fix: checkout release tag in build job and add manual re-publish trigger

Root cause of 0.1.3 not publishing to PyPI: the build job used
actions/checkout@v6 without a ref, so it checked out GITHUB_SHA
(the triggering commit) rather than the release tag. When the
release-please action tags a release during an earlier push, the
build job can check out a commit where pyproject.toml still has
the old version, causing a version mismatch and build failure.

Fixes:
- Build job now checks out the release tag ref explicitly, ensuring
  pyproject.toml always matches the tagged version
- Derive expected version from the tag name instead of the
  release-please version output (more reliable)
- Add workflow_dispatch with a tag input so failed releases can be
  re-published without needing a new commit: run the workflow
  manually with tag=promptfoo-v0.1.3 to re-trigger build+publish
- Run unit tests in the build job before publishing (was just an
  import check before)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: mldangelo

.github/workflows/release-please.yml

@@ -10,10 +10,17 @@ on:
     branches:
       - main
   workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag to publish (e.g. promptfoo-v0.1.3). Use to re-publish a failed release."
+        required: false
+        type: string
 
 jobs:
   release-please:
     runs-on: ubuntu-latest
+    # Skip the release-please bot when manually re-publishing
+    if: github.event_name != 'workflow_dispatch'
     permissions:
       contents: write
       pull-requests: write
@@ -28,13 +35,28 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
 
   build:
-    if: needs.release-please.outputs.release_created == 'true'
     runs-on: ubuntu-latest
-    needs: release-please
     permissions:
       contents: read
+    # Normal release: triggered by release-please creating a release
+    # Manual re-publish: triggered by workflow_dispatch with a tag input
+    if: |
+      (github.event_name == 'workflow_dispatch' && inputs.tag != '') ||
+      (needs.release-please.result == 'success' && needs.release-please.outputs.release_created == 'true')
+    needs: release-please
     steps:
+      - name: Resolve tag
+        id: resolve
+        run: |
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+            echo "tag=${{ inputs.tag }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "tag=${{ needs.release-please.outputs.tag_name }}" >> "$GITHUB_OUTPUT"
+          fi
+
       - uses: actions/checkout@v6
+        with:
+          ref: ${{ steps.resolve.outputs.tag }}
 
       - uses: astral-sh/setup-uv@v7
         with:
@@ -46,22 +68,21 @@ jobs:
       - name: Install dependencies
         run: uv sync --extra dev
 
-      - name: Run tests
-        run: |
-          # Quick smoke test before publishing
-          uv run python -c "import promptfoo; print(promptfoo.__version__)"
+      - name: Run unit tests
+        run: uv run pytest -m 'not smoke' -q
 
       - name: Build package
         run: uv build
 
-      - name: Verify package version matches release
+      - name: Verify package version matches release tag
         run: |
-          EXPECTED_VERSION="${{ needs.release-please.outputs.version }}"
+          TAG="${{ steps.resolve.outputs.tag }}"
+          EXPECTED_VERSION="${TAG#promptfoo-v}"
           if ls dist/*-${EXPECTED_VERSION}-*.whl 1> /dev/null 2>&1; then
-            echo "✓ Package version ${EXPECTED_VERSION} matches release"
+            echo "✓ Package version ${EXPECTED_VERSION} matches release tag ${TAG}"
           else
             echo "ERROR: Package version mismatch!"
-            echo "Expected version: ${EXPECTED_VERSION}"
+            echo "Expected version: ${EXPECTED_VERSION} (from tag: ${TAG})"
             echo "Built packages:"
             ls -la dist/
             exit 1
@@ -74,7 +95,9 @@ jobs:
           path: dist/
 
   publish-pypi:
-    if: needs.release-please.outputs.release_created == 'true'
+    if: |
+      (github.event_name == 'workflow_dispatch' && inputs.tag != '') ||
+      (needs.release-please.result == 'success' && needs.release-please.outputs.release_created == 'true')
     needs: [build, release-please]
     runs-on: ubuntu-latest
     environment: