[scottvr]

Why

PyPI is stuck at 2.1.0 while main says 2.2.1. The publish history is 3 successes out of 10 attempts, and every failure was either a tag that didn't match pyproject.toml (v2.2.0, v2.0.1–v2.0.4) or dependency drift nobody saw until tag day (v2.2.1, failed on types-networkx stub changes).

What changes

publish-pypi.yml: release on version bump, not on tag push.

• Triggers on push to main (plus workflow_dispatch, main only).
• A check job reads project.version from pyproject.toml. If v<version> already exists as a tag it does nothing. If the version is already on PyPI but untagged it fails loudly with the tag command to run.
• Otherwise: run tests → build + validate sdist/wheel → publish via Trusted Publishing (still pauses for the pypi environment approval) → create the v<version> tag and a GitHub Release, with notes extracted from the matching # PHART <version> section of PYPI-RELEASE-NOTES.md and the dist files attached.
• Release flow becomes: bump the version in pyproject.toml, push to main, approve the deployment. The tag can no longer disagree with the version because the workflow derives it.

test.yaml: weekly cron. Dependency and stub updates now surface as a scheduled red X instead of a failed release.

Manual steps that go with this PR (repo settings, not files)

These were applied/attempted alongside the PR. If any didn't land, run them:

1. The pypi environment currently only allows deployments from v* tags. The new workflow deploys from main:

   gh api -X POST repos/scottvr/phart/environments/pypi/deployment-branch-policies -f name=main -f type=branch
   gh api -X DELETE repos/scottvr/phart/environments/pypi/deployment-branch-policies/56262830   # the old v* tag policy
   

2. Narrow the 2.0.0-protect ruleset to main with only deletion + force-push protection (it currently restricts creation/update on every branch, which is why PRs show as BLOCKED):

   gh api -X PUT repos/scottvr/phart/rulesets/17097309 --input - <<'JSON'
   {"name":"protect-main","target":"branch","enforcement":"active",
    "bypass_actors":[{"actor_id":5,"actor_type":"RepositoryRole","bypass_mode":"always"}],
    "conditions":{"ref_name":{"include":["~DEFAULT_BRANCH"],"exclude":[]}},
    "rules":[{"type":"deletion"},{"type":"non_fast_forward"}]}
   JSON
   

3. Delete .github/workflows/mypy.yaml. It duplicates the mypy step already in test.yaml and only adds a second red X.

After merge

main is at 2.2.1 with no v2.2.1 tag pointing at a published build. If you first delete the stale v2.2.1 tag (git push --delete origin v2.2.1), the merge of this PR will itself release 2.2.1 after you approve the deployment. Otherwise bump to 2.2.2.

🤖 Generated with Claude Code