ci: validate TAG_NAME and force the version used for pypi upload (#79)

This change sets an explicit version to be used based on the TAG_NAME
env var in `cloudbuild.yaml`, which is needed when the tag differs from
the tip of main.

Also sets the fallback version to a local version to ensure it gets
rejected by PyPi in case it ever accidentally is used for uploading.
Also adds a validation check to cloudbuild.yaml to fail fast if it looks
like it might be building the fallback version.

Author: g-husam

cloudbuild.yaml

@@ -13,21 +13,53 @@
 # limitations under the License.
 
 steps:
-  # 1. Build the source distribution (sdist).
-  - name: 'python:3.10'
-    id: 'build-sdist'
-    entrypoint: 'bash'
+  # 1. Validate the tag and normalize the version.
+  # This ensures the build only proceeds for properly formatted release tags (vX.Y.Z).
+  # The normalized version (without 'v') is saved to a file for subsequent steps.
+  - name: 'bash'
+    id: 'validate-tag'
     args:
       - '-c'
       - |
         if [ -z "$TAG_NAME" ]; then
           echo "Error: TAG_NAME is not set. This pipeline is only for tag-based releases."
           exit 1
         fi
+        
+        # Regex for vX.Y.Z (plus optional suffixes starting with '-')
+        if [[ ! "$TAG_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-.*)?$ ]]; then
+          echo "Error: Invalid tag format '$TAG_NAME'. Expected vX.Y.Z or vX.Y.Z-suffix"
+          exit 1
+        fi
+
+        
+        if [[ "$TAG_NAME" == "v0.0.0"* ]]; then
+          echo "Error: Cannot publish fallback version '$TAG_NAME'."
+          exit 1
+        fi
+        
+        # Strip the 'v' prefix and save for subsequent steps
+        VERSION=${TAG_NAME#v}
+        echo "$VERSION" > _PYPI_VERSION.txt
+        echo "Validated version: $VERSION"
+
+  # 2. Build the source distribution (sdist).
+  - name: 'python:3.10'
+    id: 'build-sdist'
+    entrypoint: 'bash'
+    args:
+      - '-c'
+      - |
+        # Explicitly setting the version to use, so that it doesn't use local versions derived from Git
+        # when running for a tag that is behind the latest commit on main.
+        export SETUPTOOLS_SCM_PRETEND_VERSION=$(cat _PYPI_VERSION.txt)
+        echo "Building sdist for version: $${SETUPTOOLS_SCM_PRETEND_VERSION}"
+
         pip install build
         python -m build --sdist
+    waitFor: ['validate-tag']
 
-  # 2. Build the manylinux wheels.
+  # 3. Build the manylinux wheels.
   # We use the manylinux image directly to avoid the "reserved" docker.sock issue.
   # This image is pre-loaded with Python versions and build tools.
   - name: '$_MANYLINUX_IMAGE'
@@ -38,9 +70,17 @@ steps:
       - |
         # Use Python 3.10 as the build controller (it will produce the abi3 wheel)
         PYBIN="/opt/python/cp310-cp310/bin"
+        export SETUPTOOLS_SCM_PRETEND_VERSION=$(cat _PYPI_VERSION.txt)
 
         # Install build dependencies
-        $$PYBIN/pip install build
+        $$PYBIN/pip install build setuptools-scm
+
+        # Validation: Ensure scikit-build-core is actually using our pretend version
+        DETECTED_VERSION=$$($$PYBIN/python -c "import setuptools_scm; print(setuptools_scm.get_version())")
+        if [ "$$DETECTED_VERSION" != "$$SETUPTOOLS_SCM_PRETEND_VERSION" ]; then
+          echo "Error: Version mismatch! Expected $$SETUPTOOLS_SCM_PRETEND_VERSION but detected $$DETECTED_VERSION."
+          exit 1
+        fi
 
         echo "Building wheel (scikit-build-core will handle abi3 and C++ extension compilation)..."
         SKBUILD_CMAKE_ARGS="-DBUILD_TESTING=OFF" $$PYBIN/python -m build --wheel
@@ -54,8 +94,7 @@ steps:
         rm dist/*-linux_*.whl
     waitFor: ['build-sdist']
 
-
-  # 3. Upload to internal Artifact Registry (AR) for OSS Exit Gate.
+  # 4. Upload to internal Artifact Registry (AR) for OSS Exit Gate.
   - name: 'python:3.10'
     id: 'upload-to-ar'
     entrypoint: 'bash'
@@ -66,7 +105,7 @@ steps:
         twine upload --repository-url https://us-python.pkg.dev/oss-exit-gate-prod/${_PROJECT_NAME}--pypi dist/*
     waitFor: ['build-wheels']
 
-  # 4. Create and upload the manifest to GCS to trigger the Exit Gate publication.
+  # 5. Create and upload the manifest to GCS to trigger the Exit Gate publication.
   # The presence of this file in the specific GCS bucket triggers the verification and publishing process.
   - name: 'gcr.io/cloud-builders/gcloud'
     id: 'trigger-exit-gate'

pyproject.toml

@@ -160,9 +160,9 @@ cmake.source-dir = "."
 # Tool-specific Configuration for setuptools-scm
 # ===================================================================
 [tool.setuptools_scm]
-# Fallback version to use if git is not available or the directory is not a git repo.
-# This prevents build failures in environments like some CI runners or /tmp clones.
-fallback_version = "0.0.0"
+# Fallback version for local development in non-git environments.
+# The '+' ensures PyPI will reject this version if it's accidentally uploaded.
+fallback_version = "0.0.0+dev.local"
 
 # ===================================================================
 # Tool-specific Configuration for Ruff