Fix release version validation and CI SBOM uploads

.github/workflows/ci.yml

@@ -20,6 +20,8 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
           cache: pip
+      - name: Check package and runtime versions
+        run: python scripts/check_version.py
       - run: python -m pip install --upgrade pip
       - run: python -m pip install -e '.[test]'
       - run: python -m pytest --cov=omero_data_query_worker --cov-report=term-missing
@@ -67,3 +69,5 @@ jobs:
           image: omero-data-query-worker:ci
           artifact-name: omero-data-query-worker.spdx.json
           output-file: omero-data-query-worker.spdx.json
+          # CI has read-only contents permission; keep the SBOM as a run artifact.
+          upload-release-assets: false

.github/workflows/release.yml

@@ -24,9 +24,7 @@ jobs:
           python-version: "3.12"
       - name: Require tag to match package version
         shell: bash
-        run: |
-          version="$(python -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')"
-          test "${GITHUB_REF_NAME}" = "v${version}"
+        run: python scripts/check_version.py --tag "${GITHUB_REF_NAME}"
       - name: Verify SSH-signed release tag
         run: |
           git config gpg.format ssh

README.md

@@ -94,6 +94,21 @@ The smoke test builds the container, queries fixtures for all three formats,
 checks result caching and unsafe-SQL rejection, restarts the service, and
 confirms that its cache survives.
 
+## Releases
+
+Update both `pyproject.toml` and `src/omero_data_query_worker/__init__.py` before
+creating a release. Run `python scripts/check_version.py --tag vX.Y.Z`, then
+create an SSH-signed tag using a signer listed in `.github/release-signers`.
+The publication workflow checks both versions and the tag signature before
+publishing the multi-platform container to GHCR with SBOM and provenance
+attestations. CI keeps its separate SPDX SBOM as a workflow artifact and does
+not modify GitHub releases.
+
+Version 0.2.1 accidentally tagged the unchanged 0.2.0 source and did not publish
+a container. Version 0.2.2 corrects the release metadata and CI artifact handling;
+it does not change the worker API or query behavior. Existing published tags
+are preserved rather than moved to different commits.
+
 ## License
 
 Copyright NL-BioImaging contributors. Licensed under

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "omero-data-query-worker"
-version = "0.2.0"
+version = "0.2.2"
 description = "A hardened, OMERO-agnostic service for bounded queries over DuckDB, SQLite, and CSV sources"
 readme = "README.md"
 requires-python = ">=3.11,<3.14"

scripts/check_version.py

@@ -0,0 +1,27 @@
+"""Check release versions without installing the worker or its dependencies."""
+
+import argparse
+import runpy
+import tomllib
+from pathlib import Path
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--tag", help="Release tag, which must be v<package version>")
+    args = parser.parse_args()
+    root = Path(__file__).resolve().parents[1]
+    with (root / "pyproject.toml").open("rb") as metadata:
+        package_version = tomllib.load(metadata)["project"]["version"]
+    runtime_version = runpy.run_path(root / "src/omero_data_query_worker/__init__.py")[
+        "__version__"
+    ]
+    if runtime_version != package_version:
+        parser.exit(1, f"Runtime version {runtime_version} != package version {package_version}\n")
+    if args.tag is not None and args.tag != f"v{package_version}":
+        parser.exit(1, f"Release tag {args.tag} != expected v{package_version}\n")
+    print(f"Versions match: {package_version}")
+
+
+if __name__ == "__main__":
+    main()

src/omero_data_query_worker/__init__.py

@@ -1,3 +1,3 @@
 """Hardened tabular data query worker."""
 
-__version__ = "0.2.0"
+__version__ = "0.2.2"