Verify tag matches version before publishing

.github/check-version.py

@@ -0,0 +1,29 @@
+#!/usr/bin/env python
+"""
+Check the version poetry is building matches the version from `GITHUB_REF` environment variable.
+"""
+import os
+import re
+import subprocess
+import sys
+
+
+def main() -> int:
+    version_ref = os.getenv('GITHUB_REF')
+    if version_ref:
+        version = re.sub('^refs/tags/v*', '', version_ref.lower())
+    else:
+        exit('✖ "GITHUB_REF" env variables not found')
+
+    project_version = subprocess.check_output(['poetry', 'version', '--short'], encoding='utf-8').strip()
+
+    if project_version == version:
+        print(f'✓ GITHUB_REF matches version {project_version!r}')
+        return 0
+    else:
+        print(f'✖ GITHUB_REF version {version!r} does not poetry version {project_version!r}')
+        return 1
+
+
+if __name__ == '__main__':
+    sys.exit(main())

.github/workflows/ci.yml

@@ -3,10 +3,11 @@ name: Test
 on:
   push:
     branches: [ main ]
+    tags:
+      - '**'
   pull_request:
     branches: [ main ]
 
-
 env:
   PRE_COMMIT_COLOR: always
 
@@ -160,15 +161,7 @@ jobs:
         cache: 'poetry'
 
     - name: check package version
-      run: |
-        set -euo pipefail
-        package_ver="$(poetry version --short)"
-        if [[ "refs/tags/v${package_ver}" == "$GITHUB_REF" ]]
-          echo "✓ GITHUB_REF version matches ${package_ver}"
-        else
-          echo >&2 "✖ GITHUB_REF '${GITHUB_REF}' does not match package version '${package_ver}'
-          exit 1
-        fi
+      run: .github/check-version.py
 
     - name: get dist artifacts
       uses: actions/download-artifact@v3