From 38a3184de6390ddebe77553b65f1a08b512639eb Mon Sep 17 00:00:00 2001
From: "Teemu R." <tpr@iki.fi>
Date: Fri, 9 Oct 2026 21:46:57 +0200
Subject: [PATCH] Build and check packages in CI and publish workflows (#1782)

The 0.11.0 upload failed only after the release was tagged and
published, which burned the version number due to immutable releases
(see #1779).

- Add a local `build-packages` action that builds the packages with the
release build constraints and runs `twine check --strict` on them.
- Run it in the lint job, so packaging issues are caught on every PR.
- Use the same action in the publish workflow.
---
 .github/actions/build-packages/action.yaml | 14 ++++++++++++++
 .github/workflows/ci.yml                   |  5 +++++
 .github/workflows/publish.yml              |  8 +++++---
 3 files changed, 24 insertions(+), 3 deletions(-)
 create mode 100644 .github/actions/build-packages/action.yaml

diff --git a/.github/actions/build-packages/action.yaml b/.github/actions/build-packages/action.yaml
new file mode 100644
index 00000000..97341577
--- /dev/null
+++ b/.github/actions/build-packages/action.yaml
@@ -0,0 +1,14 @@
+name: Build Packages
+description: Build the release packages into dist/ and verify their metadata
+runs:
+  using: composite
+  steps:
+    - name: Build Packages
+      id: build-packages
+      shell: bash
+      run: uv build --build-constraints .github/build-constraints.txt
+
+    - name: Check Packages
+      id: check-packages
+      shell: bash
+      run: uvx --with packaging==26.2 twine==7.0.0 check --strict dist/*
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7a54874d..f20afb1e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -45,6 +45,11 @@ jobs:
         run: |
           uv run pre-commit run --all-files --verbose
 
+      # Build the same way as publish.yml to catch packaging issues before a release is tagged.
+      - name: Build and Check Packages
+        id: build-packages
+        uses: ./.github/actions/build-packages
+
   tests:
     name: Python ${{ matrix.python-version}} on ${{ matrix.os }}${{ fromJSON('[" (extras)", ""]')[matrix.extras == ''] }}
     needs: lint
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index fc94377c..b0979e3c 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -26,11 +26,13 @@ jobs:
         version-file: uv.lock
         python-version: ${{ env.PYTHON_VERSION }}
 
-    - name: Build Packages
+    - name: Build and Check Packages
       id: build-packages
-      shell: bash
-      run: uv build --build-constraints .github/build-constraints.txt
+      uses: ./.github/actions/build-packages
 
     - name: Publish Release on PyPI
       id: publish-release-on-pypi
       uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+      with:
+        # Metadata is already verified by the build action, same as in CI.
+        verify-metadata: false