refactor(ci): switch publish to workflow_dispatch

[pratyush618]

Summary

• Switch publish trigger from tag-push to workflow_dispatch with version input and dry-run toggle
• Preflight job normalizes v prefix, verifies version matches pyproject.toml, checks tag doesn't exist
• Tag + GitHub Release created only after successful PyPI upload
• contents:write scoped to publish job only, actions/checkout pinned to SHA
• Accepts both 0.16.1 and v0.16.1 as input

Test plan

• Dry-run: gh workflow run publish.yml -f version=0.16.1 -f dry-run=true
• Live: gh workflow run publish.yml -f version=0.16.1

Summary by CodeRabbit

• Chores
  • Updated internal release workflow configuration and documentation.

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

📝 Walkthrough

Walkthrough

The publish workflow transitions from automatic tag-triggered releases to manual dispatch with explicit version input and preflight validation. A new preflight job normalizes and validates the version, all build jobs pin their checkout actions to commit SHAs, and publishing steps are now gated on a dry-run flag. The changelog entry is simplified to a generic patch statement.

Changes

Publish Workflow Refactoring

Layer / File(s)	Summary
Workflow dispatch interface and preflight validation .github/workflows/publish.yml	Replaces tag-based push trigger with manual workflow_dispatch accepting version and dry-run inputs. Adds preflight job to normalize the version (strip leading v), validate it against pyproject.toml, verify the remote git tag does not exist, and output normalized version for downstream consumption. Updates build-dashboard job's checkout to pinned SHA.
Build jobs checkout SHA pinning .github/workflows/publish.yml	Updates actions/checkout across all five build jobs (Linux, musllinux, macOS, Windows wheels, and sdist) from floating v6 tag reference to pinned commit SHA for supply-chain integrity.
Publish job dependencies and environment setup .github/workflows/publish.yml	Modifies publish job to depend on preflight output, adds contents: write permission, injects normalized VERSION environment variable from preflight, and pins publish job's actions/checkout to commit SHA.
PyPI validation logic updates .github/workflows/publish.yml	Adjusts wheel-content validation to ignore specific warning codes and updates PyPI pre-publish version/hash conflict check to use the normalized VERSION environment variable instead of GITHUB_REF_NAME.
Conditional publish and release flow .github/workflows/publish.yml	Gates PyPI publishing, artifact verification on PyPI, git tag creation, and GitHub release creation on !inputs.dry-run. Pins gh-action-pypi-publish action to commit SHA. Adds explicit steps to create/push git tag and create GitHub release, both gated on non-dry-run mode. Updates PyPI verification step to use VERSION.
Changelog documentation update docs/content/docs/more/changelog.mdx	Simplifies the 0.16.1 changelog entry to a single generic statement ("Patch release with no user-facing changes") from the previous detailed notes covering PyPI hash pre-checking, wheel validation for PEP 639, timeout guards, and retry fallbacks.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• ByteVeda/taskito#248: Refactors the same publish.yml workflow from tag-triggered push to workflow_dispatch with shared preflight normalization, pinned checkouts, and gated publishing logic.
• ByteVeda/taskito#241: Modifies .github/workflows/publish.yml PyPI publishing logic by adding pre-publish version/hash conflict checks and conditional gh-action-pypi-publish gating behavior.
• ByteVeda/taskito#245: Updates .github/workflows/publish.yml wheel-validation logic to accommodate PEP 639 metadata and adjusts twine version handling.

Suggested labels

ci, docs

Poem

🐰 A publish that once needed tags to fly,
Now springs from buttons, versioned and spry—
Preflight checks dance, dry-runs shine bright,
Wheel pins hold steady, our actions in flight! 🚀

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The pull request title accurately describes the main change: switching the publish workflow from a tag-based push trigger to a manual workflow_dispatch mechanism.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/publish-workflow-overhaul

⚔️ Resolve merge conflicts

• Resolve merge conflict in branch fix/publish-workflow-overhaul

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}