[krishan711]

Releases now go through a workflow, so nobody can push version tags by hand (a new v* tag ruleset blocks it for everyone, including admins).

How to release: bump version in pyproject.toml in a PR, merge it, then run Actions → Release → Run workflow on main. It pushes vX.Y.Z with a deploy key, which starts the Publish workflow, which publishes to PyPI and creates the GitHub release.

• release.yml (new): runs only on main (the release environment, which holds the deploy key, only allows main). The version must be plain X.Y.Z. A version already tagged on another commit fails with a hint to bump it.
• publish.yml (was release.yml, triggered by the tag as before):
  • Fixed: it checked the version with python3 setup.py --version, but setup.py was removed in the switch to pyproject.toml (Feb 2025), so every release since would have failed. The check is gone: the tag now always comes from pyproject.toml.
  • actions/checkout@v2 → @v7, and the archived actions/create-release@v1 → gh release create, as in the JS repos. This path has not run since 2024.

Settings already applied: release environment with RELEASE_DEPLOY_KEY, deploy key, version tags ruleset.