ci: accept the established platform release tag convention

workflow:

  rules:

  - if: $CI_PIPELINE_SOURCE == "merge_request_event"

  - if: $CI_COMMIT_TAG =~ /^v2[.]0[.][0-9]+(rc[1-9][0-9]*)?$/

  - if: $CI_COMMIT_TAG =~ /^v2[.]0[.][0-9]+(rc[1-9][0-9]*|-release)?$/

  - if: $CI_PIPELINE_SOURCE == "push" && ($CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH == "develop")

  - if: $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS

    when: never

    - job: python-compatibility

    - job: srm-consumer

  rules:

    - if: '$CI_COMMIT_TAG =~ /^v2[.]0[.][0-9]+(rc[1-9][0-9]*)?$/ && $CI_COMMIT_REF_PROTECTED == "true"'

    - if: '$CI_COMMIT_TAG =~ /^v2[.]0[.][0-9]+(rc[1-9][0-9]*|-release)?$/ && $CI_COMMIT_REF_PROTECTED == "true"'

      when: on_success

      allow_failure: false

    - when: never

1. Review the release scope and applicable OEG-driven acceptance results, and

   merge the intended source/version through the release MR.

2. Create its matching protected tag, for example v2.0.0.

2. The release owner creates its matching protected tag. The existing platform

   convention gives v2.0.0-release for Python package version 2.0.0; plain

   v2.0.0 and candidate v2.0.0rcN remain supported.

   Creating the tag approves publication after successful checks.

   CI builds the wheel and source distribution once, tests those bytes and runs

   the linked SRM consumer. The release matrix and dependency audit also run.

For upload failures, retry the same job with the original artifacts. Inspect the

registry first if a partial upload occurred; never replace published bytes.

A source, version or rebuilt-artifact change needs a fresh version/tag and checks.

## Order across repositories

Verify the candidate wheel directly in SRM before registry publication. Keep

the working protected consumer ref during the first final SDK publication;

do not switch that trigger to a consumer whose setup requires the unpublished

package. Applicable E2E evidence is reviewed here, while full final-platform

acceptance follows the normal SRM image built with the published final package.

After SDK source integration and successful protected-tag publication, verify

the registry files against that tag build's checksums. SRM maintainers then

update pyproject.toml and uv.lock together from the actual registry, run normal

locked checks and publish their image. Update chart/profile references, run

the applicable OEG-driven E2E and review the platform release MRs. The release

owner creates the agreed final platform tags and GitLab Releases. SDK package

availability must precede SRM's dependency installation, even when release

pages and the coordinated platform announcement are created later.

def check_tag(tag, version, protected):

    if not re.fullmatch(r"v2\.0\.\d+(?:rc[1-9][0-9]*)?", tag):

        raise ValueError("Use an immutable v2.0.X or v2.0.XrcN release tag")

    if Version(tag[1:]) != Version(version):

    if not re.fullmatch(r"v2\.0\.\d+(?:rc[1-9][0-9]*|-release)?", tag):

        raise ValueError("Use an immutable v2.0.X-release, v2.0.X or v2.0.XrcN release tag")

    if Version(tag[1:].removesuffix("-release")) != Version(version):

        raise ValueError("Release tag and package version differ")

    if protected != "true":

        raise ValueError("Publication requires a protected release tag")

    "tag,version,protected",

    [

        ("v2.0.0", "2.0.0", "true"),

        ("v2.0.0-release", "2.0.0", "true"),

        ("v2.0.0rc1", "2.0.0rc1", "true"),

    ],

)

        ("v2.0-dev", "2.0.0", "true"),

        ("v2.0.0rc1", "2.0.0rc2", "true"),

        ("v2.0.0", "2.0.0", "false"),

        ("v2.0.0-release", "2.0.0rc5", "true"),

        ("v2.0.0-release", "2.0.0", "false"),

        ("v2.0.0rc5-release", "2.0.0rc5", "true"),

        ("", "2.0.0", "true"),

    ],

)