[ci] Add package-hardening CI that validates and smoke-tests built distributions

.github/workflows/package.yml

@@ -0,0 +1,46 @@
+name: package
+
+on:
+  push:
+    branches:
+      - master
+      - develop
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  package:
+    name: Build and validate distributions
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v7
+
+      - name: Setup Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+
+      - name: Install packaging tools
+        run: python -m pip install --upgrade build twine
+
+      - name: Build source and wheel distributions
+        run: python -m build
+
+      - name: Validate distribution metadata
+        run: python -m twine check --strict dist/*
+
+      - name: Install wheel in a clean environment
+        run: |
+          python -m venv "$RUNNER_TEMP/pyerrors-wheel-smoke"
+          "$RUNNER_TEMP/pyerrors-wheel-smoke/bin/python" -m pip install dist/*.whl
+          "$RUNNER_TEMP/pyerrors-wheel-smoke/bin/python" -m pip check
+
+      - name: Verify installed wheel
+        run: |
+          cd "$RUNNER_TEMP"
+          "$RUNNER_TEMP/pyerrors-wheel-smoke/bin/python" -c 'import importlib.metadata as metadata; import os; from pathlib import Path; import pyerrors; assert pyerrors.__version__ == metadata.version("pyerrors"); assert not Path(pyerrors.__file__).resolve().is_relative_to(Path(os.environ["GITHUB_WORKSPACE"]).resolve()); print(f"validated {pyerrors.__version__} from {pyerrors.__file__}")'

.github/workflows/release.yml

@@ -40,6 +40,7 @@ jobs:
         if-no-files-found: error
 
   publish:
+    if: github.event_name == 'release'
     needs: [build]
     name: Upload to PyPI
     runs-on: ubuntu-latest