From e8249f7c14de1a7574905df94f2e7a3768f62705 Mon Sep 17 00:00:00 2001
From: Xiao Gui <xgui3783@gmail.com>
Date: Mon, 27 Oct 2025 16:10:20 +0100
Subject: [PATCH 1/3] ci/cd: build on push, release on tag

---
 .github/workflows/publish.yml | 52 +++++++++++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100644 .github/workflows/publish.yml

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000000..984fae5c8f
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,52 @@
+# adapted from https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/#workflow-definition
+name: Publish Python 🐍 distribution 📦 to PyPI and TestPyPI
+
+on: push
+
+jobs:
+  build:
+    name: Build distribution 📦
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
+    - name: Set up Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: "3.x"
+    - name: Install pypa/build
+      run: >-
+        python3 -m
+        pip install
+        build
+        --user
+    - name: Build a binary wheel and a source tarball
+      run: python3 -m build
+    - name: Store the distribution packages
+      uses: actions/upload-artifact@v4
+      with:
+        name: python-package-distributions
+        path: dist/
+        
+  publish-to-pypi:  
+    name: >-
+      Publish Python 🐍 distribution 📦 to PyPI
+    if: startsWith(github.ref, 'refs/tags/')  # only publish to PyPI on tag pushes
+    needs:
+    - build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/ebrains-drive
+    permissions:
+      id-token: write  # IMPORTANT: mandatory for trusted publishing
+    steps:
+    - name: Download all the dists
+      uses: actions/download-artifact@v4
+      with:
+        name: python-package-distributions
+        path: dist/
+    - name: Publish distribution 📦 to PyPI
+      uses: pypa/gh-action-pypi-publish@release/v1
\ No newline at end of file

From fb1cf1f274bff0c193d6243d12bb174841e95817 Mon Sep 17 00:00:00 2001
From: Xiao Gui <xgui3783@gmail.com>
Date: Thu, 30 Oct 2025 10:58:26 +0100
Subject: [PATCH 2/3] ci: add version verification

---
 .github/workflows/publish.yml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 984fae5c8f..1ed7f09162 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -29,6 +29,17 @@ jobs:
       with:
         name: python-package-distributions
         path: dist/
+
+  verify-tag:
+    name: verify tag conforms
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-latest
+    steps:
+    - name: Check tag conforms
+      run: |
+        trimmed_tag=${GITHUB_REF#refs/tags/}
+        echo trimmed_tag='"'$trimmed_tag'"'
+        exit [[ "$trimmed_tag" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9]+)?$ ]]
         
   publish-to-pypi:  
     name: >-
@@ -36,6 +47,7 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/')  # only publish to PyPI on tag pushes
     needs:
     - build
+    - verify-tag
     runs-on: ubuntu-latest
     environment:
       name: pypi

From 3fe5cb4e5d255f54fadb6fe223efae8b1b963d27 Mon Sep 17 00:00:00 2001
From: Xiao Gui <xgui3783@gmail.com>
Date: Thu, 30 Oct 2025 11:15:44 +0100
Subject: [PATCH 3/3] ci: restrict version check to prod

---
 .github/workflows/publish.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 1ed7f09162..1a345e4a3a 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -35,11 +35,11 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
     steps:
-    - name: Check tag conforms
+    - name: "Check tag conforms ^[0-9]+\\.[0-9]+\\.[0-9]+$"
       run: |
         trimmed_tag=${GITHUB_REF#refs/tags/}
         echo trimmed_tag='"'$trimmed_tag'"'
-        exit [[ "$trimmed_tag" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9]+)?$ ]]
+        exit [[ "$trimmed_tag" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]
         
   publish-to-pypi:  
     name: >-