Build version changing during install and build

[ns-rse]

I've used this action in a number of places successfully but have hit a weird problem.

I've set the workflow to be triggered by tags of the form v* and duly make a release on GitHub with v0.0.1 tag being applied.

pypi.yaml

name: Publish package to PyPi
# See https://docs.pypi.org/trusted-publishers/adding-a-publisher/

on:
  push:
    tags:
      - v*
  workflow_dispatch: # Uncomment line if you also want to trigger action manually

jobs:
  build-release:
    permissions:
      id-token: write
    runs-on: ubuntu-latest
    environment: pypi-publish
    name: Publish package to PyPi
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: 3.12
      - name: Installing the package
        run: |
          pip3 install .[pypi]
      - name: Build package
        run: |
          export DEB_PYTHON_INSTALL_LAYOUT=deb_system
          python -m build --no-isolation
      - name: Publish package to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          user: __token__
          password: ${{ secrets.PYPI_API_TOKEN }}

The repository is cloned and the correct tag is checked out, but when it comes to first installing the package (with the optional pypi dependencies for building) the tag changes to a dev version. As a consequence the upload to PyPI fails.

Log

Checkout stage

Checks out the v0.0.1 tag ok...

2025-05-27T19:14:14.2694780Z ##[group]Run actions/checkout@v4
2025-05-27T19:14:14.2695783Z with:
2025-05-27T19:14:14.2696180Z   fetch-depth: 0
2025-05-27T19:14:14.2696623Z   repository: AFM-SPM/napari-AFMReader
2025-05-27T19:14:14.2697302Z   token: ***
2025-05-27T19:14:14.2697696Z   ssh-strict: true
2025-05-27T19:14:14.2698095Z   ssh-user: git
2025-05-27T19:14:14.2698504Z   persist-credentials: true
2025-05-27T19:14:14.2698958Z   clean: true
2025-05-27T19:14:14.2699367Z   sparse-checkout-cone-mode: true
2025-05-27T19:14:14.2699865Z   fetch-tags: false
2025-05-27T19:14:14.2700277Z   show-progress: true
2025-05-27T19:14:14.2700709Z   lfs: false
2025-05-27T19:14:14.2701074Z   submodules: false
2025-05-27T19:14:14.2701483Z   set-safe-directory: true
2025-05-27T19:14:14.2702112Z ##[endgroup]
2025-05-27T19:14:14.3788742Z Syncing repository: AFM-SPM/napari-AFMReader
2025-05-27T19:14:14.3790549Z ##[group]Getting Git version info
2025-05-27T19:14:14.3791387Z Working directory is '/home/runner/work/napari-AFMReader/napari-AFMReader'
2025-05-27T19:14:14.3792419Z [command]/usr/bin/git version
2025-05-27T19:14:14.3834047Z git version 2.49.0
2025-05-27T19:14:14.3861234Z ##[endgroup]
2025-05-27T19:14:14.3874598Z Temporarily overriding HOME='/home/runner/work/_temp/ec0d370a-693a-4d8d-96a9-3cdaa994b5db' before making global git config changes
2025-05-27T19:14:14.3876208Z Adding repository directory to the temporary git global config as a safe directory
2025-05-27T19:14:14.3886846Z [command]/usr/bin/git config --global --add safe.directory /home/runner/work/napari-AFMReader/napari-AFMReader
2025-05-27T19:14:14.3918779Z Deleting the contents of '/home/runner/work/napari-AFMReader/napari-AFMReader'
2025-05-27T19:14:14.3922213Z ##[group]Initializing the repository
2025-05-27T19:14:14.3926125Z [command]/usr/bin/git init /home/runner/work/napari-AFMReader/napari-AFMReader
2025-05-27T19:14:14.3998092Z hint: Using 'master' as the name for the initial branch. This default branch name
2025-05-27T19:14:14.3999683Z hint: is subject to change. To configure the initial branch name to use in all
2025-05-27T19:14:14.4000592Z hint: of your new repositories, which will suppress this warning, call:
2025-05-27T19:14:14.4001236Z hint:
2025-05-27T19:14:14.4001852Z hint: 	git config --global init.defaultBranch <name>
2025-05-27T19:14:14.4002796Z hint:
2025-05-27T19:14:14.4003550Z hint: Names commonly chosen instead of 'master' are 'main', 'trunk' and
2025-05-27T19:14:14.4004424Z hint: 'development'. The just-created branch can be renamed via this command:
2025-05-27T19:14:14.4005107Z hint:
2025-05-27T19:14:14.4005739Z hint: 	git branch -m <name>
2025-05-27T19:14:14.4006561Z Initialized empty Git repository in /home/runner/work/napari-AFMReader/napari-AFMReader/.git/
2025-05-27T19:14:14.4013608Z [command]/usr/bin/git remote add origin https://github.com/AFM-SPM/napari-AFMReader
2025-05-27T19:14:14.4046178Z ##[endgroup]
2025-05-27T19:14:14.4047435Z ##[group]Disabling automatic garbage collection
2025-05-27T19:14:14.4051036Z [command]/usr/bin/git config --local gc.auto 0
2025-05-27T19:14:14.4079355Z ##[endgroup]
2025-05-27T19:14:14.4080045Z ##[group]Setting up auth
2025-05-27T19:14:14.4085941Z [command]/usr/bin/git config --local --name-only --get-regexp core\.sshCommand
2025-05-27T19:14:14.4115523Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
2025-05-27T19:14:14.4405498Z [command]/usr/bin/git config --local --name-only --get-regexp http\.https\:\/\/github\.com\/\.extraheader
2025-05-27T19:14:14.4433687Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http\.https\:\/\/github\.com\/\.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :"
2025-05-27T19:14:14.4653437Z [command]/usr/bin/git config --local http.https://github.com/.extraheader AUTHORIZATION: basic ***
2025-05-27T19:14:14.4688703Z ##[endgroup]
2025-05-27T19:14:14.4775383Z ##[group]Fetching the repository
2025-05-27T19:14:14.4776946Z [command]/usr/bin/git -c protocol.version=2 fetch --prune --no-recurse-submodules origin +refs/heads/*:refs/remotes/origin/* +refs/tags/*:refs/tags/*
2025-05-27T19:14:16.4011685Z From https://github.com/AFM-SPM/napari-AFMReader
2025-05-27T19:14:16.4013552Z  * [new branch]      main       -> origin/main
2025-05-27T19:14:16.4014464Z  * [new tag]         v0.0.1     -> v0.0.1
2025-05-27T19:14:16.4043681Z [command]/usr/bin/git tag --list v0.0.1
2025-05-27T19:14:16.4068998Z v0.0.1
2025-05-27T19:14:16.4078733Z [command]/usr/bin/git rev-parse refs/tags/v0.0.1
2025-05-27T19:14:16.4098496Z dbad1811601a91814ef7f034e497529ea3b7d018
2025-05-27T19:14:16.4104611Z ##[endgroup]
2025-05-27T19:14:16.4106005Z ##[group]Determining the checkout info
2025-05-27T19:14:16.4107223Z ##[endgroup]
2025-05-27T19:14:16.4110331Z [command]/usr/bin/git sparse-checkout disable
2025-05-27T19:14:16.4148279Z [command]/usr/bin/git config --local --unset-all extensions.worktreeConfig
2025-05-27T19:14:16.4173740Z ##[group]Checking out the ref
2025-05-27T19:14:16.4176584Z [command]/usr/bin/git checkout --progress --force refs/tags/v0.0.1
2025-05-27T19:14:16.8487791Z Note: switching to 'refs/tags/v0.0.1'.
2025-05-27T19:14:16.8489366Z
2025-05-27T19:14:16.8489743Z You are in 'detached HEAD' state. You can look around, make experimental
2025-05-27T19:14:16.8490577Z changes and commit them, and you can discard any commits you make in this
2025-05-27T19:14:16.8491392Z state without impacting any branches by switching back to a branch.
2025-05-27T19:14:16.8491868Z
2025-05-27T19:14:16.8492201Z If you want to create a new branch to retain commits you create, you may
2025-05-27T19:14:16.8493318Z do so (now or later) by using -c with the switch command. Example:
2025-05-27T19:14:16.8493757Z
2025-05-27T19:14:16.8493982Z   git switch -c <new-branch-name>
2025-05-27T19:14:16.8494293Z
2025-05-27T19:14:16.8494480Z Or undo this operation with:
2025-05-27T19:14:16.8494764Z
2025-05-27T19:14:16.8494952Z   git switch -
2025-05-27T19:14:16.8495408Z
2025-05-27T19:14:16.8495896Z Turn off this advice by setting config variable advice.detachedHead to false
2025-05-27T19:14:16.8496436Z
2025-05-27T19:14:16.8496793Z HEAD is now at dbad181 Merge pull request #4 from AFM-SPM/add-pypi-opt-deps
2025-05-27T19:14:16.8516175Z ##[endgroup]
2025-05-27T19:14:16.8554819Z [command]/usr/bin/git log -1 --format=%H
2025-05-27T19:14:16.8577148Z dbad1811601a91814ef7f034e497529ea3b7d018

Setup Python and build

The version changes when collecting the dependencies and installing

2025-05-27T19:14:16.8789990Z ##[group]Run actions/setup-python@v5
2025-05-27T19:14:16.8790331Z with:
2025-05-27T19:14:16.8790575Z   python-version: 3.12
2025-05-27T19:14:16.8790843Z   check-latest: false
2025-05-27T19:14:16.8791221Z   token: ***
2025-05-27T19:14:16.8791456Z   update-environment: true
2025-05-27T19:14:16.8791724Z   allow-prereleases: false
2025-05-27T19:14:16.8791966Z   freethreaded: false
2025-05-27T19:14:16.8792202Z ##[endgroup]
2025-05-27T19:14:17.0423556Z ##[group]Installed versions
2025-05-27T19:14:17.0549691Z Successfully set up CPython (3.12.10)
2025-05-27T19:14:17.0550516Z ##[endgroup]
2025-05-27T19:14:17.0662153Z ##[group]Run pip3 install .
2025-05-27T19:14:17.0662541Z �[36;1mpip3 install .�[0m
2025-05-27T19:14:17.0662822Z �[36;1mpip3 install .[pypi]�[0m
2025-05-27T19:14:17.0852581Z shell: /usr/bin/bash -e {0}
2025-05-27T19:14:17.0852950Z env:
2025-05-27T19:14:17.0853310Z   pythonLocation: /opt/hostedtoolcache/Python/3.12.10/x64
2025-05-27T19:14:17.0853906Z   PKG_CONFIG_PATH: /opt/hostedtoolcache/Python/3.12.10/x64/lib/pkgconfig
2025-05-27T19:14:17.0854477Z   Python_ROOT_DIR: /opt/hostedtoolcache/Python/3.12.10/x64
2025-05-27T19:14:17.0854976Z   Python2_ROOT_DIR: /opt/hostedtoolcache/Python/3.12.10/x64
2025-05-27T19:14:17.0855728Z   Python3_ROOT_DIR: /opt/hostedtoolcache/Python/3.12.10/x64
2025-05-27T19:14:17.0856160Z   LD_LIBRARY_PATH: /opt/hostedtoolcache/Python/3.12.10/x64/lib
2025-05-27T19:14:17.0856491Z ##[endgroup]
2025-05-27T19:14:17.7970835Z Processing /home/runner/work/napari-AFMReader/napari-AFMReader
2025-05-27T19:14:17.8003865Z   Installing build dependencies: started
2025-05-27T19:14:18.7609325Z   Installing build dependencies: finished with status 'done'
2025-05-27T19:14:18.7616394Z   Getting requirements to build wheel: started
2025-05-27T19:14:20.1413826Z   Getting requirements to build wheel: finished with status 'done'
2025-05-27T19:14:20.1422587Z   Preparing metadata (pyproject.toml): started
2025-05-27T19:14:20.7970293Z   Preparing metadata (pyproject.toml): finished with status 'done'
2025-05-27T19:14:20.8492948Z Collecting afmreader (from napari-afmreader==0.0.2.dev0+gdbad181.d20250527)
[v0.0.1_pypi.log](https://github.com/user-attachments/files/20466045/v0.0.1_pypi.log)

As a result the upload fails as dev version tags aren't permitted...

2025-05-27T19:16:21.8973414Z Transparency log entry created with index: 220865771
2025-05-27T19:16:22.5670409Z Uploading distributions to https://upload.pypi.org/legacy/
2025-05-27T19:16:23.3511159Z Uploading napari_afmreader-0.0.2.dev0+gdbad181.d20250527-py3-none-any.whl
2025-05-27T19:16:24.2533935Z �[33mWARNING �[0m Error during upload. Retry with the --verbose option for more details. 
2025-05-27T19:16:24.2543563Z �[31mERROR   �[0m HTTPError: 400 Bad Request from https://upload.pypi.org/legacy/        
2025-05-27T19:16:24.2544416Z          The use of local versions in <Version('0.0.2.dev0+gdbad181.d20250527')>
2025-05-27T19:16:24.2545058Z          is not allowed. See                                                    
2025-05-27T19:16:24.2546043Z          https://packaging.python.org/specifications/core-metadata for more     
2025-05-27T19:16:24.2546709Z          information.                                                           
2025-05-27T19:16:24.3722896Z Post job cleanup.

Full log

Question

Why is the version being built 0.0.2.dev0+gdbad181.d20250527 rather than v0.0.1?