Fix/release plugin

[eschaar]

Summary

Hardened release packaging/versioning and aligned Poetry installation across CI workflows.

• Fixed release tag creation flow with compact in-step SemVer validation (X.Y.Z without v prefix) in release.yml.
• Pinned Poetry CLI version via POETRY_VERSION and upgraded pin to 2.3.4.
• Enabled poetry-dynamic-versioning plugin in release build runtime to prevent fallback 0.0.0 artifacts.
• Added plugin visibility step (poetry self show plugins) for easier CI troubleshooting.
• Kept release build safeguards:
  • checkout pinned to refs/tags/${{ needs.release.outputs.version }}
  • tag checkout validation before build
  • built artifact version validation after build
• Aligned Poetry installation to the same pinned version across:
  • release.yml
  • qa.yml
  • verify.yml
  • security.yml
• Updated CHANGELOG.md with 1.3.3 entries matching these workflow fixes.

Related Issues

• PyPI release produced 0.0.0 artifacts instead of expected SemVer tag version.

Validation

• Tests pass locally
• CI checks pass
• Docs updated (if needed)

Release Impact

• fix: (patch)
• feat: (minor)
• BREAKING CHANGE (major)
• No release impact

[Copilot]

Pull request overview

This PR hardens the release/versioning workflow for vstack’s packaging pipeline by pinning Poetry consistently across CI workflows and ensuring poetry-dynamic-versioning is active during release builds to avoid 0.0.0 artifacts.

Changes:

• Pin Poetry via POETRY_VERSION and use it consistently across release.yml, qa.yml, verify.yml, and security.yml.
• Update release tag creation to inline strict SemVer validation (X.Y.Z, no v prefix) and improve tag handling.
• Ensure release build runtime can see the dynamic versioning plugin and add a plugin visibility step for troubleshooting.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
CHANGELOG.md	Adds 1.3.3 notes documenting the workflow hardening and packaging fixes.
.github/workflows/release.yml	Pins Poetry, injects dynamic versioning plugin into the Poetry runtime for release builds, adds plugin listing, and inlines SemVer validation in tag creation.
.github/workflows/qa.yml	Pins Poetry installation via POETRY_VERSION for QA jobs.
.github/workflows/verify.yml	Pins Poetry installation via POETRY_VERSION for PR verification jobs.
.github/workflows/security.yml	Pins Poetry installation via POETRY_VERSION for PR security scanning job.