ci: fail on tag/version mismatch; create a GitHub Release per tag

Author: changkun

.github/workflows/publish.yml

@@ -6,17 +6,27 @@ on:
   push:
     tags: ["v*"]
 permissions:
-  contents: read
+  contents: write # tag-anchored GitHub Release
 jobs:
   publish:
     runs-on: ubuntu-latest
     permissions:
       id-token: write
     steps:
       - uses: actions/checkout@v4
+      # A tag must publish exactly the version it names; a stale
+      # pyproject.toml fails fast instead of a late PyPI reject.
+      - name: tag matches package version
+        run: |
+          v=$(python3 -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
+          [ "v$v" = "$GITHUB_REF_NAME" ] || { echo "tag $GITHUB_REF_NAME != pyproject v$v" >&2; exit 1; }
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
       - run: pip install build pytest && python -m pytest tests/ -q
       - run: python -m build
       - uses: pypa/gh-action-pypi-publish@release/v1
+      - name: github release
+        run: gh release create "$GITHUB_REF_NAME" --generate-notes
+        env:
+          GH_TOKEN: ${{ github.token }}