From 7f1ceec69bc9dd92c4a05343f7d2b014c251a68b Mon Sep 17 00:00:00 2001
From: Sudhanshu Sali <salisudhanshu@gmail.com>
Date: Wed, 8 Jul 2026 16:49:09 -0400
Subject: [PATCH] ci: publish a GitHub Release instead of a bare tag
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

python-deequ historically ships GitHub Releases (v1.1.0..v1.6.0), not bare
tags. Replace the 'git tag + push' step with 'gh release create v${VERSION}
--target ${RELEASE_SHA} --generate-notes', which creates the tag AND the
Release page in one call, pinned to the published commit, after the PyPI
upload. Idempotent (skips if the release already exists).

Note: this change was intended for #281 but landed on that branch after it had
already merged, so it never reached master — hence this follow-up PR.
---
 .github/workflows/publish.yml | 29 ++++++++++++++++++-----------
 1 file changed, 18 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index aa56083..e65db1a 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -132,8 +132,9 @@ jobs:
 
   tag-and-bump:
     # Runs ONLY after a successful real publish (needs: publish gates on
-    # success). Creates the release tag as a record of what is now on PyPI (tag
-    # after publish, never before), then opens a PR recording the version.
+    # success). Creates the GitHub release (and its tag) as a record of what is
+    # now on PyPI — after publish, never before — then opens a PR recording the
+    # version.
     needs: publish
     if: ${{ !inputs.dry_run }}
     runs-on: ubuntu-latest
@@ -160,18 +161,24 @@ jobs:
       - name: Install Poetry
         run: pip install poetry==1.7.1
 
-      - name: Tag the published release
-        # Tag the exact published commit, now that PyPI has the artifact.
-        # Idempotent: skip if the tag already exists remotely.
+      - name: Create GitHub release
+        # Create a GitHub release (which also creates the v${VERSION} tag) on the
+        # exact published commit, now that PyPI has the artifact — matching the
+        # repo's historical convention of publishing Releases, not bare tags.
+        # Idempotent: skip if the release already exists. Note --target is
+        # honored only when the tag is new; on an already-existing tag GitHub
+        # ignores it (releases must always use a fresh version, per above).
         run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          if git ls-remote --exit-code --tags origin "v${VERSION}" >/dev/null 2>&1; then
-            echo "Tag v${VERSION} already exists — skipping."
+          if gh release view "v${VERSION}" >/dev/null 2>&1; then
+            echo "Release v${VERSION} already exists — skipping."
           else
-            git tag -a "v${VERSION}" "${RELEASE_SHA}" -m "Release ${VERSION}"
-            git push origin "v${VERSION}"
+            gh release create "v${VERSION}" \
+              --target "${RELEASE_SHA}" \
+              --title "v${VERSION}" \
+              --generate-notes
           fi
+        env:
+          GH_TOKEN: ${{ github.token }}
 
       - name: Record release version in master and open PR
         # Records the just-released version in the repo (sets pyproject +