fix: do not fail the release when pyproject.toml is already current (#18)

## The defect

The release step added in #17 commits the computed version unconditionally:

```sh
git add pyproject.toml
git commit -m "chore(release): v${VERSION}"
```

If `pyproject.toml` already carries that version — a re-run of a release, or a version corrected by hand — nothing is staged, `git commit` exits non-zero, and `set -euo pipefail` fails the job. By that point the image has already been pushed, so the release is half-done: published container, no tag. The next run then computes the same version again from the same commits.

## The fix

Skip the commit and its branch push when there is nothing staged; tag either way.

## Verification

The step was extracted from the workflow and run against a scratch repository with a real `origin`:

- `VERSION` equal to the file's version → logs `pyproject.toml is already at 0.1.0`, pushes the tag, no commit.
- `VERSION` different → commits `chore(release): v0.2.0`, pushes the branch, then the tag.

Both paths leave `main` and the tags consistent. `bash -n` clean.

Found while porting this same release scheme to `music-mirror`, which carries the guarded version from the start.

---------

Co-authored-by: Emma Thorpe <emma.thorpe@citrix.com>
Reviewed-on: #18

.gitea/workflows/build-and-publish.yaml

@@ -153,15 +153,54 @@ jobs:
             org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
             org.opencontainers.image.revision=${{ github.sha }}
 
-      # Record the release as an annotated git tag so the next run computes the
+      # Record the release: write the computed version into pyproject.toml, then
-      # following version from it. This push does not re-trigger the workflow,
+      # commit and tag it, so the packaging metadata always matches the release
-      # which only listens on the main branch and pull requests.
+      # instead of drifting behind it. The version is derived from commit
-      - name: Tag the release
+      # messages and only known here, after the build, so it cannot be set by
+      # hand in the pull request that causes the release.
+      #
+      # Neither push re-triggers this workflow: it listens on main only for the
+      # image-affecting paths above, and pyproject.toml is not one of them. The
+      # chore(release) subject also produces no bump of its own on the next run.
+      - name: Record and tag the release
         if: steps.version.outputs.release == 'true'
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
         run: |
           set -euo pipefail
-          v="v${{ steps.version.outputs.version }}"
+
+          python - "$VERSION" <<'PY'
+          import pathlib
+          import re
+          import sys
+
+          version = sys.argv[1]
+          path = pathlib.Path("pyproject.toml")
+          text = path.read_text()
+          text, count = re.subn(
+              r'(?m)^version = ".*"$', f'version = "{version}"', text, count=1
+          )
+          if count != 1:
+              raise SystemExit("no version line found in pyproject.toml")
+          path.write_text(text)
+          PY
+
           git config user.name "${{ github.actor }}"
           git config user.email "${{ github.actor }}@users.noreply.${REGISTRY}"
-          git tag -a "$v" -m "$v"
+          git add pyproject.toml
-          git push origin "$v"
+
+          # The file may already carry this version, in which case there is
+          # nothing to commit and `git commit` would fail the job after the
+          # image has already been pushed.
+          if git diff --cached --quiet; then
+            echo "pyproject.toml is already at ${VERSION}"
+          else
+            git commit -m "chore(release): v${VERSION}"
+            # Push the branch before the tag. If main has moved on and this push
+            # is rejected, the job fails without having left a tag pointing at a
+            # commit that is not on main.
+            git push origin "HEAD:${GITHUB_REF_NAME}"
+          fi
+
+          git tag -a "v${VERSION}" -m "v${VERSION}"
+          git push origin "v${VERSION}"

pyproject.toml

@@ -4,7 +4,10 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "legacy-email-proxy"
-version = "0.3.0"
+# Written by the release job in .gitea/workflows/build-and-publish.yaml, which
+# derives the version from conventional commits and tags the result. Do not
+# edit by hand: a hand-set value is overwritten at the next release.
+version = "0.4.0"
 description = "Unauthenticated POP3/SMTP front end proxied to authenticated IMAPS/SMTPS backends"
 readme = "README.md"
 requires-python = ">=3.12"