* to get more diagnostic information than just
  "unexpected EOF while looking for matching `''"
* use that mode in GitLab CI/CD

* because sonarqube needs the coverage.xml artifact from the test run

* create coverage report with `coverage xml`
* add coverage.xml as artifact
* exclude tests and JS from coverage in SonarQube

* we were still trying to install python packages via pip install here

* run tests on a release tag but not on commits to master

* also, run tests on merge requests

* because non-virtual pip environments have been marked as read-only in
  most distros these days

* Pipfile isn't taken into account when installing Python packages via
  `pip install`, so the Flask-Session-Captcha pin wasn't taken into
  account in our deployment

* in hopes that publish failures will be less confusing from now on
* also, to detect errors (e.g. missing files in MANIFEST.in) earlier

* triggered by version tags