ci(release): GHCR & PyPI on release (OIDC)

.github/workflows/publish-pypi.yml

@@ -1,22 +1,40 @@
 name: publish-pypi
 on:
   release:
-    types: [published]       # se dispara cuando semantic-release crea el release
-  workflow_dispatch:         # también manual si lo necesitas
+    types: [published]
+
 permissions:
-  id-token: write
   contents: read
+  id-token: write
+
+env:
+  PIP_DISABLE_PIP_VERSION_CHECK: "1"
+
 jobs:
-  build-and-publish:
+  pypi:
+    if: startsWith(github.event.release.tag_name, 'v')
     runs-on: ubuntu-latest
     environment: pypi
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
-        with: { python-version: '3.12' }
-      - run: python -m pip install --upgrade pip build
-      - run: python -m build
-      - name: Publish to PyPI (OIDC)
-        uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          skip-existing: true
+          python-version: '3.x'
+      - run: python -m pip install -U pip build
+      - name: Sync version from tag into pyproject.toml
+        env:
+          TAG: ${{ github.event.release.tag_name }}
+        run: |
+          VER="${TAG#v}"
+          export VER
+          python - <<'PY'
+import os, re, pathlib
+ver = os.environ["VER"]
+p = pathlib.Path("pyproject.toml")
+t = p.read_text(encoding="utf-8")
+t = re.sub(r'(?m)^(\s*version\s*=\s*")\d+\.\d+\.\d+(")', rf'\1{ver}\2', t)
+p.write_text(t, encoding="utf-8")
+print("pyproject.toml version ->", ver)
+PY
+      - run: python -m build
+      - uses: pypa/gh-action-pypi-publish@release/v1

.github/workflows/release.yml

@@ -1,37 +1,31 @@
 name: release
 on:
-  push:
-    tags:
-      - 'v*'   # only version tags
+  release:
+    types: [published]
 
 permissions:
   contents: read
   packages: write
 
 jobs:
   ghcr:
+    if: startsWith(github.event.release.tag_name, 'v')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-
-      - name: Set image name (lowercase)
-        shell: bash
-        run: echo "IMAGE=ghcr.io/${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV"
-
       - uses: docker/setup-buildx-action@v3
       - uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-
-      - uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: ./Dockerfile
-          platforms: linux/amd64
-          push: true
-          provenance: false
-          tags: |
-            ${{ env.IMAGE }}:latest
-            ${{ env.IMAGE }}:${{ github.ref_name }}
+      - name: Set env
+        run: |
+          echo "TAG=${{ github.event.release.tag_name }}" >> "$GITHUB_ENV"
+          echo "IMAGE=ghcr.io/${GITHUB_REPOSITORY,,}"   >> "$GITHUB_ENV"
+      - name: Build & push (amd64+arm64)
+        run: |
+          docker buildx build \
+            --platform linux/amd64,linux/arm64 \
+            -t "$IMAGE:$TAG" -t "$IMAGE:latest" \
+            --push .