Guard PyPI publish release versions

Author: vahidzee

.github/workflows/python-publish.yml

@@ -13,6 +13,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Set up Python
         uses: actions/setup-python@v5
@@ -24,10 +26,24 @@ jobs:
           python -m pip install --upgrade pip
           python -m pip install build twine
 
+      - name: Verify release tag
+        run: |
+          TAG="$(git describe --tags --exact-match)"
+          case "$TAG" in
+            v[0-9]*)
+              echo "Publishing $TAG"
+              ;;
+            *)
+              echo "Refusing to publish from non-release tag: $TAG"
+              exit 1
+              ;;
+          esac
+
       - name: Build and publish
         env:
           TWINE_USERNAME: __token__
           TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
         run: |
           python -m build --sdist --wheel
+          python -m twine check dist/*
           python -m twine upload dist/*

pyproject.toml

@@ -30,7 +30,7 @@ dependencies = [
     "markdown",
     "pygments",
     "pyyaml",
-    "webifier-extensions>=1.0.0",
+    "webifier-extensions>=1.0.1",
 ]
 
 [project.optional-dependencies]