From 8c76533eef61e248729a7d4e96417180098647b4 Mon Sep 17 00:00:00 2001
From: antuarc <carl.antuar@smartservice.qld.gov.au>
Date: Fri, 25 Oct 2024 10:36:20 +1000
Subject: [PATCH 1/4] remove incorrect 'v' from tag name pattern, we don't use
 it

---
 .github/workflows/publish.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 917856a5..8d9cc0d8 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -4,7 +4,7 @@ on:
   push:
   #On versioned releases
     tags:
-      - v*.*.*
+      - *.*.*
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
     inputs:

From e940ee5ac5b0bbbc16c97532e1fea83678215ee5 Mon Sep 17 00:00:00 2001
From: antuarc <carl.antuar@smartservice.qld.gov.au>
Date: Fri, 25 Oct 2024 10:37:06 +1000
Subject: [PATCH 2/4] configure default 'environment' value when publish
 workflow is triggered

---
 .github/workflows/publish.yml | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 8d9cc0d8..78e3dbd0 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -100,32 +100,32 @@ jobs:
     name: Publish Package
     runs-on: ubuntu-latest
     environment:
-      name: ${{ github.event.inputs.environment }}
+      name: ${{ github.event.inputs.environment || 'pypi' }}
       url: ${{ steps.version.outputs.url }}
     concurrency:
       group: ${{ github.event.inputs.environment }}-deployment
       cancel-in-progress: false
-
+    env:
+      ENVIRONMENT: ${{ github.event.inputs.environment || 'pypi' }}
     steps:
       - name: Get Git Tag and set url from environment
         id: version
         run: |
           #!/bin/bash
 
-          ENVIRONMENT=$1
           TAG_VALUE=${GITHUB_REF/refs\/tags\//}
           echo "version=${TAG_VALUE}" >> $GITHUB_ENV
 
           # Extract the repository name (minus the owner/org)
           reponame=$(basename $GITHUB_REPOSITORY)
           echo "reponame=${reponame}" >> $GITHUB_OUTPUT
-          
-          if [ "$ENVIRONMENT" == "pypi" ]; then
-            url="https://pypi.com/p/$reponame"
-          elif [ "$1" == "testpypi" ]; then
+
+          if [ "$env.ENVIRONMENT" == "testpypi" ]; then
             url="https://test.pypi.com/p/$reponame"
+            echo "environment=${env.ENVIRONMENT}" >> $GITHUB_OUTPUT
           else
-           url=""
+            url="https://pypi.com/p/$reponame"
+            echo "environment=pypi" >> $GITHUB_OUTPUT
           fi
 
           echo "url=${url}" >> $GITHUB_OUTPUT
@@ -138,14 +138,14 @@ jobs:
           pip install twine
           python -m build
       - name: Publish package distributions to PyPI
-        if: ${{ startsWith(github.ref, 'refs/tags') && (github.event.inputs.environment == 'pypi' || github.event.inputs.environment == 'publish' ) && github.event.inputs.dryRun != 'true'}}
+        if: ${{ startsWith(github.ref, 'refs/tags') && steps.version.outputs.environment == 'pypi' && github.event.inputs.dryRun != 'true' }}
         uses: pypa/gh-action-pypi-publish@release/v1
 #        with:
 #          skip-existing: true
 #          verbose: true
 #          print-hash: true
       - name: Test Publish package distributions to PyPI
-        if: ${{ startsWith(github.ref, 'refs/tags') && github.event.inputs.environment == 'testpypi' && github.event.inputs.dryRun == 'true' }}
+        if: ${{ startsWith(github.ref, 'refs/tags') && steps.version.outputs.environment == 'testpypi' && github.event.inputs.dryRun == 'true' }}
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
           repository-url: https://test.pypi.org/legacy/

From 9818b6172fb5c965f3741a542924dd5dce3e5f51 Mon Sep 17 00:00:00 2001
From: antuarc <carl.antuar@smartservice.qld.gov.au>
Date: Fri, 25 Oct 2024 10:37:28 +1000
Subject: [PATCH 3/4] check that tag value matches Python version before
 publishing to PyPI

---
 .github/workflows/publish.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 78e3dbd0..7a4ad8ca 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -132,6 +132,16 @@ jobs:
 
       - name: Checkout repository
         uses: actions/checkout@v4
+
+      - name: Validate tag version
+        if: ${{ startsWith(github.ref, 'refs/tags') }}
+        run: |
+          PYTHON_VERSION=$(grep "\bversion='[^']+'" | awk -F "'" '{print $2}')
+          if [ "${steps.version.outputs.version}" != "$PYTHON_VERSION" ]; then
+            echo "Version mismatch; tag version is [${steps.version.outputs.version}] but Python version is [$PYTHON_VERSION]"
+            exit 1
+          fi
+
       - name: Build package ${{ steps.version.outputs.reponame }} @ ${{ steps.version.outputs.version }}
         run: |
           pip install build

From f0cbbb1c000b575ec8d2b3c9f6d4a49e88ea820b Mon Sep 17 00:00:00 2001
From: antuarc <carl.antuar@smartservice.qld.gov.au>
Date: Fri, 25 Oct 2024 10:54:55 +1000
Subject: [PATCH 4/4] quote the GitHub publish workflow tag pattern

---
 .github/workflows/publish.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 7a4ad8ca..f701810a 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -4,7 +4,7 @@ on:
   push:
   #On versioned releases
     tags:
-      - *.*.*
+      - '*.*.*'
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
     inputs: