ci: secure and enhance publish workflow

Author: ParticularlyPythonicBS

.github/workflows/publish.yml

@@ -16,17 +16,28 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
       - name: Install Python 3.12
         run: uv python install 3.12
       - name: Build
         run: uv build
+      - name: Verify tag matches version
+        run: |
+          VERSION=$(grep "__version__ =" temoa/__about__.py | cut -d "'" -f 2)
+          TAG=${GITHUB_REF#refs/tags/v}
+          if [ "$VERSION" != "$TAG" ]; then
+            echo "Error: Tag v$TAG does not match version $VERSION in temoa/__about__.py"
+            exit 1
+          fi
+          echo "Tag v$TAG matches version $VERSION"
       # Check that basic features work and we didn't miss to include crucial files
       - name: Smoke test (wheel)
+        timeout-minutes: 10
         run: uv run --isolated --no-project --with dist/*.whl tests/smoke_test.py
       - name: Smoke test (source distribution)
+        timeout-minutes: 10
         run: uv run --isolated --no-project --with dist/*.tar.gz tests/smoke_test.py
       - name: Publish
         run: uv publish