chore: release-infra hardening — sigstore attach on dispatch, wildcard langchain ignore, codeql name

[alphacrack]

What

Four small fixes that surfaced from the v0.5.0 release cycle, packaged together because each is a single-file change with the same 'invisible to users, matters for maintainers' shape.

Fixes

#	File	Change
1	publish-pypi.yml	Attach step now runs on workflow_dispatch against a v* tag too
2	dependabot.yml	Wildcard langchain* ignore for major bumps
3	codeql.yml	Drop redundant single-element matrix; check name becomes Analyze (python) (was Analyze (python) (python))
4	apply_branch_protection.sh	Update required check to the normalized Analyze (python) name

Why each

(1) sigstore attach on workflow_dispatch. v0.5.0 was published via manual dispatch (gh workflow run publish-pypi.yml --ref v0.5.0) because the first tag-triggered run failed at SBOM generation and had to be re-run after that fix landed. The manual dispatch skipped the "Attach signed artifacts + SBOM" step because it was gated if: github.event_name == 'release' only. Result: the sigstore .sigstore bundles never reached the v0.5.0 Release page; wheel/sdist/SBOM had to be uploaded by hand.

New gate:

if: >-
  github.event_name == 'release' ||
  (github.event_name == 'workflow_dispatch' && startsWith(github.ref, 'refs/tags/'))
env:
  TAG_NAME: ${{ github.event.release.tag_name || github.ref_name }}

(2) wildcard langchain ignore. The previous ignore list enumerated 5 packages. v0.5.0 had to close #23 (langchain-ollama 0.2 → 1.1) because it wasn't in that list, and #10 (a grouped langchain PR) because grouped updates bypass per-package ignores. Wildcard langchain* covers current + future family members (langchain-google-*, langchain-xai, etc.) without hand-maintaining the list.

(3) codeql name normalization. With strategy.matrix.language: ["python"], GitHub renders the check as Analyze (python) (python) — the job's literal name: Analyze (python) plus the matrix value appended. Branch protection had to be configured with the redundant name. Removing the matrix (only one language today) gives the cleaner Analyze (python).

(4) apply_branch_protection.sh follow-through. Same-PR update to the required-check name + a comment above the JSON payload documenting the transition, so anyone re-running the script after this lands knows why the required-check name changed.

Verification

• YAML: publish-pypi.yml, codeql.yml, dependabot.yml parse.
• JSON in apply_branch_protection.sh still parses (python -c 'import json; json.loads(...)' on extracted heredoc content).
• codeql.yml no longer references ${{ matrix.language }} (replaced with literal python in both languages: and category:).

Post-merge

• Re-run ./scripts/apply_branch_protection.sh after this merges — the required-check name changes from Analyze (python) (python) to Analyze (python). Until then, new PRs will show BLOCKED waiting on the old check name that no longer exists.
• Ready to be included in the next release; no user-facing CHANGELOG entry needed (release infra only).

Related

• Unblocks proper sigstore/SBOM attachment for v0.5.1+
• Prevents Bump the langchain group across 1 directory with 5 updates #10-style langchain-family bumps from reaching the queue

Checklist

• YAML/JSON validated
• No runtime code changes
• DCO sign-off
• Small, reviewable diff (4 files, ~35 lines net)