build: CI, packaging and release maintenance

[feanil]

Follow-up maintenance after #57. Six independent commits, each reviewable on its own.

1. build: CI actions off the deprecated Node 20 runtime

Every CI run was emitting this deprecation warning for four actions in backend-ci.yml:

action	before	after
actions/checkout	v4.3.1	v7.0.1
actions/setup-python	v5.6.0	v7.0.0
astral-sh/setup-uv	v4.2.0	v10.0.1
codecov/codecov-action	v4.6.0	v7.0.0

Input compatibility was checked rather than assumed: codecov v7's action.yml still declares all four inputs we pass (token, flags, fail_ci_if_error, working-directory), and setup-uv is used with no inputs at all, so its large version jump has no surface here. This also brings actions/checkout onto the same major as release.yml, which was already on v6.

2. fix: declare the Django versions we actually support

pyproject.toml advertised Framework :: Django :: 4.2 on PyPI, but tox's envlist is py312-django{52,60} and CI runs django52/django60 — 4.2 is tested nowhere. Replaced with 5.2 and 6.0.

3. build: dependabot for GitHub Actions

Because we pin to commit SHAs, nothing moves those pins forward on its own, which is how they drifted onto a deprecated runtime in the first place. Weekly github-actions updates, mirroring openedx-events.

4. build: clarify the release step comment

# Create a draft release read as though the release is left as a draft for something else to publish. gh release create does all three itself: draft, upload, publish.

5. build: attach the tutor plugin dists to the GitHub release

The release page only carried the backend distributions; the tutor plugin's went to PyPI alone. Build | Tutor Plugin now runs before the release is created and both dist globs are passed to gh release create, so all four files land on the release.

The ordering is load-bearing: immutable releases freeze the asset list at publish time, so everything we want attached has to exist before that one command runs. Asset names don't collide — the projects are openedx-plugin-sample and tutor-contrib-sample.

6. build: per-matrix-job uv cache key

Bumping setup-uv surfaced a second, quieter problem: v10 enables caching by default, so all five matrix jobs raced to save one shared cache key and four warned Unable to reserve cache with key ... another job may be creating this cache. Each job runs a different toxenv and so fills the uv cache with a different dependency set, making cache-suffix: ${{ matrix.toxenv }} both quieter and a better fit than one shared key.

Verified

• make quality passes
• Both new classifiers are registered in PyPI's canonical classifier list, so they won't be rejected at upload
• The package builds with the new metadata, and twine check passes on the sdist and the wheel
• All three changed YAML files parse, and the reordered release job's steps come out in the intended sequence
• CI on this branch is green with an empty annotations list — both the Node 20 deprecation warnings and the cache-contention warnings are gone, and codecov v7 reported codecov/patch and codecov/project successfully

The reordering and the extra release assets can only be fully exercised by a real release, which happens on merge.

Deliberately not included

release.yml's upload-artifact (v4→v7), download-artifact (v4→v8) and setup-node (v6→v7). Those are major jumps on a path PR CI never runs — the release workflow only triggers on push to main — so they'd first be exercised on a live release. Better handled as individual dependabot PRs, which item 3 now enables.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.04%. Comparing base (5d5da4e) to head (a2e9713).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #58   +/-   ##
=======================================
  Coverage   93.04%   93.04%           
=======================================
  Files          16       16           
  Lines         503      503           
  Branches       18       18           
=======================================
  Hits          468      468           
  Misses         24       24           
  Partials       11       11           

Flag	Coverage Δ
unittests	93.04% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.