ci: Tag every merge to main, publish on GitHub release

[HQJaTu]

What

Every pull request merged to main gets a version tag automatically. Publishing to PyPI starts when someone publishes a GitHub release on that tag.

1. Tag (.github/workflows/tag.yml, new; runs on pull_request_target: closed): tags the merge commit with the next version.

   Label	Step
   none	patch, 1.2.3 → 1.2.4
   minor-version	minor, 1.2.3 → 1.3.0
   major-version	major, 1.2.3 → 2.0.0

   If no v* tag exists yet, it creates v1.0.0. Tagging alone publishes nothing.

2. Publish (publish.yml; runs on release: published): when a user publishes a GitHub release on a v* tag, it builds that tag, publishes to PyPI, and attaches the wheel and the sdist to the release. Running it by hand on a branch still publishes a .devN version to TestPyPI. Pushing a tag no longer publishes, and PyPI is reached only from a release event.

Details

• Where the version comes from: the tag, through setuptools-scm (dynamic = ["version"], local_scheme = "no-local-version"). pyproject.toml no longer holds a version, so no "bump" commit to main is needed. Publish checks that the built version matches the tag.
• The Tag workflow never checks out or runs pull request code. It reads only the labels and the merge commit, through the API.
• Merges tag one at a time, because of concurrency. A merge commit that is already tagged is refused.
• fetch-depth: 0 is now set on the checkouts in ci.yml and publish.yml, so setuptools-scm can see the tags.
• Trusted Publisher unchanged: it still points at the workflow publish.yml.

Needed before merging

• The release tags ruleset must not have "Restrict creations": GITHUB_TOKEN can't be a ruleset bypass actor (422: "must be part of the ruleset source or owner organization"). Moving and deleting v* tags stays admin-only, and a tag alone publishes nothing.
• Before publishing the v1.0.0 release, add a pending publisher on pypi.org for mfiles-grpc: owner M-Files, repository mfiles-grpc-python, workflow publish.yml, no environment.

Tested locally

• A build from a clone without a tag gives mfiles_grpc-0.1.dev5. With a v1.0.0 tag it gives mfiles_grpc-1.0.0, and the wheel holds no .proto.
• The version script gives the expected result for:
  • no tags;
  • each label on its own;
  • both labels (major wins);
  • v1.9.9 against v1.10.0 (compared as numbers);
  • an already-tagged merge commit (refused).

🤖 Generated with Claude Code