Finalize trusted publishing

Author: galjos

.github/workflows/release.yml

@@ -4,24 +4,16 @@ on:
   push:
     tags:
       - "v*.*.*"
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: Existing release tag to publish
-        required: true
-        type: choice
-        options:
-          - v0.1.0
 
 permissions:
   contents: read
 
 concurrency:
-  group: release-${{ inputs.tag || github.ref_name }}
+  group: release-${{ github.ref_name }}
   cancel-in-progress: false
 
 env:
-  RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
+  RELEASE_TAG: ${{ github.ref_name }}
 
 jobs:
   build:
@@ -31,21 +23,13 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-          ref: ${{ inputs.tag && format('refs/tags/{0}', inputs.tag) || github.ref }}
       - name: Verify release commit
         run: |
           git fetch --no-tags origin main:refs/remotes/origin/main
           release_sha=$(git rev-parse HEAD)
-          tag_object=$(git rev-parse --verify "refs/tags/${RELEASE_TAG}")
           tag_sha=$(git rev-parse --verify "refs/tags/${RELEASE_TAG}^{commit}")
           test "$release_sha" = "$tag_sha"
           git merge-base --is-ancestor "$release_sha" origin/main
-          if [[ "$GITHUB_EVENT_NAME" == "workflow_dispatch" ]]; then
-            test "$GITHUB_REF" = "refs/heads/main"
-            test "$RELEASE_TAG" = "v0.1.0"
-            test "$tag_object" = "1bac90e875b7373fe391f7fbe359783ef545a522"
-            test "$release_sha" = "82f510c3a40aa576bfeef277dd406d42b788250b"
-          fi
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
@@ -171,7 +155,7 @@ jobs:
           pqviewer --no-open --port 8765 > pqviewer.log 2>&1 &
           server_pid=$!
           trap 'kill "$server_pid" 2>/dev/null || true' EXIT
-          for attempt in {1..30}; do
+          for _ in {1..30}; do
             if curl --fail --silent http://127.0.0.1:8765/api/health > /dev/null; then
               break
             fi
@@ -193,10 +177,6 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-          ref: ${{ inputs.tag && format('refs/tags/{0}', inputs.tag) || github.ref }}
-      - name: Verify recovery source
-        if: github.event_name == 'workflow_dispatch'
-        run: test "$(git rev-parse HEAD)" = "82f510c3a40aa576bfeef277dd406d42b788250b"
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
@@ -264,8 +244,8 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          cd dist
-          sha256sum *.whl *.tar.gz > SHA256SUMS
+          cd dist || exit 1
+          sha256sum ./*.whl ./*.tar.gz > SHA256SUMS
           release_flags=()
           if [[ "$RELEASE_TAG" =~ (a|b|rc)[0-9]+$ ]]; then
             release_flags+=(--prerelease)