From 749a5ed94fde25552d8b70e0d32720e9557aec74 Mon Sep 17 00:00:00 2001
From: RAHoebe <ronhoebe@gmail.com>
Date: Tue, 13 Oct 2026 16:41:19 +0200
Subject: [PATCH] Fix release version validation and CI SBOM uploads

---
 .github/workflows/ci.yml                |  4 ++++
 .github/workflows/release.yml           |  4 +---
 README.md                               | 15 ++++++++++++++
 pyproject.toml                          |  2 +-
 scripts/check_version.py                | 27 +++++++++++++++++++++++++
 src/omero_data_query_worker/__init__.py |  2 +-
 6 files changed, 49 insertions(+), 5 deletions(-)
 create mode 100644 scripts/check_version.py

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4963bec..9ccabff 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,6 +20,8 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
           cache: pip
+      - name: Check package and runtime versions
+        run: python scripts/check_version.py
       - run: python -m pip install --upgrade pip
       - run: python -m pip install -e '.[test]'
       - run: python -m pytest --cov=omero_data_query_worker --cov-report=term-missing
@@ -67,3 +69,5 @@ jobs:
           image: omero-data-query-worker:ci
           artifact-name: omero-data-query-worker.spdx.json
           output-file: omero-data-query-worker.spdx.json
+          # CI has read-only contents permission; keep the SBOM as a run artifact.
+          upload-release-assets: false
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c243b3f..b2df011 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,9 +24,7 @@ jobs:
           python-version: "3.12"
       - name: Require tag to match package version
         shell: bash
-        run: |
-          version="$(python -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')"
-          test "${GITHUB_REF_NAME}" = "v${version}"
+        run: python scripts/check_version.py --tag "${GITHUB_REF_NAME}"
       - name: Verify SSH-signed release tag
         run: |
           git config gpg.format ssh
diff --git a/README.md b/README.md
index 1c16278..87ffcc4 100644
--- a/README.md
+++ b/README.md
@@ -94,6 +94,21 @@ The smoke test builds the container, queries fixtures for all three formats,
 checks result caching and unsafe-SQL rejection, restarts the service, and
 confirms that its cache survives.
 
+## Releases
+
+Update both `pyproject.toml` and `src/omero_data_query_worker/__init__.py` before
+creating a release. Run `python scripts/check_version.py --tag vX.Y.Z`, then
+create an SSH-signed tag using a signer listed in `.github/release-signers`.
+The publication workflow checks both versions and the tag signature before
+publishing the multi-platform container to GHCR with SBOM and provenance
+attestations. CI keeps its separate SPDX SBOM as a workflow artifact and does
+not modify GitHub releases.
+
+Version 0.2.1 accidentally tagged the unchanged 0.2.0 source and did not publish
+a container. Version 0.2.2 corrects the release metadata and CI artifact handling;
+it does not change the worker API or query behavior. Existing published tags
+are preserved rather than moved to different commits.
+
 ## License
 
 Copyright NL-BioImaging contributors. Licensed under
diff --git a/pyproject.toml b/pyproject.toml
index 913dbbd..58ac247 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "omero-data-query-worker"
-version = "0.2.0"
+version = "0.2.2"
 description = "A hardened, OMERO-agnostic service for bounded queries over DuckDB, SQLite, and CSV sources"
 readme = "README.md"
 requires-python = ">=3.11,<3.14"
diff --git a/scripts/check_version.py b/scripts/check_version.py
new file mode 100644
index 0000000..531914a
--- /dev/null
+++ b/scripts/check_version.py
@@ -0,0 +1,27 @@
+"""Check release versions without installing the worker or its dependencies."""
+
+import argparse
+import runpy
+import tomllib
+from pathlib import Path
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--tag", help="Release tag, which must be v<package version>")
+    args = parser.parse_args()
+    root = Path(__file__).resolve().parents[1]
+    with (root / "pyproject.toml").open("rb") as metadata:
+        package_version = tomllib.load(metadata)["project"]["version"]
+    runtime_version = runpy.run_path(root / "src/omero_data_query_worker/__init__.py")[
+        "__version__"
+    ]
+    if runtime_version != package_version:
+        parser.exit(1, f"Runtime version {runtime_version} != package version {package_version}\n")
+    if args.tag is not None and args.tag != f"v{package_version}":
+        parser.exit(1, f"Release tag {args.tag} != expected v{package_version}\n")
+    print(f"Versions match: {package_version}")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/src/omero_data_query_worker/__init__.py b/src/omero_data_query_worker/__init__.py
index 9da50c1..f0e8e35 100644
--- a/src/omero_data_query_worker/__init__.py
+++ b/src/omero_data_query_worker/__init__.py
@@ -1,3 +1,3 @@
 """Hardened tabular data query worker."""
 
-__version__ = "0.2.0"
+__version__ = "0.2.2"