make release(s) on tag push, not main push

Author: ric-evans

.github/workflows/cicd.yml

@@ -2,7 +2,8 @@ name: ci/cd
 
 on:
   push:
-    branches: [ main ]
+    branches: [ '**' ]
+    tags-ignore: [ '**' ]
 
 jobs:
 
@@ -118,10 +119,10 @@ jobs:
 
 
   ############################################################################
-  # RELEASE
+  # TAG NEW VERSION
   ############################################################################
 
-  release:
+  tag-new-version:
     # only run on main/master/default
     if: format('refs/heads/{0}', github.event.repository.default_branch) == github.ref
     needs: [
@@ -132,11 +133,12 @@ jobs:
       py-dependencies
     ]
     runs-on: ubuntu-latest
-    concurrency: release  # prevent any possible race conditions
+    concurrency: tag-new-version  # prevent any possible race conditions
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0  # required to see tags and commits
+          ref: ${{ github.sha }}  # in case 'ref' (arg default) has been updated since start
       - uses: actions/setup-python@v5
         with:
           python-version: "${{ fromJSON(needs.py-versions.outputs.matrix)[0] }}"
@@ -146,28 +148,15 @@ jobs:
         with:
           force-patch-if-no-commit-token: true
           ignore-paths: |
-            .github/**
             .gitignore
             assets/**
             dependencies-logs/**
             resources/foo/**
 
-      - uses: WIPACrepo/wipac-dev-py-build-action@main
+      - name: Tag New Version
         if: steps.next-version.outputs.version != ''
-        with:
-          version: ${{ steps.next-version.outputs.version }}
-
-      - uses: softprops/action-gh-release@v2
-        if: steps.next-version.outputs.version != ''
-        with:
-          files: dist/*
-          tag_name: v${{ steps.next-version.outputs.version }}
-          generate_release_notes: true
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - uses: pypa/gh-action-pypi-publish@release/v1
-        if: steps.next-version.outputs.version != ''
-        with:
-          user: __token__
-          password: ${{ secrets.PYPI_TOKEN }}
+        run: |
+          set -euo pipefail
+          echo "now: $(date -u +"%Y-%m-%dT%H:%M:%S.%3N")"
+          git tag ${{ steps.next-version.outputs.version }}
+          git push origin ${{ steps.next-version.outputs.version }}

.github/workflows/release.yml

@@ -0,0 +1,46 @@
+name: release
+
+on:
+  push:
+    branches-ignore: [ '**' ]
+    tags: [ 'v*.*.*' ]
+
+jobs:
+
+  py-versions:
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.versions.outputs.matrix }}
+    steps:
+      - uses: actions/checkout@v4
+      - id: versions
+        uses: WIPACrepo/wipac-dev-py-versions-action@v2.5
+
+  release:
+    if: github.ref_type == 'tag'  # redundant b/c workflow's 'on'
+    needs: [ py-versions ]
+    runs-on: ubuntu-latest
+    concurrency: release  # prevent any possible race conditions
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # required to see tags and commits
+          ref: ${{ github.sha }}  # in case 'ref' (arg default) has been updated since start
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "${{ fromJSON(needs.py-versions.outputs.matrix)[0] }}"
+
+      - uses: WIPACrepo/wipac-dev-py-build-action@main
+
+      - uses: softprops/action-gh-release@v2
+        # uses 'github.ref_name' as associated tag
+        with:
+          files: dist/*
+          generate_release_notes: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          user: __token__
+          password: ${{ secrets.PYPI_TOKEN }}