update tagging/pypi push behavior

Author: psathyrella

.github/workflows/build.yml

@@ -1,23 +1,33 @@
+# Release workflow:
+#   1. merge dev into main
+#   2. git tag v<new-version>  (on main)
+#   3. git push origin main --tags
+# CI runs on every push to main (tests only) and on v* tag pushes (tests + PyPI publish).
+# PyPI publish requires the tag to be on main.
+
 name: Build and Test
 
 on:
   push:
+    branches:
+      - main
     tags:
-      - '*'
+      - 'v*'
 
 jobs:
   docker:
     runs-on: ubuntu-latest
-    env:
-      ACTIONS_ALLOW_UNSECURE_COMMANDS: true
     steps:
     - uses: actions/checkout@v3
     - name: Checkout tags
       run: git fetch --unshallow origin +refs/tags/*:refs/tags/*
-    - name: Set git branch variable
-      run: echo ::set-env name=BRANCH::$(git branch --show-current)
-    - name: Set git tag variable
-      run: if [ $BRANCH == "main" ];then echo ::set-env name=TAG::$(git describe --tags);else echo ::set-env name=TAG::$BRANCH;fi
+    - name: Set docker tag variable
+      run: |
+        if [[ "${{ github.ref }}" == refs/tags/* ]]; then
+          echo "TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
+        else
+          echo "TAG=latest" >> $GITHUB_ENV
+        fi
     - name: Checkout submodules
       shell: bash
       run: |
@@ -120,8 +130,16 @@ jobs:
           partis-test.py --paired --no-per-base-mutation --no-tree-gen
         fi
 
+    - name: Verify tag is on main
+      if: matrix.install-method == 'pip' && startsWith(github.ref, 'refs/tags/v')
+      run: |
+        if ! git branch -r --contains HEAD | grep -q 'origin/main'; then
+          echo "ERROR: tag is not on main branch, skipping PyPI publish"
+          exit 1
+        fi
+
     - name: Build and publish to PyPI
-      if: matrix.install-method == 'pip' && github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')  #  && matrix.os == 'ubuntu-latest'
+      if: matrix.install-method == 'pip' && startsWith(github.ref, 'refs/tags/v')
       run: |
         python -m pip install build twine
         if [ "${{ matrix.os }}" = "ubuntu-latest" ]; then