ci(release): publish tagged releases from triggering ref

[binaryaaron]

Summary

• trigger the full release path when a v* tag is pushed
• retain manual workflow_dispatch with dry-run and create-gh-release, without a separate release-ref
• build, publish, and deploy docs from the run's triggering revision
• remove the temporary release-target checkout and project-directory task arguments added in build: migrate developer tasks to mise #211
• keep release orchestration thin by calling build:wheel, docs:build, and docs:deploy
• target manually created GitHub release tags at the triggering github.sha
• reject tag-triggered releases when the tag and built package version differ
• add regression coverage for trigger, checkout, task, and tag-release contracts

Context

This is stacked on #211. The separate release-ref came from the generic FW-CI release template in #54 and remained when #93 moved the release workflow into this repository. Safe Synthesizer later moved to tag-push releases in Safe-Synthesizer #361. This follow-up adopts that single-revision strategy while preserving manual dispatch for dry runs and controlled release testing.

Validation

• mise tasks validate: all 26 tasks passed
• mise run test -- tests/tools/test_mise_configuration.py -q: 22 focused workflow and tooling tests passed
• mise run check ::: test: 1,213 tests passed; format, lint, type, lock, SPDX, and benchmark shell checks passed
• mise run docs:build: strict documentation build passed
• independent reviewed-engineering review: accepted with no findings

Commits 5f3cb9c and 734d776 are signed and DCO-signed.

[greptile-apps]

Greptile Summary

The PR makes v* tag pushes run the complete release process from the triggering revision while retaining controlled manual releases.

• Builds and publishes the wheel from the triggering checkout.
• verifies that tag-triggered builds match the package version before publication.
• Creates the GitHub release at the triggering SHA and deploys versioned documentation.
• Simplifies build and documentation tasks to operate on the current checkout.
• Adds regression coverage for the release workflow and task contracts.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains; the previously reported tag/package mismatch is now checked before either package upload, and the documented release-candidate tag format is compatible with that check.

Important Files Changed

Filename	Overview
.github/workflows/release.yml	Adds tag-triggered releases, consistently uses the triggering checkout, validates tag/package version identity before publishing, and orchestrates package, GitHub, and documentation releases.
.mise/tasks/build/wheel	Simplifies wheel builds to clean and build the current checkout's dist/ directory.
.mise/tasks/docs.toml	Simplifies documentation build and deployment tasks to run from the current checkout.
tests/tools/test_mise_configuration.py	Adds regression assertions covering release triggers, checkout behavior, publication conditions, version guarding, and current-checkout task contracts.
DEVELOPMENT.md	Removes obsolete separate-project task examples while retaining the stable and release-candidate tag format contract.

Sequence Diagram

sequenceDiagram
    participant Tag as v* tag push
    participant Build as publish-wheel
    participant PyPI as Package registries
    participant GH as GitHub release
    participant Docs as Documentation deployment
    Tag->>Build: Checkout triggering revision
    Build->>Build: Build wheel and derive version
    Build->>Build: Verify tag equals v + wheel version
    Build->>PyPI: Publish wheel
    Build-->>GH: Provide built version and artifact
    GH->>GH: Create release at triggering SHA
    GH-->>Docs: Release completed
    Docs->>Docs: Build and deploy versioned docs

Loading

_{Reviews (4): Last reviewed commit: "fix(release): reject mismatched version ..." | Re-trigger Greptile}