fix(release): force tag version + strip local identifier in CI

The v0.3.5 publish failed because setuptools-scm produced
"0.3.6.dev0+g7e9e85604.d20260517" instead of "0.3.5":

  1. CI checkout is at the tagged commit, but the frontend build step
     (`npm run build:viewer`) modifies tracked files before
     `python -m build` runs.
  2. setuptools-scm sees a dirty tree → bumps to dev0 + adds
     "+gHASH.dDATE" local version identifier.
  3. PyPI 400s on upload because PEP 440 forbids local version
     identifiers on public package indexes.

Two complementary fixes per setuptools-scm's documented best practice:

- `SETUPTOOLS_SCM_PRETEND_VERSION_FOR_LLM_EVALUATION_SYSTEM` set from
  the git tag in `publish.yml`. Bypasses setuptools-scm's tree
  inspection entirely; the version published is exactly the tag value.
- `local_scheme = "no-local-version"` in `pyproject.toml` as defense
  in depth — even if a local dev build accidentally produced a wheel
  someone tried to upload, the "+gHASH" suffix wouldn't be there to
  trip PyPI's PEP 440 check.

Verified locally that setuptools-scm still derives versions correctly
for dev builds; only the PyPI-incompatible suffix is stripped.

Author: DataGomes

.github/workflows/publish.yml

@@ -31,10 +31,19 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@v4
 
-      - name: Verify tag matches the commit
+      - name: Force version from tag
         run: |
-          TAG="${GITHUB_REF#refs/tags/v}"
-          echo "Building for tag v$TAG (setuptools-scm will derive version from git)"
+          # Tag-driven CI publishing: bypass setuptools-scm's working-tree
+          # inspection so the published version is exactly the tag, never
+          # a dev-suffixed derivative. Required because build steps (e.g.
+          # the frontend `npm run build:viewer`) can write into tracked
+          # paths and trip setuptools-scm's dirty-tree detection — without
+          # this override we ship things like 0.3.6.dev0 instead of 0.3.5.
+          # Per setuptools-scm docs the dist-name-scoped env var is the
+          # recommended way to do this in CI.
+          VERSION="${GITHUB_REF#refs/tags/v}"
+          echo "SETUPTOOLS_SCM_PRETEND_VERSION_FOR_LLM_EVALUATION_SYSTEM=$VERSION" >> "$GITHUB_ENV"
+          echo "Forcing build version to $VERSION (from tag $GITHUB_REF)"
 
       - name: Build viewer frontend
         run: |

pyproject.toml

@@ -87,11 +87,15 @@ requires = ["setuptools>=68.0.0", "setuptools-scm>=8.0.0", "wheel"]
 build-backend = "setuptools.build_meta"
 
 [tool.setuptools_scm]
-# Version is derived from the latest `v*` git tag. When building on a tagged
-# commit the version is clean (e.g. "0.3.5"); off-tag commits get a dev
-# version (e.g. "0.3.6.dev3+gabc1234"). `fallback_version` covers sdist
-# builds and shallow clones where git history isn't available.
-fallback_version = "0.0.0+unknown"
+# Version is derived from the latest `v*` git tag. When building on a
+# tagged commit the version is clean (e.g. "0.3.5"); off-tag commits
+# get a dev version (e.g. "0.3.6.dev3"). `local_scheme = "no-local-version"`
+# strips the "+gHASH.dDATE" suffix so the result is always PyPI-acceptable
+# (PEP 440 forbids local version identifiers on public indexes).
+# `fallback_version` covers sdist builds and shallow clones where git
+# history isn't available.
+local_scheme = "no-local-version"
+fallback_version = "0.0.0"
 
 [tool.setuptools.packages.find]
 where = ["."]