ci: switch PyPI publish to OIDC and fix release tagging

- Drop PYPI_API_TOKEN; rely on Trusted Publisher (id-token + pypi env
  already configured).
- Read version from pyproject.toml and skip publish if the version is
  already on PyPI (avoids failing runs on every push to main).
- Tag the release commit as v<version> and create the GitHub release
  with that tag and auto-generated notes (previously used
  github.ref_name which resolves to "main" under workflow_run).
- Bump runner Python to 3.11 so tomllib is available.

Author: pyyupsk

.github/workflows/publish.yml

@@ -16,28 +16,52 @@ permissions:
 
 jobs:
   release-build:
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
     runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+      should_publish: ${{ steps.check.outputs.should_publish }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         name: ⬇️ Checkout repository
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         name: 📦 Setup Python
         with:
-          python-version: "3.9"
-          cache: "pip" # caching pip dependencies
+          python-version: "3.11"
+          cache: "pip"
+      - name: 🔢 Read version
+        id: version
+        run: |
+          VERSION=$(python -c "import tomllib; print(tomllib.loads(open('pyproject.toml','rb').read().decode())['project']['version'])")
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+      - name: 🔎 Check if already published
+        id: check
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          if curl -fsSL "https://pypi.org/pypi/geothai/${VERSION}/json" >/dev/null 2>&1; then
+            echo "should_publish=false" >> "$GITHUB_OUTPUT"
+            echo "ℹ️ geothai ${VERSION} already on PyPI; skipping publish."
+          else
+            echo "should_publish=true" >> "$GITHUB_OUTPUT"
+          fi
       - name: 🔍 Install dependencies
+        if: steps.check.outputs.should_publish == 'true'
         run: |
           python -m pip install --upgrade pip
           pip install -r requirements.txt
       - name: 🏗 Build release
+        if: steps.check.outputs.should_publish == 'true'
         run: python -m build
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: steps.check.outputs.should_publish == 'true'
         name: 📤 Upload artifact
         with:
           name: release
           path: dist/
 
   pypi-publish:
+    if: needs.release-build.outputs.should_publish == 'true'
     runs-on: ubuntu-latest
     needs:
       - release-build
@@ -47,39 +71,49 @@ jobs:
       name: pypi
       url: https://pypi.org/project/geothai
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         name: 📥 Download artifact
         with:
           name: release
           path: dist/
-      - uses: pypa/gh-action-pypi-publish@v1.12.4
+      - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
         name: 🚀 Publish package
-        with:
-          user: __token__
-          password: ${{ secrets.PYPI_API_TOKEN }}
 
   github-release:
+    if: needs.release-build.outputs.should_publish == 'true'
     runs-on: ubuntu-latest
     needs:
+      - release-build
       - pypi-publish
     permissions:
       contents: write
       id-token: write
+    env:
+      VERSION: ${{ needs.release-build.outputs.version }}
+      GITHUB_TOKEN: ${{ github.token }}
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        name: ⬇️ Checkout repository
+        with:
+          fetch-depth: 0
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         name: 📥 Download artifact
         with:
           name: release
           path: dist/
-      - uses: sigstore/gh-action-sigstore-python@v3.0.0
+      - uses: sigstore/gh-action-sigstore-python@04cffa1d795717b140764e8b640de88853c92acc # v3.3.0
         name: 🔑 Sign artifact
         with:
           inputs: dist/*
+      - name: 🏷  Tag commit
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          if ! git rev-parse "v${VERSION}" >/dev/null 2>&1; then
+            git tag "v${VERSION}"
+            git push origin "v${VERSION}"
+          fi
       - name: 🚀 Create Release
-        run: gh release create ${{ github.ref_name }} --repo ${{ github.repository }}
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-      - name: 🚀 Upload Release Asset
-        run: gh release upload ${{ github.ref_name }} dist/* --repo ${{ github.repository }}
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
+        run: gh release create "v${VERSION}" --repo "${GITHUB_REPOSITORY}" --generate-notes
+      - name: 📦 Upload Release Asset
+        run: gh release upload "v${VERSION}" dist/* --repo "${GITHUB_REPOSITORY}"

.github/workflows/test.yml

@@ -8,12 +8,12 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         name: ⬇️ Checkout repository
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         name: 📦 Setup Python
         with:
-          python-version: "3.9"
+          python-version: "3.11"
           cache: "pip" # caching pip dependencies
       - name: 🔍 Install dependencies
         run: |