ci: post end-of-run Slack notices from their own job

A failed Slack post now fails only the notify job, not the deploy or
publish job or its GitHub deployment, and "Re-run failed jobs" re-posts
without running the work again. Start notices stay in the work jobs.

Author: gorandodig

.github/workflows/publish-dev-to-pypi.yml

@@ -124,9 +124,18 @@ jobs:
           # version should be a no-op, not a red build.
           skip-existing: true
 
-      # Before the success notice, so a failed success post cannot trigger it.
+  # End-of-run notices run in their own job: a failed Slack post fails only this
+  # job, not the publish or its GitHub deployment, and "Re-run failed jobs"
+  # re-posts without publishing again.
+  notify:
+    name: Notify Slack
+    needs: [build, publish-dev]
+    if: ${{ !cancelled() && vars.SLACK_CHANNEL_ID != '' && contains(fromJSON('["success", "failure"]'), needs.publish-dev.result) }}
+    runs-on: ubuntu-latest
+
+    steps:
       - name: Notify Slack (failure)
-        if: ${{ failure() && vars.SLACK_CHANNEL_ID != '' }}
+        if: ${{ needs.publish-dev.result == 'failure' }}
         uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
         with:
           method: chat.postMessage
@@ -141,7 +150,7 @@ jobs:
       # Spell out the --pre install: a plain "pip install codeplain" will
       # NOT pick this up, which otherwise reads as a broken publish.
       - name: Notify Slack (success)
-        if: ${{ success() && vars.SLACK_CHANNEL_ID != '' }}
+        if: ${{ needs.publish-dev.result == 'success' }}
         uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
         with:
           method: chat.postMessage

.github/workflows/publish-install-script.yml

@@ -15,9 +15,6 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - name: Short SHA for Slack
-        run: echo "SHORT_SHA=${GITHUB_SHA:0:7}" >> "$GITHUB_ENV"
-
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Upload install scripts to R2
@@ -57,9 +54,21 @@ jobs:
             --content-type "text/plain"
           echo "✓ examples.ps1 uploaded to R2"
 
-      # Before the success notice, so a failed success post cannot trigger it.
+  # End-of-run notices run in their own job: a failed Slack post fails only this
+  # job, and "Re-run failed jobs" re-posts without uploading again.
+  notify:
+    name: Notify Slack
+    needs: publish
+    if: ${{ !cancelled() && vars.SLACK_CHANNEL_ID != '' }}
+    runs-on: ubuntu-latest
+    permissions: {}
+
+    steps:
+      - name: Short SHA
+        run: echo "SHORT_SHA=${GITHUB_SHA:0:7}" >> "$GITHUB_ENV"
+
       - name: Notify Slack (failure)
-        if: ${{ failure() && vars.SLACK_CHANNEL_ID != '' }}
+        if: ${{ needs.publish.result == 'failure' }}
         uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
         with:
           method: chat.postMessage
@@ -73,7 +82,7 @@ jobs:
               See <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|the run log>.
 
       - name: Notify Slack (success)
-        if: ${{ success() && vars.SLACK_CHANNEL_ID != '' }}
+        if: ${{ needs.publish.result == 'success' }}
         uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
         with:
           method: chat.postMessage

.github/workflows/publish-to-pypi.yml

@@ -62,19 +62,6 @@ jobs:
         run: |
           gh release upload ${{ github.ref_name }} dist/* --clobber
 
-      - name: Notify Slack (build failure)
-        if: ${{ failure() && vars.SLACK_CHANNEL_ID != '' }}
-        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
-        with:
-          method: chat.postMessage
-          token: ${{ secrets.SLACK_BOT_TOKEN }}
-          errors: true
-          payload: |
-            channel: ${{ vars.SLACK_CHANNEL_ID }}
-            text: >-
-              *Codeplain Client*: Build of `${{ github.ref_name }}` FAILED :x:. Nothing was published to PyPI.
-              See <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|the run log>.
-
   publish-to-pypi:
     name: Publish to PyPI
     needs: build
@@ -88,13 +75,6 @@ jobs:
       id-token: write
 
     steps:
-      # The tag (v0.4.0rc1) without its "v", for the install command in Slack.
-      - name: Version from tag
-        id: version
-        env:
-          TAG: ${{ github.ref_name }}
-        run: echo "version=${TAG#v}" >> "$GITHUB_OUTPUT"
-
       - name: Download distribution packages
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -104,9 +84,31 @@ jobs:
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
 
-      # Before the success notice, so a failed success post cannot trigger it.
+  # End-of-run notices run in their own job: a failed Slack post fails only this
+  # job, not the publish or its GitHub deployment, and "Re-run failed jobs"
+  # re-posts without publishing again.
+  notify:
+    name: Notify Slack
+    needs: [build, publish-to-pypi]
+    if: ${{ !cancelled() && vars.SLACK_CHANNEL_ID != '' }}
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Notify Slack (build failure)
+        if: ${{ needs.build.result == 'failure' }}
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
+        with:
+          method: chat.postMessage
+          token: ${{ secrets.SLACK_BOT_TOKEN }}
+          errors: true
+          payload: |
+            channel: ${{ vars.SLACK_CHANNEL_ID }}
+            text: >-
+              *Codeplain Client*: Build of `${{ github.ref_name }}` FAILED :x:. Nothing was published to PyPI.
+              See <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|the run log>.
+
       - name: Notify Slack (failure)
-        if: ${{ failure() && vars.SLACK_CHANNEL_ID != '' }}
+        if: ${{ needs.publish-to-pypi.result == 'failure' }}
         uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
         with:
           method: chat.postMessage
@@ -118,12 +120,20 @@ jobs:
               *Codeplain Client*: Publishing `${{ github.ref_name }}` to PyPI FAILED :x:.
               See <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|the run log>.
 
+      # The tag (v0.4.0rc1) without its "v", for the install command below.
+      - name: Version from tag
+        id: version
+        if: ${{ needs.publish-to-pypi.result == 'success' }}
+        env:
+          TAG: ${{ github.ref_name }}
+        run: echo "version=${TAG#v}" >> "$GITHUB_OUTPUT"
+
       # GitHub marks the release itself as a pre-release; the tag (v0.4.0rc1)
       # carries the same intent for PEP 440. pip and uv skip pre-releases by
       # default, so "--upgrade" would NOT pick one up. Tell people the command
       # that actually works.
       - name: Notify Slack (pre-release published)
-        if: ${{ success() && github.event.release.prerelease && vars.SLACK_CHANNEL_ID != '' }}
+        if: ${{ needs.publish-to-pypi.result == 'success' && github.event.release.prerelease }}
         uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
         with:
           method: chat.postMessage
@@ -136,7 +146,7 @@ jobs:
               Normal installs are unaffected — try it with `pip install --pre codeplain==${{ steps.version.outputs.version }}`.
 
       - name: Notify Slack (release published)
-        if: ${{ success() && !github.event.release.prerelease && vars.SLACK_CHANNEL_ID != '' }}
+        if: ${{ needs.publish-to-pypi.result == 'success' && !github.event.release.prerelease }}
         uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
         with:
           method: chat.postMessage