit-derived version with the
computed one each run.
---
 .github/workflows/release-please.yml | 29 ++++++++++++++++++++++++++--
 1 file changed, 27 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 19e3692..1eefb76 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -18,6 +18,32 @@ jobs:
     name: Release Please
     runs-on: ubuntu-latest
     steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+
+      - name: Compute next calver version
+        id: calver
+        run: |
+          set -euo pipefail
+          # Find the most recent calver tag (matching vYYYY.M.PATCH).
+          PREV=$(git describe --tags --match 'v20*' --abbrev=0 2>/dev/null || true)
+          TODAY_YM=$(date -u +'%Y.%-m')
+          if [[ "$PREV" =~ ^v([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
+            PREV_YM="${BASH_REMATCH[1]}.${BASH_REMATCH[2]}"
+            PREV_PATCH="${BASH_REMATCH[3]}"
+            if [ "$PREV_YM" = "$TODAY_YM" ]; then
+              NEXT_PATCH=$((10#$PREV_PATCH + 1))
+            else
+              NEXT_PATCH=1
+            fi
+          else
+            NEXT_PATCH=1
+          fi
+          NEXT="${TODAY_YM}.${NEXT_PATCH}"
+          echo "version=${NEXT}" >> "$GITHUB_OUTPUT"
+          echo "Next calver: ${NEXT}"
+
       - id: release
         uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         with:
@@ -25,10 +51,9 @@ jobs:
           release-type: python
           package-name: opengateway
           changelog-path: CHANGELOG.md
-          bump-minor-pre-major: true
-          bump-patch-for-minor-pre-major: false
           default-branch: main
           include-component-in-tag: false
+          release-as: ${{ steps.calver.outputs.version }}
 
       - name: Publish to PyPI (on release)
         if: steps.release.outputs.release_created == 'true'

From 59693e8ff10b2754c95783b791e7d68d912f2f6b Mon Sep 17 00:00:00 2001
From: Johnny Huynh <27847622+johnnyhuy@users.noreply.github.com>
Date: Sat, 19 Sep 2026 19:38:28 +1000
Subject: [PATCH 2/2] ci: converge matrix to single 'CI' required-check job
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PRs to main show nine separate status checks (Python matrix × 6
platforms + Mojo + CodeQL + Socket Security), which makes branch
ruleset configuration brittle — each platform combination would
need to be listed. Add a final ``ci`` job that waits on the
Python matrix and treats the Mojo job as informational (Mojo
toolchain is nightly-quality, not a blocker).

The ``ci`` job is the single required status check on the main
branch ruleset. Reviewers see one green tick; the underlying
matrix detail is still visible on the PR.

- Adds ``needs: [python, mojo]`` + ``if: always()`` convergence job
- Python matrix failure → ``ci`` fails
- Mojo failure → ``ci`` stays green, surfaces as ``::warning::``
---
 .github/workflows/ci.yml | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 541345e..f0bae01 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -115,3 +115,36 @@ jobs:
       - name: Test
         working-directory: opengateway/mojo
         run: pixi run -e mojo mojo run test_router.mojo 2>&1 | tail -30 || true
+
+  # Convergence job — the single required status check on the main
+  # branch. Waits for the full Python matrix and treats Mojo as
+  # informational (its steps use ``continue-on-error: true`` since the
+  # Mojo toolchain is nightly-quality). PR branch protection rules
+  # (see repository ruleset) key off this job's name so reviewers see
+  # one green tick rather than nine.
+  ci:
+    name: CI
+    runs-on: ubuntu-latest
+    needs: [python, mojo]
+    if: always()
+    steps:
+      - name: Python matrix result
+        run: |
+          result="${{ needs.python.result }}"
+          echo "Python matrix result: $result"
+          if [ "$result" != "success" ]; then
+            echo "::error::Python matrix did not succeed (result=$result)."
+            exit 1
+          fi
+
+      - name: Mojo result (informational)
+        run: |
+          result="${{ needs.mojo.result }}"
+          echo "Mojo job result: $result"
+          # Mojo is nightly-quality: failures are warnings, not
+          # blockers. The status check stays green so the ruleset
+          # passes; reviewers see Mojo's individual job status on the
+          # PR for the real signal.
+          if [ "$result" != "success" ] && [ "$result" != "skipped" ]; then
+            echo "::warning::Mojo job did not succeed (result=$result); continuing because Mojo is informational."
+          fi