ci: converge matrix to single 'CI' required-check job

.github/workflows/ci.yml

@@ -115,3 +115,36 @@ jobs:
       - name: Test
         working-directory: opengateway/mojo
         run: pixi run -e mojo mojo run test_router.mojo 2>&1 | tail -30 || true
+
+  # Convergence job — the single required status check on the main
+  # branch. Waits for the full Python matrix and treats Mojo as
+  # informational (its steps use ``continue-on-error: true`` since the
+  # Mojo toolchain is nightly-quality). PR branch protection rules
+  # (see repository ruleset) key off this job's name so reviewers see
+  # one green tick rather than nine.
+  ci:
+    name: CI
+    runs-on: ubuntu-latest
+    needs: [python, mojo]
+    if: always()
+    steps:
+      - name: Python matrix result
+        run: |
+          result="${{ needs.python.result }}"
+          echo "Python matrix result: $result"
+          if [ "$result" != "success" ]; then
+            echo "::error::Python matrix did not succeed (result=$result)."
+            exit 1
+          fi
+
+      - name: Mojo result (informational)
+        run: |
+          result="${{ needs.mojo.result }}"
+          echo "Mojo job result: $result"
+          # Mojo is nightly-quality: failures are warnings, not
+          # blockers. The status check stays green so the ruleset
+          # passes; reviewers see Mojo's individual job status on the
+          # PR for the real signal.
+          if [ "$result" != "success" ] && [ "$result" != "skipped" ]; then
+            echo "::warning::Mojo job did not succeed (result=$result); continuing because Mojo is informational."
+          fi

.github/workflows/release-please.yml

@@ -18,17 +18,42 @@ jobs:
     name: Release Please
     runs-on: ubuntu-latest
     steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+
+      - name: Compute next calver version
+        id: calver
+        run: |
+          set -euo pipefail
+          # Find the most recent calver tag (matching vYYYY.M.PATCH).
+          PREV=$(git describe --tags --match 'v20*' --abbrev=0 2>/dev/null || true)
+          TODAY_YM=$(date -u +'%Y.%-m')
+          if [[ "$PREV" =~ ^v([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
+            PREV_YM="${BASH_REMATCH[1]}.${BASH_REMATCH[2]}"
+            PREV_PATCH="${BASH_REMATCH[3]}"
+            if [ "$PREV_YM" = "$TODAY_YM" ]; then
+              NEXT_PATCH=$((10#$PREV_PATCH + 1))
+            else
+              NEXT_PATCH=1
+            fi
+          else
+            NEXT_PATCH=1
+          fi
+          NEXT="${TODAY_YM}.${NEXT_PATCH}"
+          echo "version=${NEXT}" >> "$GITHUB_OUTPUT"
+          echo "Next calver: ${NEXT}"
+
       - id: release
         uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           release-type: python
           package-name: opengateway
           changelog-path: CHANGELOG.md
-          bump-minor-pre-major: true
-          bump-patch-for-minor-pre-major: false
           default-branch: main
           include-component-in-tag: false
+          release-as: ${{ steps.calver.outputs.version }}
 
       - name: Publish to PyPI (on release)
         if: steps.release.outputs.release_created == 'true'