Build and check packages in CI and publish workflows (#1782)

The 0.11.0 upload failed only after the release was tagged and
published, which burned the version number due to immutable releases
(see #1779).

- Add a local `build-packages` action that builds the packages with the
release build constraints and runs `twine check --strict` on them.
- Run it in the lint job, so packaging issues are caught on every PR.
- Use the same action in the publish workflow.

.github/actions/build-packages/action.yaml

@@ -0,0 +1,14 @@
+name: Build Packages
+description: Build the release packages into dist/ and verify their metadata
+runs:
+  using: composite
+  steps:
+    - name: Build Packages
+      id: build-packages
+      shell: bash
+      run: uv build --build-constraints .github/build-constraints.txt
+
+    - name: Check Packages
+      id: check-packages
+      shell: bash
+      run: uvx --with packaging==26.2 twine==7.0.0 check --strict dist/*

.github/workflows/ci.yml

@@ -45,6 +45,11 @@ jobs:
         run: |
           uv run pre-commit run --all-files --verbose
 
+      # Build the same way as publish.yml to catch packaging issues before a release is tagged.
+      - name: Build and Check Packages
+        id: build-packages
+        uses: ./.github/actions/build-packages
+
   tests:
     name: Python ${{ matrix.python-version}} on ${{ matrix.os }}${{ fromJSON('[" (extras)", ""]')[matrix.extras == ''] }}
     needs: lint

.github/workflows/publish.yml

@@ -26,11 +26,13 @@ jobs:
         version-file: uv.lock
         python-version: ${{ env.PYTHON_VERSION }}
 
-    - name: Build Packages
+    - name: Build and Check Packages
       id: build-packages
-      shell: bash
-      run: uv build --build-constraints .github/build-constraints.txt
+      uses: ./.github/actions/build-packages
 
     - name: Publish Release on PyPI
       id: publish-release-on-pypi
       uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+      with:
+        # Metadata is already verified by the build action, same as in CI.
+        verify-metadata: false