Publish to PyPI on a push to main that bumps the version

[alecjacobson]

Summary

Adds a check_version job to wheels.yml that gates the PyPI publish on the version in pyproject.toml actually changing.

Heads up: this needs a Trusted Publisher configured on PyPI before it will work — see below.

The existing release job was unreachable

release_artifacts was gated on:

if: github.event_name == 'push' && contains(github.ref, 'refs/tags/')

but the workflow only triggers on push: branches: [main], so github.ref is always refs/heads/main and that condition can never be true. Whatever published 2.6.3.dev1–dev4 was not this job. Worth confirming there isn't another publish path that would now double up.

How the gate works

check_version reads project.version from pyproject.toml at HEAD and at github.event.before, and sets should_release=true only when they differ. It:

• falls back to HEAD^ when before is all-zeros (branch just created) or points at a commit that a force-push removed;
• skips a version that is already on PyPI, so re-running the workflow is safe and doesn't hard-fail on 400 File already exists;
• marks aN / bN / rcN / .devN as GitHub pre-releases (.postN is deliberately not one).

Verified against real commits in this repo's history:

Commit	Transition	Verdict
983b3d5	2.6.3.dev4 → 2.6.3.dev5	RELEASE
eb2783b	unchanged	no release
6f70157	dev3 → dev4	no release (already on PyPI)

Since dev1–dev4 are all on PyPI, "any bump publishes" is treated as intended rather than special-casing dev versions.

Other changes to release_artifacts

• needs: build_sdist as well as build_wheels. It previously needed only build_wheels, so it could publish without the sdist.
• Tags at the bare version (2.6.1), matching the existing tag convention rather than v2.6.1.
• skip-existing: true on the publish step.

pip.yml fix

It triggered on push: branches: [master]. This repo's default branch is main, so the pytest suite has never run on a push to main. One-word fix.

Required PyPI setup

The publish step uses OIDC (id-token: write, no password) and the repo has no secrets configured, so a Trusted Publisher must be added or auth will fail:

pypi.org → project libigl → Manage → Publishing → Add a new publisher → GitHub

• Owner: libigl
• Repository: libigl-python-bindings
• Workflow name: wheels.yml
• Environment: leave blank

Leave the environment blank — this job intentionally has no environment: key, so an environment claim would mismatch. (Alternative: add a PYPI_API_TOKEN secret and password: to the publish step.)

Repo-side is already fine: default workflow permissions are write, so tagging and creating the GitHub release will work.

Not addressed

Nothing gates the release on tests. build_wheels sets no CIBW_TEST_COMMAND, and pip.yml is a separate workflow so it can't be a needs: dependency. Separately, the wheel upload step has continue-on-error: true, so a failed artifact upload won't fail the job — a release could go out with wheels silently missing for a platform. Both are outside the scope of this change but worth a follow-up.

🤖 Generated with Claude Code