ci: publish to PyPI from release tags

release-gate now builds and publishes via trusted publishing (OIDC) when a v* tag is pushed; verifies the tag matches pyproject version first.

Author: Lundez

.github/workflows/ci.yml

@@ -109,7 +109,38 @@ jobs:
                   echo "Isolated install smoke test passed."
 
     release-gate:
+        if: startsWith(github.ref, 'refs/tags/v')
         needs: [test-and-build, s3-integration, isolated-install-smoke]
         runs-on: ubuntu-latest
+        permissions:
+            id-token: write  # OIDC -> PyPI trusted publishing (no API token)
+            contents: read
+
         steps:
-            - run: echo "All release gates passed."
+            - name: Check out repository
+              uses: actions/checkout@v4
+
+            - name: Set up Python
+              uses: actions/setup-python@v5
+              with:
+                  python-version: "3.12"
+
+            - name: Set up uv
+              uses: astral-sh/setup-uv@v4
+
+            - name: Verify tag matches package version
+              run: |
+                  set -euo pipefail
+                  TAG_VERSION="${GITHUB_REF_NAME#v}"
+                  PACKAGE_VERSION="$(sed -n 's/^version = "\(.*\)"/\1/p' pyproject.toml)"
+                  if [ "$TAG_VERSION" != "$PACKAGE_VERSION" ]; then
+                    echo "Tag ${GITHUB_REF_NAME} does not match pyproject version ${PACKAGE_VERSION}" >&2
+                    exit 1
+                  fi
+                  echo "Releasing dataref ${PACKAGE_VERSION}"
+
+            - name: Build package
+              run: uv build
+
+            - name: Publish to PyPI
+              run: uv publish --publish-url https://upload.pypi.org/legacy/ --check-url https://pypi.org/pypi/dataref/json