Make release.yml idempotent and tighten permissions (#35)

* Make release.yml idempotent and tighten permissions

The github-release step previously called `gh release create` unconditionally,
which fails with HTTP 422 when a release already exists for the tag - e.g.
when a maintainer publishes the release through the GitHub UI (which also
creates the tag), as happened for v0.1.1.

- Guard with `gh release view ... || gh release create ...` and upload `dist/*`
  to the existing release with `--clobber` when present.
- `permissions: {}` at workflow level, escalated only where needed.
- Drop unused `attestations: write`; PEP 740 attestations are produced by
  pypa/gh-action-pypi-publish v1.11+ from `id-token: write` alone.
- Add `concurrency: cancel-in-progress: false` on the tag ref.
- Verify the tagged commit is an ancestor of origin/main.
- Attach built sdist + wheel to the GitHub Release.
- Fold verify-version into build (no need for a separate runner).

* Simplify release.yml

Drop machinery that wasn't earning its lines:

- The concurrency block - tag-push races are vanishingly rare for this repo.
- UV_FROZEN env - irrelevant; uv build doesn't sync from the lockfile.
- The tag-on-main ancestry check (and its fetch-depth: 0) - the
  tag-vs-pyproject match already catches the common error modes.
- The if/else in github-release. Replace with the cleaner pattern of
  "create the release if missing, then always upload dist/* with --clobber."
  Idempotent on retry without branching.
- --verify-tag and the post-publish info echo - noise.

Use job-level env (GH_REPO, TAG) to drop --repo flags from each gh call.

* Align release.yml with repo conventions

- Add concurrency block matching ci.yml's group key. Use
  cancel-in-progress: false (unlike ci.yml which uses true) so an
  in-flight pypa/gh-action-pypi-publish never gets killed mid-upload.
- Add env: UV_FROZEN: true to match the other uv-using workflows.
- Name the final github-release step, matching the repo pattern of
  naming any step with a multi-line script.

Author: splch

.github/workflows/release.yml

@@ -4,43 +4,33 @@ on:
   push:
     tags: ["v*"]
 
-permissions:
-  contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions: {}
 
 env:
   UV_FROZEN: true
 
 jobs:
-  verify-version:
+  build:
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
       - name: Verify tag matches pyproject version
         run: |
           set -euo pipefail
-          TAG_VERSION="${GITHUB_REF_NAME#v}"
-          PYPROJECT_VERSION=$(python3 -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
-          if [[ "$TAG_VERSION" != "$PYPROJECT_VERSION" ]]; then
-            echo "::error::Tag ${GITHUB_REF_NAME} does not match pyproject.toml version ${PYPROJECT_VERSION}"
-            exit 1
-          fi
-          if curl -sf "https://pypi.org/pypi/ionq-core/${PYPROJECT_VERSION}/json" > /dev/null 2>&1; then
-            echo "::error::Version ${PYPROJECT_VERSION} already exists on PyPI"
+          TAG="${GITHUB_REF_NAME#v}"
+          VERSION=$(python3 -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
+          [[ "$TAG" == "$VERSION" ]] || { echo "::error::Tag $GITHUB_REF_NAME does not match pyproject version $VERSION"; exit 1; }
+          if curl -sf "https://pypi.org/pypi/ionq-core/$VERSION/json" >/dev/null 2>&1; then
+            echo "::error::Version $VERSION already exists on PyPI"
             exit 1
           fi
-          echo "Releasing ionq-core ${PYPROJECT_VERSION}"
-
-  build:
-    needs: verify-version
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-        with:
-          persist-credentials: false
       - uses: ./.github/actions/setup-uv
       - run: uv build
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
@@ -49,7 +39,7 @@ jobs:
           path: dist/
           if-no-files-found: error
 
-  publish:
+  publish-pypi:
     needs: build
     runs-on: ubuntu-latest
     timeout-minutes: 5
@@ -58,7 +48,6 @@ jobs:
       url: https://pypi.org/p/ionq-core
     permissions:
       id-token: write
-      attestations: write
     steps:
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
@@ -67,16 +56,21 @@ jobs:
       - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
 
   github-release:
-    needs: publish
+    needs: publish-pypi
     runs-on: ubuntu-latest
     timeout-minutes: 5
     permissions:
       contents: write
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      GH_REPO: ${{ github.repository }}
+      TAG: ${{ github.ref_name }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
-          persist-credentials: false
-      - name: Create GitHub Release
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh release create "$GITHUB_REF_NAME" --generate-notes
+          name: dist
+          path: dist/
+      - name: Create or update GitHub Release
+        run: |
+          gh release view "$TAG" >/dev/null 2>&1 || gh release create "$TAG" --generate-notes
+          gh release upload "$TAG" --clobber dist/*